Embed Security Adds Customer-Built AI Investigation Agents
Embed Security has added customer-built investigation agents, expanded NoiseIQ Memories and Detection Engineering to its AI SOC platform. The company says the capabilities let security teams teach Embed their investigative methods, organizational context and detection priorities.
- Customer-built iSteps turn natural-language expertise into autonomous investigations.
- NoiseIQ Memories connects changing organizational knowledge with investigative evidence.
- Detection Engineering recommends improvements to customer-authored detections.
- The capabilities cover endpoint, cloud, email and identity environments.
Security teams can turn expertise into investigations
The new customer-built iSteps extend Embed Security's existing library of investigation agents. The company's security and AI experts build that library using deterministic logic and large language model reasoning, while the new capability allows customers to capture their own investigative expertise in natural language.
Analysts describe how they approach a security question, and Embed transforms that guidance into executable investigations. These investigations can run autonomously when relevant on the same orchestration framework as Embed's built-in iSteps, without requiring customers to program AI workflows.
Embed said the approach is intended to let analysts teach the platform what matters in their environments rather than build workflows themselves. “Everyone is telling security teams to build agents. We think security teams should be teaching AI, not building it,” Seth Summersett, co-founder and CEO of Embed Security, said in the company's announcement.
NoiseIQ Memories adds changing organizational context
Embed's expanded NoiseIQ Memories builds on the platform's organizational context capabilities. The company said Memories can dynamically connect organizational knowledge with investigative evidence, including information that changes over time.
This extends the platform beyond relying only on predefined relationships. According to Embed, the capability helps it make context-aware decisions without requiring analysts to anticipate every possible scenario in advance.
The changes are designed to let teams teach Embed more about their environment as their business develops. That context is then available to the platform's investigative decision layer alongside the evidence associated with an alert.
Detection Engineering links investigations to detection improvements
Embed's Detection Engineering capabilities use investigation outcomes to help security teams assess and improve detections across endpoint, cloud, email and identity environments. The company said it analyzes investigated alerts to provide visibility into detection performance.
The capability also recommends improvements to customer-authored detections in supported security information and event management platforms. Embed described these as actionable insights and ready-to-apply recommendations.
“Every investigation Embed runs tells us something about the detection that triggered it,” Jeffrey Johns, CTO of Embed Security, said. “Detection Engineering closes that loop, turning investigation outcomes into actionable intelligence teams can use to improve the detections themselves.”
For users, the announcement points to a platform that combines customer-provided expertise, evolving organizational context and feedback from completed investigations. Embed Security said its platform is designed to scale expert security reasoning across security operations. The company was founded in 2024 by cybersecurity and AI practitioners from Mandiant, Google and the NSA, and said it is SOC 2 Type II compliant.
