Can a security company sell its alerts and investigation write-ups to AI?

A security company produces a steady flow of records that show expert judgment at work: an alert fires, an analyst decides whether it matters, the trail is followed, the incident is contained and a report explains what happened. AI teams building agents for security work want those trails, because they show the decisions, not only the outcomes.

That makes the question natural: can a security company sell or license them? Sometimes, and the limits are sharper here than in most industries, because the records describe other companies' weaknesses.

What security firms hold

• Alerts and triage notes. The signal, the analyst's reasoning and the verdict: real threat, false alarm or needs more work.
• Incident timelines. What happened, in order, with the actions taken at each step.
• Investigation write-ups and post-incident reports. The narrative of how a problem was found and fixed.
• Playbooks and runbooks. The written steps for common cases.
• Test reports. Penetration test and red team reports, which describe weaknesses found in a client's systems.

The public standard for handling incidents shows why this is a natural fit. The US National Institute of Standards and Technology, in its Incident Response Recommendations and Considerations for Cybersecurity Risk Management, a profile of its Cybersecurity Framework 2.0 (Special Publication 800-61, revision 3, April 2025), treats incident response as part of managing cybersecurity risk: detecting, analyzing, responding and recovering, with lessons learned fed back into improvement. A firm's own records follow that path, with real cases attached.

Whose records are they?

For most security providers the answer starts with the client contract. An alert generated about a client's network, an investigation of a client's breach and a test report on a client's systems are normally the client's information or are held under confidentiality. The firm's right to reuse them depends on what the contract says, and many contracts say little or forbid it.

What a firm owns outright is usually narrower: its playbooks, its internal training material, its detection logic written by its own staff and its internal analysis that does not identify a client. Those are the easier starting points.

Three practical sorts help:

1. Yours. Playbooks, internal procedures, detection ideas and anonymous analysis.
2. A client's, with a contract that allows reuse. Possible after the client agrees in writing.
3. A client's, with no reuse right. Not offered.

What has to come out

Even records the firm owns carry other people's information:

• Addresses and identifiers. Internal and public network addresses, host names, user accounts and email addresses. The GDPR (Regulation (EU) 2016/679, recital 30) notes that online identifiers such as internet protocol addresses can identify people when combined with other information.
• Secrets. Passwords, keys and tokens that appear in logs or screenshots.
• Unfixed weaknesses. A write-up about a flaw that is still open is a map for attackers. These are held back.
• Client identity. Names, systems and details that let a reader work out which company was affected.

The cleaning here is more careful than for ordinary tickets, and it is done before anyone outside the company sees a sample. Our de-identification page describes the steps and the record we keep.

What AI teams look for

Labs training security agents often prefer tasks they can check by running them, not only reports they have to read. Our posts on what an offensive security environment is, black-box and white-box tasks and why security tasks cite weakness identifiers explain this. If your team builds environments, the page on selling private RL environments covers it. Written records matter too, especially when they show the whole path from alert to resolution.

As with any data set, counts and a sample decide how fast a conversation moves: how many incidents, which years, which kinds and three cleaned, complete cases. Our post on what to have ready before you talk to a data broker lists them.

What we do

We sort your records into the three groups above, plan the removal of identifiers and secrets, prepare a sample and ask AI labs whether they want it. You keep the final decision on every term. Most deals are licenses, so the firm keeps its records and its business. Have your counsel read the client contracts that apply, since they are the real limit.

The page for cybersecurity companies has more detail. The data value calculator takes about a minute, and if you hold records and want a straight answer, tell us what you have.