Ramp grew its detection program 10x in alert volume without adding analysts, and cut triage from about 30 minutes per alert to under a minute. Cotool agents now take the first pass on every SIEM alert, and every false positive becomes a proposed rule fix in Ramp's detection repo.
How do you scale human judgment without scaling the team?
At the start of 2025, Ramp hit hyperscale. Antoinette Stevens had built Ramp's Detection and Response function from the ground up, and it was mature: detections lived as code in GitHub and ran across two SIEMs. But the team was a few engineers, and she needed to extend its reach without simply adding people.
"We needed to expand our program, and we needed to do it in such a way that didn't require us to hire another 10 analysts." — Antoinette Stevens, Principal Security Engineer, Ramp
Every alert required hands-on investigation. Analysts pivoted across endpoint, SIEM and cloud logs to pull data, correlate activity and rebuild context before they could decide what was real. The work wasn't conceptually hard. Most of the roughly 30 minutes per alert went into gathering context before a decision could even be made.
"Before Cotool, it was hard to scale the detection program. We didn't have the manpower to go through and triage any influx of alerts that might come." — Antoinette
The cost went beyond triage time. Noisy rules stayed noisy, because tuning them meant someone finding time to open the repo, work out the fix and ship a PR. And alerts didn't respect business hours.
"Reviewing alerts outside of business hours meant waiting to get back to a laptop or juggling tools on my phone. It slowed down decisions and limited our flexibility." — Antoinette
As Ramp expanded log ingestion and wrote new detections, alert volume would climb. Even well-designed programs generate noise as coverage broadens. Without a structural change, scaling detection meant scaling headcount.
What does a closed loop from detection to response look like?
Ramp didn't rip anything out. Cotool slots in between the tools the team already uses, and the loop closes back in the detection repo.
- A detection fires in one of Ramp's SIEMs.
- A SOAR workflow routes it and opens a ticket in Ramp's case management tool.
- A Cotool agent picks up the ticket and investigates, pulling context from the SIEMs, EDR, identity provider, insider risk tooling, cloud security platform and GitHub.
- The agent writes a disposition into the ticket and Slack. True positives escalate to a human. False positives get closed.
- For a false positive, the agent asks a second question: why did this rule fire on benign activity, and what change would stop it?
- Cotool opens a pull request against Ramp's detection repository with the proposed rule change and its reasoning.
- An engineer reviews and merges, often from Slack on their phone. Detections in one of the SIEMs get an extra Slack approval step before the change goes in.
"It collapsed what used to take minutes or hours down to a process that took seconds." — Antoinette
How quickly did it start paying off?
Antoinette set up the first agent herself, then handed it to Brandon Ledyard, the security engineer on the Detection & Response team who owns the agents day to day. Even that first version paid off right away.
"Out of the box, we got meaningful usage and value pretty quickly. In less than a week, agents were performing end-to-end investigation and addressing tickets as they happened." — Antoinette
Ramp didn't stop at triage. The team moved on to harder problems, including investigations for its insider risk program, using customized agents and multi-agent workflows.
"The value has only increased from there. We fairly quickly introduced and solved more complex use cases, leveraging highly customized agents as well as agent orchestration on the platform." — Antoinette
For Brandon, Cotool is now the default for new work.
"A lot of the new stuff that we're building is done mostly in Cotool. If it's an easy automation, I would rather just have an agent do it." — Brandon Ledyard, Security Engineer, Detection & Response, Ramp
What does a tuning PR look like?
Say a rule flags any IAM role assumption from an unfamiliar IP. It keeps firing on the CI runners after an infrastructure change moved them to a new address range. The agent investigates, confirms the activity is the CI pipeline, and opens this:
Note what the agent didn't do. It didn't mute the rule, and it didn't exclude the role everywhere. The narrowest change goes up for review, with the evidence attached.
How does Ramp stay in control of an agent that edits its detections?
An agent that edits your detections needs guardrails, and Ramp wanted a tool it could see inside.
"Most other tools felt like black boxes. With Cotool, we control the prompt, the integrations, and how the agent behaves. That level of flexibility and transparency is rare in security tooling." — Antoinette
- Humans merge. The agent proposes changes and a person approves them. Detection logic never changes without review.
- Detections stay as code. Every tuning change is a normal PR with a diff, a reason and a history. You can audit or revert it like any other commit.
- One agent owns SIEM queries. A specialist sub-agent knows the schemas of both of Ramp's SIEMs, and five or more other agents call it. Query logic lives in one place instead of being copied into every prompt.
- A router decides who runs. A router agent with confidence thresholds picks the right specialist, and hands off to a human when confidence is low.
- Natural language keeps it accessible. Control doesn't mean complexity. New team members picked it up quickly and started automating parts of their own work.
The shared query agent was Brandon's idea:
"What if we just had this as one agent? Then we can update it in one place, and any SIEM queries can use it." — Brandon
"Because it's all driven through natural language, it's easy for different team members to pick up, refine, and extend without heavy lift." — Antoinette
What changed for Ramp's team?
Ramp's program grew 10x without adding analysts.
"Automated tuning is a big help for us. Now, from my phone on the train, I can fully investigate and tune an alert in five minutes. Cotool has already opened a PR to update the detection rule in our repo, all I have to do is review and merge it." — Antoinette
The bigger change is what the team now feels free to do. Adding a new log source used to mean bracing for the noise. Antoinette still treats alerts as expensive, but more coverage no longer means more strain on the team.
"Cotool lets us onboard new log sources and easily author detections without worrying about overwhelming the team with alert fatigue." — Antoinette
Why not build it in-house?
Ramp has a talent-dense engineering culture, and rolling its own was on the table. Antoinette's fallback was an agent built on a cloud model platform. But the model call is the easy part. Memory, context, evaluation and keeping integrations working are where the time goes.
"There's real value in having a highly technical, dedicated team focused on all the complicated internals of agent-building specific to security: memory, context management, and deep native integrations. Given our team size and time constraints, partnering with a vendor that specializes in this while still letting us keep flexibility was an obvious choice." — Antoinette
So, did Ramp need those 10 analysts?
When Ramp hit hyperscale, Antoinette's goal was to grow the program without hiring another 10 analysts. Alert volume has since grown 10x, and the team hasn't added an analyst. Every SIEM alert gets an agent's first pass, every false positive turns into a reviewed fix in the detection repo, and a noisy rule can be tuned from a phone on the train.
Growth used to force a choice between broader coverage and a team buried in alerts. Now a new log source means seeing more, not bracing for noise. A small, sharp detection and response team operates like a much larger one, without giving up control, context or precision.
If you run detections as code and your rules are noisier than you'd like, this loop is a good first agent to build. See how Cotool works or talk to us about setting it up on your stack.