# AWS staff describe an internal system that writes detection rules with a language model, with each rule approved by the security team

Page: https://flyvolo.ai/en/changes/ev-20251231-cybersecurity-analyst-9
Date: 2025-12-31 · Stage: Deployment
Can this record move a task judgement? yes
Occupation: https://flyvolo.ai/en/careers/cybersecurity-analyst

## Scope

United States, one employer. A paper by the employer's own staff says RuleForge is an AWS internal system that automatically generates detection rules identifying malicious HTTP requests that exploit specific vulnerabilities; that each generated rule passing automated validation is submitted as an individual code review to the internal security team; and that the volume processed was intentionally limited to avoid overwhelming the human reviewers. Its evaluation covers the last four months of 2025. A preprint by the employer's staff; the rules target web exploits, not an organisation's own estate, and its productivity figure is relative.

## Source

- Garg, Hager, Montiel et al. (Amazon Web Services) — 'RuleForge: Automated Generation and Validation for Web Vulnerability Detection at Scale', arXiv:2604.01977 (submitted 2 April 2026) — https://arxiv.org/abs/2604.01977 (primary source)

## What this means

At one large employer, drafting detection rules is done by a model, and analysts' work shifts to reviewing and approving them.

## What it does not show yet

One employer's own preprint about one kind of rule; no change in analysts' numbers or time is given.

## How to verify it yourself

Open arXiv:2604.01977 and find "an AWS internal system that automatically generates detection rules".


More: https://flyvolo.ai/llms.txt