South Korean fintech Toss is using AI to help create and deploy security detection rules, while keeping people responsible for defining the risks and approving changes. Its approach offers a concrete example of how a company can put AI to work in security without handing it the keys and hoping for the best.
Watch Desk analysis
What happened
BigGo Finance reports that Toss security engineer Seo Jong-chan described the system, called Vibe Detection, at the Guardians 26 security conference in Seoul. Staff specify what a rule should detect; AI helps select data sources, configure alerts, map attack techniques, test rules and tune false positives.
Changes are managed as code. Each rule change is recorded in a merge request, with deployment changes and validation results raised for review. AI can flag possible false positives and inconsistencies, but a person confirms and merges the change. If deployment fails, the system automatically rolls back to the previous state.
Why it matters
The design turns detection-rule changes into reviewable, reversible experiments rather than edits made directly in a monitoring console. Toss says that makes temporary rules practical, including rules deployed after a red team reports a vulnerability and withdrawn once the developer patches it.
The same account describes controls around broader AI use: internal systems go through a gateway that checks inputs and outputs for personal information or credentials and keeps audit logs. AI agents receive defined access scopes. The security team also uses staged rollouts for patches, widening deployment through 1%, 5% and 25% before broader release, with rollback if something goes wrong.
Our read
The useful lesson is in the plumbing, not the label. Toss pairs a clear human decision about what to detect with automated testing, recorded changes and a way back if deployment misbehaves. That is a sturdier pattern than asking staff to trust a clever prompt and a cheerful green tick.
What to watch
- Whether Toss shares measures of rule quality, false positives and time saved.
- How the approach performs as it extends to more detection systems or affiliates.
- Whether Toss’s planned backend-neutral rules work across Splunk, ClickHouse and Snowflake.
Discussion spark: For AI-written security rules, which safeguard matters most: human approval, automated testing, or an immediate rollback path?
Sources and evidence
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.