diff --git a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml b/detections/experimental/application/detect_risky_spl_using_pretrained_ml_model.yml
similarity index 100%
rename from detections/application/detect_risky_spl_using_pretrained_ml_model.yml
rename to detections/experimental/application/detect_risky_spl_using_pretrained_ml_model.yml
diff --git a/detections/application/splunk_xss_in_monitoring_console.yml b/detections/experimental/application/splunk_xss_in_monitoring_console.yml
similarity index 100%
rename from detections/application/splunk_xss_in_monitoring_console.yml
rename to detections/experimental/application/splunk_xss_in_monitoring_console.yml
diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/experimental/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
similarity index 100%
rename from detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
rename to detections/experimental/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/experimental/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
similarity index 100%
rename from detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
rename to detections/experimental/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/experimental/cloud/circle_ci_disable_security_step.yml
similarity index 100%
rename from detections/cloud/circle_ci_disable_security_step.yml
rename to detections/experimental/cloud/circle_ci_disable_security_step.yml
diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/experimental/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
similarity index 100%
rename from detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
rename to detections/experimental/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/experimental/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
similarity index 100%
rename from detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
rename to detections/experimental/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/experimental/cloud/cloud_instance_modified_with_previously_unseen_user.yml
similarity index 100%
rename from detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
rename to detections/experimental/cloud/cloud_instance_modified_with_previously_unseen_user.yml
diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/experimental/cloud/gsuite_drive_share_in_external_email.yml
similarity index 100%
rename from detections/cloud/gsuite_drive_share_in_external_email.yml
rename to detections/experimental/cloud/gsuite_drive_share_in_external_email.yml
diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/experimental/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
similarity index 100%
rename from detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
rename to detections/experimental/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/experimental/endpoint/windows_vulnerable_driver_loaded.yml
similarity index 100%
rename from detections/endpoint/windows_vulnerable_driver_loaded.yml
rename to detections/experimental/endpoint/windows_vulnerable_driver_loaded.yml
diff --git a/tests/application/detect_risky_spl_using_pretrained_ml_model.test.yml b/tests/experimental/application/detect_risky_spl_using_pretrained_ml_model.test.yml
similarity index 100%
rename from tests/application/detect_risky_spl_using_pretrained_ml_model.test.yml
rename to tests/experimental/application/detect_risky_spl_using_pretrained_ml_model.test.yml
diff --git a/tests/application/splunk_xss_in_monitoring_console.test.yml b/tests/experimental/application/splunk_xss_in_monitoring_console.test.yml
similarity index 100%
rename from tests/application/splunk_xss_in_monitoring_console.test.yml
rename to tests/experimental/application/splunk_xss_in_monitoring_console.test.yml
diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/experimental/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
similarity index 100%
rename from tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
rename to tests/experimental/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/experimental/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
similarity index 100%
rename from tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
rename to tests/experimental/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
diff --git a/tests/cloud/circle_ci_disable_security_step.test.yml b/tests/experimental/cloud/circle_ci_disable_security_step.test.yml
similarity index 100%
rename from tests/cloud/circle_ci_disable_security_step.test.yml
rename to tests/experimental/cloud/circle_ci_disable_security_step.test.yml
diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/experimental/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
similarity index 100%
rename from tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
rename to tests/experimental/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/experimental/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
similarity index 100%
rename from tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
rename to tests/experimental/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/experimental/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
similarity index 100%
rename from tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
rename to tests/experimental/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
diff --git a/tests/cloud/gsuite_drive_share_in_external_email.test.yml b/tests/experimental/cloud/gsuite_drive_share_in_external_email.test.yml
similarity index 100%
rename from tests/cloud/gsuite_drive_share_in_external_email.test.yml
rename to tests/experimental/cloud/gsuite_drive_share_in_external_email.test.yml
diff --git a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml b/tests/experimental/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml
similarity index 100%
rename from tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml
rename to tests/experimental/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml
diff --git a/tests/endpoint/windows_vulnerable_driver_loaded.test.yml b/tests/experimental/endpoint/windows_vulnerable_driver_loaded.test.yml
similarity index 100%
rename from tests/endpoint/windows_vulnerable_driver_loaded.test.yml
rename to tests/experimental/endpoint/windows_vulnerable_driver_loaded.test.yml