DeepTempo has unveiled its Intelligent Defense Platform, a comprehensive cyber defense solution designed to provide machine-speed intelligence to enterprises, MSSPs, service providers, and critical infrastructure operators. The launch marks the company’s evolution from a LogLM foundation model provider to a broader system-level security platform that offers visibility into detection performance across an organization’s security telemetry. The platform also supports optional integration with Vigil, the open-source AI SOC solution introduced by DeepTempo in April 2026.
DeepTempo anticipated today’s reality – the emerging use of AI by attackers is overwhelming human speed cyber security systems. While much has been made of the efficacy of Mythos and similar models in finding vulnerabilities, substantial evidence suggests that attackers are also using AI to orchestrate and execute campaigns that traditional systems struggle to identify and isolate.
The DeepTempo Intelligent Detection Platform extends existing cybersecurity investments by adding an intelligence layer across threat intelligence, detection, threat hunting, response, and related workflows, making every SIEM, SOAR, and AI SOC more focused and effective, reducing MTTD and MTTR while controlling spending on both human and AI intelligence.
Use cases in cyber traditionally have been fragmented across countless point products. Investments in telemetry platforms such as Cribl and data lakes such as Snowflake have made the Intelligent Defense Platform possible. Running in customer environments, DeepTempo’s IDL delivers insights and, optionally, takes actions without the cost, delays, and risk of siloed products that backhaul telemetry into their SaaS solutions for analytics.
DeepTempo’s Intelligent Defense Platform unifies, evaluates, and continuously improves detection across telemetry classes, embracing and supporting existing investments rather than replacing them. Additionally, this learning loop can extend to the use of Vigil and other AI SOCs for common workflows. By closing this loop with visibility into performance, efficacy, and both historical and projected costs, the Intelligent Defense Layer helps operators transition to the safe and cost-effective use of machine-speed intelligence.
DeepTempo’s approach provides an AI-native detection and operations foundation to thwart AI-enabled attackers. Recent research shows that 67.2% of exploited CVEs in 2026 have been zero-days, while 82% of detections in 2025 were malware-free. The window between vulnerability and exploitation has narrowed in the era of AI. DeepTempo’s Intelligent Defense Platform builds upon the LogLM, which was pretrained on billions of logs and performs approximately 279 billion calculations per sequence. The LogLM uncovers complex, compound behavioral patterns that no human-authored rule can anticipate while eliminating the costly and error-prone retraining that undermines traditional anomaly detection.
“When 82% of intrusions arrive without malware and breakout times are measured in seconds, you need a system to decide what actions to take and to capture end-to-end performance for continuous improvement,” said Evan Powell, CEO and Founder, DeepTempo. “We built the Intelligent Defense Platform to augment what organizations already have, making every detection and workflow measurably better.”
The DeepTempo Intelligent Defense Platform’s key features include:
- Pluggable Architecture Extends Capabilities while Reducing Lock-in: DeepTempo has partnered with Cribl, Snowflake, and others at the data layer, and works well with Splunk and other SIEMs, as well as agentic solutions within the SOC. Agentic intelligence is pluggable through skills and similar patterns, whether Vigil is used or not, allowing users to leverage their own AI solutions, such as enterprise licenses for OpenAI, Gemini, and Claude, as well as on-premises reasoning models.
- End-to-End Validation and Monitoring: Continuously evaluates the efficacy of existing rule-based and ML-based detections alongside LogLM-generated detections and can also be used to measure the efficacy and projected costs of many workflows.
- Broader Telemetry used by the LogLM: DeepTempo’s LogLM has broadened its capabilities and can now ingest network flow, firewall, DNS, WAF, cloud performance, commonOT, and agentic AI logs. In some recent deployments, the LogLM has achieved <1% false positives and <1% false negatives without any adaptation required, far better protecting defenders while saving time and money by being pinpoint focused on malicious behavior.
- Edge-Appropriate Deployment: DeepTempo has simplified the deployment and management of LogLM and related software at the edge. Distilled versions of the LogLM run on small systems, for example, adding the state-of-the-art ability to see novel and rapidly evolving attacks to systems running in critical infrastructure, including on fly-away kits.
This announcement follows DeepTempo’s recent launch of Vigil, the first open-source AI SOC built on an LLM-native architecture, underscoring the company’s commitment to providing security teams with a more transparent, extensible foundation for modern security operations.
To learn how DeepTempo is advancing AI-native detection and response through both Vigil and its Intelligent Defense Platform, visit the website here. Free assessments, or threat hunts, are available for a limited time.
Related News:
