Managed security services provider UltraViolet Cyber Inc. today launched Equinox, a detection engineering platform that grades how much of the known attacker playbook a customer’s existing security tooling would actually catch.
Equinox inventories the detection rules and log sources a customer already runs across its security information and event management platform and endpoint detection and response tooling, then maps them against the MITRE ATT&CK framework. Vendor detection libraries can run to thousands of rules, and sorting out which of them matter in a given environment has traditionally taken detection engineers weeks. UltraViolet said the automated analysis finishes in under 30 minutes.
Out the other end comes a coverage map and a scorecard, along with a list of recommended vendor or custom detections to fill whatever gaps turn up. Nothing deploys automatically. Engineers on the company’s Threat Intelligence and Detection Engineering team review each recommendation and backtest it against the customer’s own telemetry first, tuning as needed. A separate log-source gap report puts a number on how much extra coverage each new data feed would buy, which gives buyers a case for telemetry spending.
“Every SOC team has heard the question ‘are we actually covered?'” said Dan Gittis, director of the TIDE team at UltraViolet Cyber. He added that the platform confirms a detection can fire against live data rather than assuming a mapped rule works, which he called “the difference between a coverage dashboard and coverage you can defend in an audit.”
The company points to one customer trial in which a single Equinox review identified a path from 59 of 222 covered techniques to 136, a gain of 34.7 percentage points, once the recommended detections were implemented. UltraViolet said alert volume in the security operations center would not rise as a result. Enterprise SIEM detection coverage averages about 21% of ATT&CK techniques, according to CardinalOps’ fifth annual detection risk report, published in June 2025.
UltraViolet is running the same assessment against MITRE ATLAS, the companion knowledge base covering adversary behavior aimed at artificial intelligence and machine learning systems. The company says it is the first to produce a full coverage map and scorecard for that framework.
Atif Ghauri, chief operating officer at UltraViolet Cyber, said the shortage is not in detections. Security leaders lack visibility into which of the ones they own actually work against their own data, he said, and Equinox is meant to close that gap “before they spend a dollar on anything new.”
Managed customers pay nothing extra. Equinox ships with UltraViolet’s managed security operations center service, run during onboarding and quarterly after that, and organizations that staff their own security operations centers can buy it as a standalone engagement. The platform works today with tooling from SentinelOne Inc., CrowdStrike Holdings Inc., Elastic N.V. and Panther Labs Inc. Support for Splunk and Microsoft Defender is in development.
Private equity firm Achieve Partners assembled UltraViolet Cyber in April 2023 by merging Metmox, Mosaic451, Stage 2 Security and W@tchTower. The company is based in McLean, Virginia. It bought Black Duck Software Inc.’s application security testing services business in September 2025 and ranks No. 19 on MSSP Alert’s Top 250 list of managed security services providers.
