AI Agents for Cybersecurity Companies

You build a detection product and your own detection engineering backlog never shrinks. Every quarter MITRE ATT&CK publishes new sub-techniques, every product release adds new telemetry sources, and the queue of "we should write a rule for this" tickets grows faster than your team clears it. Your red team, three or four people, is supposed to validate that your product catches what it claims to catch, but they are perpetually a sprint behind the roadmap: by the time they finish simulating last month's release, this month's release has already shipped with new attack surface nobody has tested. And your threat hunters, the people whose entire job is to find what the alerts missed, only get pulled in after an incident ticket opens. Nobody is hunting proactively through your own customers' telemetry to check whether the gap your red team just found has already been exploited quietly. This is the specific bind of building a security product: you are simultaneously the vendor and the target, and the three functions that should feed each other, offense, defense, and hunting, run as disconnected silos with a lag measured in weeks.

Why a generalist chatbot and an autocomplete tool both miss this

Ask ChatGPT or Claude.ai to help plan a red team exercise against your own EDR product and it will happily draft a generic attack narrative: phishing, initial access, lateral movement, exfiltration. What it will not do is understand that your detection backlog is a specific, numbered list of MITRE ATT&CK sub-techniques your SIEM does not yet cover, that your red team's simulation needs to target exactly those gaps rather than techniques you already catch, or that the output needs to land as a structured finding your detection engineers can turn into a SIEM query the same afternoon. A generalist chatbot treats "design a red team exercise" and "write a detection rule" and "plan a threat hunt" as three unrelated one-off requests. It has no memory of what the last simulation found, no concept of a detection backlog it is supposed to be shrinking, and no mechanism for handing red team output to a defensive counterpart. You get three disconnected documents instead of one coordinated workflow.

Cursor and GitHub Copilot solve an entirely different problem and are not built for this one at all. They are excellent at completing a Python script that parses Sigma rules or a Go function that ingests EDR telemetry, but a security vendor's core problem here is not writing code, it is sequencing three security disciplines so offense feeds defense and defense feeds hunting. An autocomplete tool has no opinion on rules of engagement, no CVSS scoring model, no MITRE ATT&CK mapping, and no way to reason about whether a detection gap your red team found last week has already been exploited against a live customer. When the actual deliverable is a penetration test plan, a SIEM detection rule mapped to ATT&CK, and a compromise assessment scoped against the same attack chain, in-editor autocomplete is the wrong tool at the wrong altitude.

Red, Blue, and Hunt: the loop a security vendor actually needs

Tonone's security-operations team is built around the loop a security vendor runs internally: offense finds the gap, defense closes it, hunting checks whether the gap was already exploited. Red is the offensive security engineer, designing penetration test plans, red team exercises, and attack path documentation with real rules of engagement and CVSS-scored findings. Blue is the defensive counterpart, designing detection rules and SIEM queries mapped to MITRE ATT&CK, and writing hardening playbooks against CIS benchmarks. Hunt is the threat hunter, running hypothesis-driven compromise assessments and IOC analysis rather than waiting for an alert to trigger the investigation. None of the three operate as a generic security chatbot. Each has a narrow, specific job, and the value is in how cleanly the output of one becomes the input of the next.

Tonone's Red simulates the attack chain a security vendor's own product is supposed to catch, then hands the finding straight to Blue's detection backlog.

Red's red-recon skill designs the reconnaissance plan, OSINT scope, attack surface mapping, enumeration methodology, before any simulation starts, so the exercise targets your product's actual blind spots instead of a generic kill chain. red-pentest then produces the full penetration testing plan: scope, methodology, attack surface, and rules of engagement, structured the way a real red team lead would write it before anyone touches a keyboard. red-report closes the loop by writing the finding itself: CVSS scores, business impact, and remediation, in a format your detection engineering team can act on directly rather than translate from a wall of raw pentest notes.

Blue picks up exactly where Red leaves off. blue-recon audits your existing detection coverage against MITRE ATT&CK to find where the real gaps sit, which is the same map Red should be simulating against. blue-detect designs the actual detection rule for a given threat: SIEM queries, alert logic, and the ATT&CK technique it maps to. blue-harden writes the hardening playbook, CIS benchmark mapping and implementation steps, for the systems the attack chain touched. Hunt runs the third leg: hunt-recon designs the hunting program itself, maturity assessment, hunting calendar, playbook library, so hunting stops being purely reactive. hunt-assess scopes a compromise assessment with a defined methodology and evidence collection plan, and hunt-ioc analyzes any indicators that surface, enrichment, attribution, and response recommendations.

The reason this matters specifically for a security vendor, and not for a generic IT department, is that the artifact quality bar is unusually high. A hardening playbook that cites the wrong CIS control, a detection rule that inverts an ATT&CK technique ID, or a CVSS score that does not match the actual business impact does not just waste an afternoon, it ships inside your own product's credibility with the exact audience, security engineers at your customers, who will notice immediately. That is why each of these three agents stays narrow: Red does not attempt to write detection logic, Blue does not attempt to score CVSS findings, Hunt does not attempt to scope a penetration test. The handoff between them is deliberate and structured precisely because blending the three roles into one generalist pass is where accuracy erodes fastest.

