Built by a detection engineer who wanted the boring half of the job automated.
Kyrolan builds AI agents that run the detection engineering lifecycle, from threat research to tuning live rules. Engineers review every stage and decide what ships.
Hiệu Nguyễn
Founder & CEODetection engineer who builds the agents and the detections they write.
It started with the same three problems every detection team has.
Writing a good detection is only part of the job. Most of the time goes into the work around it, and that work rarely gets done well when the team is small.
A backlog that only grows
Every new threat report adds techniques to cover. Turning each one into a tested rule takes days of research, data checks and testing.
Rules that get noisy
A rule that was clean at launch slowly fills the queue with benign alerts. Re-tuning it carefully always loses to the next new rule.
Coverage by guesswork
Answering "are we covered for this technique?" usually means a spreadsheet, not evidence from deployed rules and live data.
Kyrolan hands the repetitive, evidence-heavy steps to agents: research, data checks, drafting, simulation, measuring noise. The judgement calls stay with your engineers.
Three principles we hold the agents to.
Evidence over assertion
Every claim an agent makes links to the query, event or source behind it. No evidence, no claim.
Engineers decide
Agents propose and open merge requests. A named engineer approves anything that reaches production.
Honest about uncertainty
When data is missing or a test is inconclusive, the output says so, instead of guessing.
Hanoi, Vietnam.
Kyrolan is in early access and looking for design partners running Splunk. The agents are built with Claude by Anthropic.