AWS staff describe an internal system that writes detection rules with a language model, with each rule approved by the security team

Event date / reported

Evidence stage

Tasks this bears on

Where this applies

United States, one employer. A paper by the employer's own staff says RuleForge is an AWS internal system that automatically generates detection rules identifying malicious HTTP requests that exploit specific vulnerabilities; that each generated rule passing automated validation is submitted as an individual code review to the internal security team; and that the volume processed was intentionally limited to avoid overwhelming the human reviewers. Its evaluation covers the last four months of 2025. A preprint by the employer's staff; the rules target web exploits, not an organisation's own estate, and its productivity figure is relative.

What this means

What it does not yet show

One employer's own preprint about one kind of rule; no change in analysts' numbers or time is given.

What you can check

Does it change the assessment?

Source