Worked example: closing the loop on a ransomware precursor chain

Say you run Ferrous Security, an EDR vendor with 340 open items in your detection engineering backlog, MITRE ATT&CK sub-techniques your SIEM does not yet have a rule for. Your four-person red team is roughly two sprints behind the product roadmap: your platform team ships new telemetry sources every three weeks, and a full simulation cycle takes closer to six. Your two threat hunters run compromise assessments only when a customer opens an incident ticket. There has never been a proactive hunt through your own telemetry for a chain nobody has reported yet.

You point Red at the highest-risk gap in the backlog: a common ransomware precursor chain that starts with a phishing macro and ends in lateral movement before deployment. red-recon maps the attack surface for this specific chain against your product's own telemetry sources. red-pentest scopes the simulation. The finding that comes back from red-report looks like this.

Red, Finding: Ransomware Precursor Chain, Detection Gap
Scope: Ferrous EDR telemetry, Windows endpoint fleet, simulated environment

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Attack chain simulated (7 techniques, all currently undetected):
  T1566.001  Phishing: Spearphishing Attachment (macro dropper)
  T1218.011  System Binary Proxy Execution: Rundll32
  T1055      Process Injection
  T1003.001  OS Credential Dumping: LSASS Memory
  T1021.002  Remote Services: SMB/Windows Admin Shares
  T1047      Windows Management Instrumentation (lateral move)
  T1486      Data Encrypted for Impact

CVSS (chain-level):        8.6 (High)
Business impact:           Full endpoint fleet, customer-facing SLA breach
                           if chain reaches T1486 undetected in production
Why this chain, not another: closes 7 of 340 backlog items in one pass,
                           all 7 map to telemetry Ferrous EDR already
                           collects but does not yet alert on
Remediation owner:         Blue (detection), Hunt (retroactive check)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Next: Blue drafts SIEM logic per technique. Hunt checks whether this
chain has already run, undetected, against any customer environment
in the last 90 days of retained telemetry.

That single finding hands Blue seven concrete, scoped detection rules to write instead of a vague mandate to "cover more of ATT&CK." blue-detect produces SIEM query logic and alert thresholds for each of the seven techniques, mapped explicitly back to the ATT&CK IDs Red simulated. In parallel, Hunt takes the same attack chain and runs hunt-assess against 90 days of retained customer telemetry, not because an incident was reported, but because Red just proved the chain is currently invisible to your own product. If Hunt's hunt-ioc analysis turns up a match, that is a live compromise nobody would have found until it hit stage seven. If it turns up clean, you have proactively validated 90 days of customer environments against a gap you just closed, before a single customer ever asked.

Tonone's Blue turns a Red finding into SIEM detection logic mapped to MITRE ATT&CK, and Hunt checks whether the gap was already exploited before the rule ever shipped.

The backlog of 340 does not vanish in one session, but the workflow changes shape: instead of picking backlog items at random or by whoever complains loudest, you are working down the list in order of what your own red team has proven is both undetected and reachable, with hunting validating the blast radius in parallel rather than three weeks later when a customer files a ticket. Run the same loop again next sprint against the next highest-risk gap, and the backlog stops being a queue nobody owns and becomes a scored, prioritized list where every item that gets closed also gets its blast radius checked. Over two or three release cycles, that compounds: the chains most likely to actually be attempted against your customers, the ones that chain common initial access techniques into high-impact outcomes like ransomware deployment or credential theft, get covered first, instead of whichever ATT&CK sub-technique happened to be assigned to whoever had free cycles that week.

There is a second-order benefit that matters as much as the backlog math: your red team's simulation cadence now sets Blue's detection roadmap and Hunt's hunting calendar, instead of the three functions maintaining separate backlogs that only get reconciled during an incident postmortem. When Hunt's hunt-recon builds the standing hunting program, it can schedule proactive hunts against the exact chains Red has already simulated but Blue has not yet finished detection logic for, closing the window where a known, proven gap sits unmonitored. That is the difference between a security vendor that discovers its own product's blind spots from a customer incident report and one that discovers them internally, on its own schedule, before a customer ever notices.

Red, Blue, Hunt vs the alternatives

None of this replaces your human red team, detection engineers, or hunters, and it is not trying to. What it replaces is the gap between them: the days lost translating an informal pentest writeup into a ticket a detection engineer can act on, the weeks a proven blind spot sits unmonitored because hunting was never told it existed, the effort spent re-deriving CVSS scores or ATT&CK mappings that should have been attached to the finding the moment it was written. The comparison below is scoped to the capabilities that actually matter for a security vendor running this loop, not a generic feature checklist.

Tonone's Hunt schedules proactive hunts against the exact attack chains Red has already proven undetected, closing the window before a customer incident forces the discovery.

Install and try

Tonone is free and MIT-licensed. Install it once and Red, Blue, Hunt, and the rest of the security-operations team are available in your Claude Code session alongside the full 100-agent roster. You pay only for Claude Code token usage during the work itself.