Vega
snapshot-20260824 commercialThe section your link pointed to isn't on Vega's page any more, so we've brought you to the top.
Vega is a decentralized protocol for derivatives trading that enables peer-to-peer trading of futures and options on a blockchain.
Summary
Vega is a commercial data-fabric that enhances security analytics and detection capabilities by encoding investigation and triage logic as versioned, shareable skills. It operates as a service within the Vega Cyber Defense Platform, allowing users to compose detections, attach skills to manage alert lifecycle, and receive tuning proposals for review. The tool is designed for security analytics practitioners and sits in the detection space, with its documentation positioning it alongside the general concept of an open standard for threat intelligence skills. Since launching in 2024, it has released 21 times, with the last update occurring 34 days ago.
Vega is a decentralized protocol for derivatives trading that enables peer-to-peer trading of futures and options on a blockchain.
How Vega helps
Which alerts in my queue are noise that never should have escalated?
attaches a triage skill that runs before the alert surfaces, evaluates it against the reasoning encoded in the skill, and suppresses it pre-escalation rather than leaving it for an analyst to close
Which of my detections keep firing on the same false positives without ever getting tuned?
runs the optimization loop against each alert fire and generates a tuning proposal with its reasoning attached, writing the verdict back into the rule once an engineer approves it
Are my agents or models being used for something they shouldn't be?
applies skills scoped to dangerous model activity against the relevant logs and surfaces the reasoning behind any verdict, rather than relying on one general-purpose detection
Who needs to sign off before a proposed rule change takes effect in my environment?
routes every tuning proposal to an engineer for approval or rejection before the verdict is written back into the detection, so nothing is tuned automatically
Which investigation steps am I repeating by hand for every alert of a given type?
attaches an investigation skill that encodes the reasoning as a versioned skill, so the same steps run automatically each time that detection fires
Languages
Features
Built from Vega's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.
No capabilities match.
All capabilities 6 capabilities
Detection Skills sandbox shipped A public sandbox at detectionskills.io where users can build a detection, attach a skill, preview the agentic verdict, and export a spec-compliant YAML skill file.
release
-
Provides a sandbox at detectionskills.io to build a detection, attach a skill, preview the verdict, and export spec-compliant YAML.
updated · Aug 2026
· source
· release history
example
-
Try the Detection Skills sandbox to attach a skill to a detection, preview the agentic verdict, and export a spec-compliant YAML skill file.
In the detectionskills.io sandbox: (1) Build or paste in a detection. (2) Select a skill from the Detection Skills Library (e.g. a triage skill). (3) Preview the verdict output.updated · Aug 2026 · source -
Export a spec-compliant Detection Skill as YAML from the detectionskills.io sandbox to review or contribute the skill to the community library.
In the detectionskills.io sandbox: build a detection, attach a triage or investigation skill from the library, preview the verdict, then click 'Export' to download a spec-compliant YAML file.updated · Aug 2026 · source
Detection Skills workflow in Vega Cyber Defense Platform shipped A three-step in-platform workflow where engineers compose detection logic in a detection notebook, attach skills for triage, investigation, or optimization, and approve or reject tuning proposals that write accepted verdicts back into the detection rule.
release
-
Adds a three-step Detection Skills workflow inside the Vega Cyber Defense Platform: compose detections in a detection notebook, attach skills from the Skill Library for triage/investigation/optimization, and approve or reject tuning proposals that write approved verdicts back into the rule.
updated · Aug 2026
· source
· release history
- Integrates Detection Skills into the Vega Cyber Defense Platform via a detection notebook workflow: compose detection logic, attach skills for triage/investigation/optimization, and receive tuning proposals with attached reasoning for engineer approval. updated · Aug 2026 · source · release history
- Adds an optimization loop that writes approved verdicts back into the detection rule, incrementally sharpening coverage with each alert fire. updated · Aug 2026 · source · release history
Agentic AI threat detection coverage shipped suggested Provides Detection Skills scoped to dangerous AI model activity, extending detection and triage coverage to agentic AI threat scenarios.
Suggested capability: Security event correlation. This is our guess, not confirmed.
release
-
Adds coverage for agentic AI threat scenarios — dangerous model activity — through new Detection Skills targeting that use case.
updated · Aug 2026
· source
· release history
- Enables agentic detection and triage for emerging threat landscapes including dangerous AI model activity, with skills scoped to specific use cases rather than relying on a single catch-all agent. updated · Aug 2026 · source · release history
Detection Skills Library shipped A curated library of 50+ triage, investigation, and optimization skills from Vega Research and partners, available openly at detectionskills.io and contributed to via a community GitHub repository.
release
-
Hosts a GitHub repository for the community to contribute Detection Skills back to the shared library.
updated · Aug 2026
· source
· release history
- Ships the Detection Skills Library with 50+ skills from Vega Research and partners — the same skills running inside the Vega platform — available openly at detectionskills.io. updated · Aug 2026 · source · release history
Detection Skills open standard shipped An open standard built on Anthropic's Agent Skills format that encodes triage, investigation, and optimization reasoning as versioned, shareable YAML skills that attach to detections.
release
-
Launches Detection Skills, an open standard built on Anthropic's Agent Skills format, enabling triage, investigation, and optimization reasoning to be written as versioned skills that attach to detections and execute as a continuous agentic loop.
updated · Aug 2026
· source
· release history
- Launches the Detection Skills open standard at detectionskills.io, built on Anthropic's Agent Skills format, for encoding triage, investigation, and detection-optimization logic as versioned, shareable YAML skills. updated · Aug 2026 · source · release history
Pre-alert triage noise reduction shipped Runs triage skills before an alert surfaces to the analyst rather than after escalation, reducing alert noise at the source.
release
-
Enables agentic detection and triage for emerging threat landscapes including dangerous AI model activity, with skills scoped to specific use cases rather than relying on a single catch-all agent.
updated · Aug 2026
· source
· release history
- Enables noise prevention by running triage skills before an alert surfaces, rather than after escalation. updated · Aug 2026 · source · release history
Lines in monospace are the tool's own words: help text
parsed from its source, or an endpoint from its API document. Under
release, a line is our summary of a dated release. Under
docs, it is quoted from the tool's own documentation or
website. Each links back to the source it came from.
Screenshots
From the release notes, newest first. Click one to see it full size.Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
Five scores for Vega, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail Vega puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
2 entries
No entries match these filters.
- August 20262
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →