Built inside a UK managed detection service, LuceraAI investigates every alert in minutes, learns the organisation it protects, shows what that organisation owns, and acts only within rules the customer sets.
GUILDFORD, UK, Tuesday 10th November, 2026 – LuceraAI today announced the general availability of its context-aware detection and response platform, which gives every security alert a full investigation the moment it arrives, learns each organisation it protects and acts only within limits its customers set. LuceraAI is available today to organisations running their own security operations, and to MSSPs.
The problem: the alert nobody looked at
Every security team knows the alert that arrived overnight, looked like a hundred others, and sat in the queue until the question changed from “what is this?” to “how long has this been going on?”. Teams are asked to watch everything, all the time, with tools that each see only part of the picture. Most alerts are noise, every one has to be checked, and there are never enough hours.
Attackers have made that gap dangerous. Threat actors now use AI as standard, and agentic tooling scans, pivots and adapts faster than any analyst can triage a queue. An alert that waits six hours is no longer a backlog; it is dwell time. Asking SOC teams to work harder doesn’t fix that. They need something working alongside them at the same speed.
“Attackers now move at machine speed. A year ago we decided as defenders we had to as well. LuceraAI is that force multiplier. It doesn’t replace your analysts. It gives them time back.” Sean Doggett, founder and CEO, LuceraAI
What LuceraAI does
LuceraAI sits on top of the security tools an organisation already owns, including any EDR, identity and email security platform, and does four things:
- Investigates every alert in minutes. A council of specialist AI agents gathers the evidence for every signal, hunts for more, challenges its own verdict and takes a second opinion from an independent model. Two must agree before anything happens. When they disagree, or confidence is low, the case goes to a person with everything found so far. Analysts start each case with the evidence already gathered.
- Learns the organisation it protects. No two environments are the same. LuceraAI builds context about an organisation’s assets, its users and what normal looks like for it, drawing on the signals it investigates and the rulings its own analysts make. Decisions reflect the business rather than a generic rulebook, and verdicts get sharper the longer it runs.
- Shows what the organisation owns. A laptop without endpoint protection or a forgotten server is where attackers look first. LuceraAI brings existing sources together to show what an organisation has and which of it is unprotected, and raises a signal when a device falls outside policy.
- Explains every decision. Each verdict shows its full path: which agents took part, what each found, whether the second opinion agreed and whether a person was needed. Every fact shows where it came from.
Customers stay in control
LuceraAI starts read-only. It investigates and reports without touching a customer’s tools until the customer chooses to let it act, within confidence thresholds the customer sets. The AI never acts in the environment directly; fixed code does, within those rules, and every action is logged and verified. It fails safe: anything it cannot conclude goes to a person, and nothing closes silently. Customer data is hosted in AWS London, encrypted and isolated per customer, and is never used to train AI models.
Why we built it
LuceraAI was built inside a UK managed detection service that has watched alerts for organisations since 2021, by the analysts who use it every day. It protects live customer estates today.
“Anyone who knows me knows I’ve never been comfortable with ‘good enough’. Building LuceraAI meant countless late nights, hard architectural decisions, and a lot of ‘that’s not good enough yet, go again’. What kept us going was watching it work on live estates for the customers we already look after. We hold it to the same standard we sell, and our early adopters are already seeing faster response, sharper triage and fewer gaps. A year in, it feels like day one.” Sean Doggett
Availability and pricing
LuceraAI is available today in three ways: run by a customer’s own security team; with LuceraAI’s UK analysts handling escalations around the clock; or alongside an existing MDR provider, running on the same alerts. It connects to any EDR and is priced per protected device. Organisations can run a two-week read-only evaluation on their own alerts, comparing LuceraAI’s verdicts with their team’s, at luceraai.net/evaluate.
About LuceraAI
LuceraAI is a UK cyber security company whose context-aware detection and response platform was built inside a managed detection service that has run since 2021. LuceraAI investigates every alert an organisation’s security tools raise, learns the organisation it protects, shows what it owns and acts only within the rules its customers set.
.png)
