Swimlane has introduced new capabilities to its Swimlane Turbine platform, enabling security teams to create custom detection logic, analyze large datasets and route alerts directly into Swimlane AI SOC for investigation and response. The October 2026 update also introduces bidirectional Model Context Protocol (MCP) support and a new Hero AI Application Builder Agent that allows organizations to develop security applications and workflows using natural-language instructions.
The enhancements address emerging security challenges associated with enterprise adoption of AI agents, MCP servers, copilots and local AI models. Threats such as prompt injection, unauthorized AI usage and compromised security guardrails may escape conventional detection tools that rely on predefined vendor rules. By supporting AI detection and response (AIDR) use cases, Swimlane enables organizations to identify AI-related threats through detection logic tailored to their environments, including scenarios where commercial security products do not provide adequate coverage.
Traditional AI SOC solutions have largely concentrated on automating alert triage, investigation and response. However, these capabilities depend on security technologies generating relevant alerts in the first place.
As organizations expand their AI deployments, emerging threats and environment-specific behaviors may not align with existing vendor-defined detection rules. Similar challenges affect organizations outside AI security, where suspicious activity can vary considerably across industries, including government agencies, manufacturing environments and managed security service providers (MSSPs).
Swimlane Turbine addresses these detection gaps through large-scale data processing that allows organizations to execute custom detection logic and feed the resulting alerts into Swimlane AI SOC. Its parallel processing architecture enables a single big data action to evaluate tens of thousands of records across multiple compute nodes, supporting enterprise-scale detection and more comprehensive security investigations.
“The security industry has spent the last two years debating how autonomously AI can work an alert, but that skips a more basic question: where did the alert come from?” said Cody Cornell, Co-Founder and CEO of Swimlane. “As AI introduces new risks faster, investigation depth and quality are going to become essential,vendor-defined detections alone don’t paint the full picture, the teams closest to those environments need a way to define what matters to them. Turbine gives them that control, then connects the resulting alert directly to investigation and response.”
The expanded detection functionality extends Turbine’s role across the security detection and response lifecycle while maintaining compatibility with existing enterprise security infrastructure. Organizations can continue ingesting alerts from SIEM, EDR, cloud security and other security technologies while supplementing those sources with organization-specific detections that trigger agentic investigation and governed response through Swimlane AI SOC.
The new capabilities allow security teams to define detection conditions specific to their operational requirements, including monitoring local AI model activity, identifying unsanctioned AI accounts, detecting sensitive information submitted to AI services and recognizing prompt injection attempts or disabled security guardrails.
Turbine also supports AI-assisted detection authoring through its playbook generation functionality. Security practitioners can describe the detection behavior they need and use the platform to help construct the corresponding detection logic. Combined with parallel processing across large datasets, this approach is designed to make customized security detection more accessible and scalable.
Beyond detection improvements, the October update introduces bidirectional MCP functionality, expanding how AI agents interact with external tools and enterprise security automation.
With Turbine operating as an MCP host, Hero AI can access tools provided by third-party MCP servers during investigations and automated playbooks. Authentication and access remain centrally managed, allowing organizations to maintain oversight of external tool interactions.
Turbine can also function as an MCP server, enabling external AI assistants and agents, including Claude, ChatGPT, Cursor, Gemini CLI and Microsoft Copilot, to invoke governed Turbine components. These include multi-step automation playbooks that operate within established role-based access controls.
The platform additionally supports MCP and API bridging, allowing organizations to combine external MCP-compatible tools with Swimlane’s existing API integrations. This provides a way to incorporate AI agents into established security workflows without replacing existing integration architectures.
“MCP is most useful when it becomes part of the operating model, not just another integration,” said Srikant Vissamsetti, Chief Operating Officer at Swimlane. “Turbine can use tools from external MCP servers, expose governed automation back to AI clients and combine both with the API integrations customers already rely on. That gives security teams a practical way to bring agents into real workflows without giving up the controls and automation already in place.”
The release also introduces the Hero AI Application Builder Agent, which uses natural-language prompts to simplify the creation and modification of applications within Turbine.
Security teams can describe their requirements to generate or update applications, record structures, layouts and workflows without manually configuring every component. The functionality is intended to reduce development effort when adapting security automation to new operational requirements.
Human oversight remains part of the application development process. AI-generated modifications are highlighted for review and are not saved automatically. Users can examine proposed changes and choose whether to accept or reject them before they become permanent.
Together, these enhancements expand Swimlane’s approach to agentic AI automation across security operations. Swimlane AI SOC uses intelligent routing to determine whether a task should be handled through deterministic automation, AI-assisted investigation or fully agentic investigation, depending on the reasoning and operational complexity involved.
Customer-defined detection provides an additional mechanism for initiating these workflows, allowing security teams to establish their own conditions for investigation and response based on organizational data and security expertise.
Rather than replacing established detection platforms or requiring every security activity to be processed by an AI model, Swimlane is extending its governed automation environment to combine traditional security tools, custom detection logic, AI capabilities and deterministic workflows.
The new Swimlane Turbine capabilities, including customer-defined detection logic, bidirectional MCP support and the Hero AI Application Builder Agent, are now generally available.
Organizations can learn more about Swimlane Turbine, request a demonstration or register for the upcoming webinar, AI Reasoning Meets Reliability: An Operating Model for the SOC, scheduled for November 12 at 11:00 A.M ET.
___________
About Swimlane
At Swimlane, we believe the convergence of agentic AI and automation can solve the most challenging security, compliance and IT/OT operations problems. With Swimlane, enterprises and MSSPs benefit from the world’s first and only AI automation platform for every security function. Only Swimlane gives you the scale and flexibility to unify security teams, tools and telemetry, ensuring today’s SecOps are always a step ahead of tomorrow’s threats. Learn more: swimlane.com
Join our LinkedIn group Information Security Community!
