UltraViolet Cyber launches Equinox to map detection gaps

UltraViolet Cyber has launched Equinox, a detection engineering platform designed to assess detection coverage across customers' security tools.

Equinox maps existing detections and available log sources against the MITRE ATT&CK and MITRE ATLAS frameworks, which are widely used to classify attacker tactics and techniques. UltraViolet said the system can complete that analysis in under 30 minutes, then recommend vendor or custom detections to address gaps.

The launch comes as security teams face growing pressure to show whether their monitoring tools can actually detect malicious activity across complex environments. Many organisations run several layers of security software, but determining which alerts are meaningful and which threats remain uncovered often requires manually reviewing thousands of possible rules.

Coverage focus

Equinox is intended to show where mapped coverage exists, where gaps remain, and which additional detections or log sources could improve results. UltraViolet's Threat Intelligence & Detection Engineering team reviews, backtests and approves each recommended detection before deployment.

The platform also applies the same assessment process to MITRE ATLAS, a framework focused on threats to artificial intelligence and machine learning systems. According to UltraViolet, this gives customers a scorecard for adversarial tactics aimed at AI-related environments, alongside more conventional attack techniques covered by MITRE ATT&CK.

Customers receive evidence showing where mapped detection coverage exists, how it changes over time and what to prioritise next. The aim, UltraViolet said, is to improve coverage without increasing alert volumes for security operations centre teams.

The issue has become more prominent as companies invest in SIEM and endpoint detection tools but still struggle to measure whether existing deployments match their risk profile. UltraViolet cited industry research that put average enterprise detection coverage at 21% of MITRE ATT&CK techniques.

In one customer trial, Equinox increased mapped coverage from 59 of 222 techniques, or 26.6%, to 136 of 222, or 61.3%, after recommended detections were implemented, UltraViolet said. That represented a 34.7 percentage-point increase and a 130% rise in mapped technique coverage, with no increase in security operations centre alert volume.

Managed service

Equinox is being delivered as part of UltraViolet's managed security operations centre service and is also available as a standalone engagement for organisations that run their own security operations. UltraViolet said it uses the assessment during customer onboarding and then quarterly.

The platform is vendor-agnostic, according to the company. Integrations are already in place for SentinelOne, CrowdStrike, Elastic and Panther, while work on Splunk and Microsoft Defender is under way.

For buyers, that cross-platform approach addresses a common problem in security operations. Native dashboards in individual products can show only their own rules and telemetry, leaving blind spots between systems that are not always visible in a single view.

UltraViolet also said Equinox can help teams decide where to invest in additional telemetry. A log-source gap report is intended to quantify how much extra mapped coverage a new data source could support, giving security leaders a clearer basis for spending decisions.

Dan Gittis, Director, TIDE Team, UltraViolet Cyber, said the company built Equinox to answer a long-standing question for security operations teams. "Every SOC team has heard the question 'are we actually covered?' and struggle to answer it with full confidence," said Gittis. "Equinox gives our TIDE engineers a real answer, in minutes instead of weeks, on not just which detections exist, but validates that a detection can actually fire against the data rather than assuming a mapped rule is effective. That's the difference between a coverage dashboard and coverage you can defend in an audit."

Atif Ghauri, Chief Operating Officer, UltraViolet Cyber, said the product is meant to improve visibility into whether existing detections work with a customer's own telemetry. "Security leaders don't lack detections, they lack visibility into whether the ones they have actually work against their own data," said Ghauri. "Equinox closes that gap using the telemetry customers already have, before they spend a dollar on anything new. It's a clear example of what we mean by practitioner-led, AI-accelerated: automation does the heavy lifting, our TIDE engineers make the calls that matter."