Skip to content
AI Cyber Compare

DISPATCH · BUYING

The one-page brief to send every SOC vendor before the demo

The short answer

Send each vendor one page before the first call: your top alert sources, what happens to your playbooks, your response actions with approval levels, who is awake at night, and the questions you want answered in writing. A vendor that answers the page gives you comparable facts; a generic demo gives you a show.

By The Triage Desk · AI Cyber Compare · Published 2026-10-04 · 4 min read

Why send a brief?

A standard demo shows a vendor's best case on a vendor's data. Two demos from two vendors are hard to compare because each chose its own story. A one-page brief turns the meeting around: every vendor answers the same questions about your environment, and the answers line up.

What goes on the page?

Your alert sources

List your top five alert sources by volume, by product name. Ask: "Which of these are supported today, and how?" Integration counts on vendor pages are a guide to breadth; Dropzone AI, for example, publishes 90+ integrations across 14 categories. Only a named answer tells you whether your sources are covered.

Your playbooks

If you run SOAR, say how many playbooks you depend on and attach three representative ones. Ask: "What happens to these?" The answers differ by product. Mate Security says it translates SOAR playbooks into Gamebooks, keeping custom logic. Torq rebuilds them as workflows from natural-language descriptions. Products built to work beside a SOAR leave them in place. Cortex XSOAR adds AI prompts inside existing playbooks through AgentiX.

Your response actions

Attach your response action catalog, or at least the ten actions you take most often, with the approval each needs by day and by night. Ask: "Which can your product take natively, which need another tool, and how is each approval set?"

Your staffing

State who is on shift by day, whether anyone is on call at night, and whether you want outside help. Ask: "What happens to an alert that needs a decision at 3 a.m.?"

The written questions

End with five questions you want answered in writing before the second meeting:

  1. What is the pricing unit, and what makes the bill grow?
  2. Where is our data processed and stored, and is a single-tenant or regional option available?
  3. What does a verdict record show, step by step, and can an analyst challenge it?
  4. What can we export if we leave: case history, detections, automation, learned context?
  5. Which compliance reports are available, and under what terms?

What do you do with the answers?

Put them in a table with one column per vendor, the way the fact table does for public facts. Mark every answer that came only verbally. After two or three vendors, the gaps will show: one vendor will not name your noisiest source, another will not put the pricing unit in writing, a third will answer the night question with "it depends".

How long should the page be?

One page. If it runs longer, vendors will skim it and you will be back to a generic demo. Attachments are fine; the page itself should fit on a screen.

What about the demo itself?

Ask for it on one of your own alert types, ideally from your noisiest source, and ask the vendor to show the approval flow for one mid-risk action. Ten minutes on your case tells you more than an hour on theirs.

A note on fairness

Send the same page to every vendor, including any you already favor. The point is comparable answers. If you change the page after the first call, send the new version to everyone.

Should procurement see the page?

Yes. The written questions about pricing, data location, export and compliance are as much procurement questions as technical ones. Sharing the page early lets procurement add its own standard questions once, instead of running a separate round later. It also means the answers you collect in the technical round can go straight into the contract review.

Sources

Source: Dropzone AI integrations · Read 27 Sep 2026

Source: Mate Security: Gamebooks · Read 27 Sep 2026

Source: Torq Hyperautomation page · Read 27 Sep 2026

Source: Palo Alto Networks: Cortex AgentiX · Read 27 Sep 2026

Read next

Inventory your stackA short inventory of alert sources, playbooks and response actions that tells you which SOC model fits and which vendor questions matter most.Response action catalogA response action catalog lists every containment and fix action by risk and says who may approve it. How to build one and use it with any SOC model.What vendors leave unpublishedWe tracked eleven capabilities across thirteen AI SOC and SOAR vendors. Which ones almost everyone documents, which almost nobody does, and what to ask about the gaps.

More dispatches

6 Oct 2026 · 4 min readAgents Inside the SOAR: What AgentiX and Splunk ES Mean for Teams Staying PutSOARModelsPalo Alto's Cortex AgentiX and Splunk's move of SOAR into Enterprise Security add AI without a migration. What that offers teams that keep their SOAR, and its limits.8 Oct 2026 · 4 min readManaged Options From AI SOC Vendors: Watchtower, PLAID ELITE and MDRModelsStaffingProphet Security's Watchtower and 7AI's PLAID ELITE add vendor people to AI SOC software. How these managed options sit between an AI SOC platform and MDR.