Embed Security lets analysts teach its AI SOC Platform how to investigate

Embed Security announced new capabilities that let security teams teach Embed how they investigate, what matters in their environment, and how to improve their detections.

With customer-built iSteps, expanded NoiseIQ Memories, and Detection Engineering, organizations can extend Embed’s built-in security expertise with their own knowledge and operating practices. Rather than programming workflows, analysts can teach Embed what they know, and its decision layer applies that expertise autonomously.

“Everyone is telling security teams to build agents. We think security teams should be teaching AI, not building it,” said Seth Summersett, CEO of Embed Security. “Analysts already know how to investigate. Our job is to make that expertise executable and apply it consistently across every investigation.”

Customer-built iSteps: Making security expertise executable

Embed’s library of iSteps is engineered by its security and AI experts, combining deterministic logic with LLM reasoning for consistency and robustness. Customer-built iSteps extend this library, letting teams capture their own investigative expertise as natural-language investigation agents that run on the same orchestration framework. Analysts describe how they approach a security question, and Embed transforms their expertise into executable investigations that run autonomously when relevant, without requiring customers to program AI workflows.

NoiseIQ Memories: Organizational context that evolves with your business

Building on NoiseIQ’s organizational context capabilities, Memories expands how teams teach Embed about their environment. Rather than relying solely on predefined relationships, Embed dynamically connects organizational knowledge with investigative evidence, including context that changes over time. This enables accurate, context-aware decisions without requiring analysts to anticipate every scenario.

Detection Engineering: Turning investigation outcomes into better detections

Embed’s new Detection Engineering capabilities leverage investigation outcomes to help security teams identify and improve detections across endpoint, cloud, email, and identity. Analyzing investigated alerts, Embed provides visibility into detection performance and recommends improvements to customer-authored detections in supported SIEM platforms, giving teams actionable insights and ready-to-apply recommendations.

“Every investigation Embed runs tells us something about the detection that triggered it,” said Jeffrey Johns, CTO of Embed Security. “Detection Engineering closes that loop, turning investigation outcomes into actionable intelligence teams can use to improve the detections themselves.”