We are excited to share the next evolution of the Nebulock platform: Agentic Cybersecurity Engineering (ACE). The ACE platform unifies threat hunting, detection engineering, insider risk, and alert triage on a single architecture. Not four separate products bundled together, but one platform where the same security practitioner does all four workflows with AI agents automating the repetitive parts.
ACE works with any SIEM, any data lake, or by directly connecting to different security tools (no centralized storage needed). Security engineers can query sources directly when needed without a forced rip-and-replace of storage infrastructure.
Unifying with built-in AI, not bolt-on AI
Some vendors are trying to modernize by adding AI to their SIEM. This lets SOCs analyze logs with a natural language chatbot, using an MCP to query the data. This is the same architecture, just a new interface. AI isn’t just for querying. It’s for unifying workflows and transforming security roles themselves.
Alert triage, threat hunting, detection engineering, and insider risk are all related, but they’ve been artificially separated by tooling, not a natural division. Hunt findings become detection rules. Detection rules need hunting to validate coverage. Insider risk uses the same behavioral analytics as threat hunting. All four jobs query the same data and need the same enrichment context.
When platforms let you unify workflows and AI automates the repetitive parts, the roles converge. That’s ACE, one discipline on one platform designed for any adversary. Here’s how we do it.
Behavioral detection across security telemetry
The ACE platform targets TTPs, not IOCs. Alert-first SIEMs live at the bottom of the pyramid of pain, using known-bad signatures and IOCs to reactively respond to threats. ACE is hunt-first, so it lives at the top of that pyramid using behavioral detection of TTPs to find novel attacks based on their shape, not on known indicators. Modern adversaries can easily rotate infrastructure and update artifacts, but changing an attack’s behavior is a lot harder.
Baselines that track entity relationships over time
Nebulock's TRACE Graph maintains baselines for each user, device, application, etc. so we know what normal is for your environment. By combining baselines and behavioral analysis, the ACE platform can power all the use cases of a security engineer. With a SIEM, a vendor says True Positive, but there’s no easy way to verify that finding in the context of your specific environment. With ACE, your baselines determine what’s normal behavior for specific users in a specific environment under specific circumstances. Baselines reduce alerts, streamline hunts, proactively identify needed rule coverage, and spot insider threats from weak signals that are otherwise overlooked.
Proactive continuous hunting (not reactive alert triage)
On our platform, agents query telemetry and enrichment data before alerts fire, autonomously managing most alerts without human assistance. This means reactive alert triage becomes a small part of a security engineer’s workload. Instead, engineers can focus on proactive threat hunts that generate findings, intelligence, and detections for both external and internal threats.
Modular by design
The data layer and behavioral system of record (TRACE Graph) on ACE stays the same, but new functions get added as the security engineer role evolves. We enable threat hunting, detection engineering, insider risk, and alert triage today, but our modularity allows us to extend the platform to cover more roles (ex. agentic threat research) without clunky, bolt-on workflows. As security engineering evolves with AI, the platform evolves with it.
AI for upleveling, not for replacing
Nebulock’s AI agents are automating work that used to require full-time human hours. This is a good thing. Because our platform ingests, triages, and helps scope all the alerts SOCs care about, security analysts don’t spend their time deciding, “Is this CrowdStrike alert real?” Instead, they spend their time hunting for threats, generating detections from findings, researching emerging intelligence, and investigating insider risks.
This is AI upleveling, not AI replacing. By handing off time-intensive tasks to agents, SOCs gain the capacity to do the hard work that requires human judgment.
Before AI, security analysts and detection engineers had to be separate roles. Alert triage alone could fill the day for a team of analysts. The issue wasn’t the complexity of triage, it was always capacity and context switching. Humans can only work so fast, and constant context switching only slows us down. AI doesn’t have these specific limitations.
So with AI, these two roles can be collapsed into the single role of a security engineer. One team (or a team of one) can do the threat hunting, detection engineering, insider risk, and alert oversight, all on one platform with AI agents handling the repetitive parts. It’s not less security work, it’s better security work.
Why security roles were divided
SIEMs as the core SOC infrastructure was built for a different era. Centralized log storage could handle the volume of data and correlation rules could stop predictable attack patterns. That architecture worked in 2010, not in 2026.
But even when it worked, you still had to sacrifice data or money. SIEMs could centralize your data, but the data model was too expensive to unify operations. To query data in a SIEM, you had to ingest it first. That meant expensive storage (even with tiers), ingest costs that scaled with data volume, slow deployment with ETL pipelines for each new source, and ultimately, having to decide what you could afford to ingest.
So workflows fragmented. Threat hunting stayed in the SIEM. Detection engineering moved to EDR and XDR. Insider risk got its own UEBA products. This left analysts living in the alerts spanning all of these systems. Separate teams, separate tools, separate disciplines.
ACE ends this disconnect.
Nebulock is the ACE platform
Nebulock was built to hunt from the very start, not alert triage with hunt features added. We knew that a hunt-first platform focused on behaviors and context almost eliminates the need to do alert triage in the traditional sense. This also means that we don’t have the technical debt of starting from the legacy alert-first workflows.
The AI-SOC industry jumped the gun to get marketing wins and be the first to claim AI in cybersecurity. They rebuilt the exact same problems that the linear SOC model always had by starting from alert triage, and are only now adding the proactive hunt capability. We started with the hunt and made alert triage less important along the way.
The technical debt difference is architectural. You can’t backfill hunt-first on top of alert-first infrastructure. Nebulock is different, and the proof can be seen in the 375M+ investigations we’ve run over two years. We have turned our hunts into deep intelligence and thousands of behavioral detections. Every hunt makes us stronger. Alerts don’t have that kind of impact.
On the ACE platform, you uplevel your whole team to security engineers. All the while not losing capabilities you have today. Nebulock automates the rote work while enabling you to do the harder tasks that require human judgment.
Up-leveling without replacing.
.webp)
