For many security operations teams, the biggest challenge isn’t creating new detections; it’s ensuring existing ones continue working as environments evolve. Every new cloud service, automation, or data source introduces another variable, and even routine infrastructure updates can quietly disrupt detection pipelines without immediate visibility.
Fig is addressing that problem with the introduction of what it calls a complete engineering lifecycle for Security Operations (SecOps). The company says its latest platform enhancements bring the first true CI/CD workflow to security operations, allowing SecOps Engineers to build, deploy, and continuously verify changes across their environments.
The release expands the capabilities to generate, validate and deploy detections and configurations, while introducing an engineering model intended to give security teams greater confidence as they make changes to increasingly complex infrastructures.
Understanding the Full SecOps Environment
Rather than requiring engineers to manually stitch together detections and configurations, Fig enables them to describe the change they want to make. The platform analyzes the live environment before generating a proposed implementation.
According to Fig, every proposed change is then simulated and tested before deployment, allowing engineers to understand its impact before it reaches production. Once approved, updates can be deployed with built-in version control and rollback capabilities, while continuous observability monitors whether detection flows continue performing as expected.
The workflow is designed to make infrastructure changes more predictable while reducing the operational effort required to validate them manually.
Mapping Every Detection Flow
A key component of the platform is its deterministic security data lineage, which maps every detection, data source, and connection throughout the SecOps stack.
Instead of viewing security tools as isolated systems, Fig creates a unified representation of how information moves across the environment. The company says this allows Fig to understand dependencies throughout the infrastructure and evaluate proposed changes using live operational context.
That visibility is intended to help organizations avoid one of the more difficult problems in security operations: silent failures caused by upstream or downstream changes that unintentionally interrupt detection pipelines.
Helping Teams Move Faster
Beyond validating infrastructure changes, Fig says the platform is designed to accelerate several high-impact operational tasks.
Threat reports can be converted into detections and queries more quickly, allowing organizations to respond sooner to emerging risks. SIEM migrations, which often require months of planning and execution, can be completed in weeks while remaining operational throughout the transition.
The platform also gives organizations control over their data plane, allowing them to manage data ingestion and storage spending without disrupting production detections.
For teams balancing operational resilience with limited engineering resources, the goal is to spend less time maintaining infrastructure and more time improving security outcomes.
Confidence Through Continuous Verification
The company positions continuous verification as a central part of the release. Rather than assuming a deployment remains healthy after implementation, the platform continuously confirms that detection flows continue working as intended as the surrounding environment changes.
Jayme Hancock, Head of Security Operations and Engineering at AppLovin, said that approach has changed how his team delivers detection updates. “With Fig we build and ship accurate detection changes in minutes instead of weeks, without the endless plumbing,” he said, adding that the team now builds “with a confidence we’ve never had,” and has even started “vibe parsing.”
The comments underscore Fig’s emphasis on reducing uncertainty during deployment rather than simply increasing development speed.
Continuing a Broader Strategy
The latest announcement builds on Fig’s broader Security Operations Resilience strategy. Since launching publicly, the company has raised $38 million from Team8, Ten Eleven Ventures, and Crosspoint Capital, earned recognition as an RSAC Innovation Sandbox finalist, and says its technology is deployed across dozens of Fortune 500 companies.
Founded by veterans of Google SecOps and Siemplify, the company says its platform reflects lessons learned from operating some of the world’s largest security operations centers, where infrastructure changes frequently create unexpected operational challenges.
Gal Shafir, Co-Founder and CEO of Fig, said the goal is to bring security operations closer to the engineering practices that transformed software development. “Security teams shouldn’t have to choose between moving quickly and maintaining confidence in their SecOps Infrastructure,” he said. “Fig gives SecOps Engineers the same modern engineering workflow that software developers have long relied on. They can design changes with complete context, prove those changes work before deployment, and continuously verify that their security operations remain resilient as their environments evolve.”
With the latest expansion, Fig is positioning its platform around a broader premise: that resilience in modern security operations depends not only on detecting threats, but also on ensuring the systems responsible for those detections remain reliable through constant change.
