The Vega II Launch: Cyber Defense At The Frontier
Welcome to the Post-SIEM Era: Reclaim the Advantage with Agentic Cyber Defense
The Problem
- Attackers are already at the frontier. Threat actors adopt new AI models the week they ship. Most SOCs are still running workflows designed before any of those models existed.
- Your data is stuck behind pipelines. Legacy SIEM economics force you to choose what to ingest, so investigations run on whatever made it in, not on everything you have.
- Your SOC forgets everything it learns. Every verdict, correction, and environment detail disappears when the ticket closes. The next analyst, or the next agent, starts from zero.
- General-purpose AI was never trained for this. Frontier models are brilliant generalists. None of them were post-trained on how a security investigation actually works.
The Solution: Vega II
Vega II is Agentic Cyber Defense: a model trained for cyber defense, memory that outlasts every ticket, and access to all your data wherever it lives, without forcing it into a legacy SIEM first.
- The first open-weight model trained for cyber defense. Vega’s proprietary model sits beside frontier models in the harness, so triage and investigation start from expert judgment rather than general reasoning. It executes searches, investigations, and triage dynamically based on case severity.
- Vega Memory. Holds your environment’s ground truth and every action taken, on your private tenant. Agents remember past verdicts and analyst corrections instead of repeating the same work on the next alert.
- Vega Gateway. Streams any source into low-cost object storage over OpenTelemetry, webhook, or API, where it’s indexed, mapped, and searchable. No new pipeline, no ingestion tax.
- Query data in place, across everything you already run. Vega analyzes data where it resides, across data lakes, object storage, security tools, and your existing SIEM. Customers have cut storage and ingestion costs by up to 82% compared to legacy SIEM ingestion. (Aside: confirm the 82% has an approved source attached before this goes to DemandScience; the “half a day to minutes” line further down needs a named customer or the section header “Customer Metrics” should be softened.)
Key Features & Capabilities
- Unified Loop Operations: Detections, triage, investigations, and optimizations run continuously in a single automated loop.
- Open Standard Detection Skills: Uses an open-source framework on GitHub that enables engineering teams to define how AI agents investigate, triage, and tune detections.
- Complete Control & Auditability: Eliminates black-box decisions by ensuring every agent reasoning path, query, and memory source remains completely inspectable and transparent.
Proven Impact (Customer Metrics & Highlights)
- Investigation Acceleration: Reduces incident investigation timelines from half a day or hours down to just minutes.
- Zero-Drama Deployment: Integrates plug-and-play into existing environments without requiring legacy systems to be immediately ripped out.
- Shift to Cyber Defense Engineering: Empowers SOC analysts to transition from clearing repetitive queues to engineering autonomous defense strategies that scale.
White Paper from 