What thirteen AI SOC and SOAR vendors leave unpublished

What did we count?

Each profile on this site carries eleven flags: capabilities a vendor's public pages either describe or do not. A flag is "Documented" when the pages we read describe it, and "Not described" otherwise. Not described is not the same as absent: a vendor may offer something it does not write about. But for a buyer, an undocumented capability is a question you must ask, and the count shows where those questions cluster.

All counts in this post are computed from the same data as the fact table, so they stay correct if a profile changes.

What does almost everyone document?

• Running response actions itself: 11 of 13. Not described by Dropzone AI and Vega; Dropzone AI hands response to a connected SOAR by design.
• Acting alone on some cases: 11 of 13.
• An integration count: 9 of 13. Not published by Mate Security, 7AI, Tines and Vega.
• Approval or sign-off before actions: 9 of 13. Not described by Dropzone AI, Intezer, Torq AI SOC Platform and Vega.

So the basic question, "can it act?", has a public answer for nearly every vendor. The harder questions do not.

What does only a minority document?

• A pricing unit or tiers: 3 (Dropzone AI, Intezer and Tines). Dropzone AI publishes its Standard tier as up to 4,000 full investigations per year per AI analyst; Intezer prices by endpoints with no volume fees.
• On-premises, hybrid or your own cloud tenant: 4 (Conifers CognitiveSOC, Cortex XSOAR, Splunk SOAR and Tines).
• A managed option where the vendor's people work the queue: 4 (7AI, Artemis Security, Exaforce and Prophet Security).
• A multi-tenant or MSSP offering: 2 (Conifers CognitiveSOC and Dropzone AI).
• A single-tenant option: 2 (Dropzone AI and Prophet Security).
• A data residency option: 2 (Conifers CognitiveSOC and Dropzone AI).
• Translating existing SOAR playbooks: 1 (Mate Security).

Why is pricing the biggest gap?

None of the thirteen AI SOC and SOAR vendors publishes a list price for a paid edition on its own site. Torq's pricing page returned a 404 when we checked. Mate Security publishes no price on its own site; its AWS Marketplace listing shows one contract price for a usage tier it does not define. The vendors that publish a unit give buyers something real: if you know you pay per investigation or per endpoint, you know what makes the bill grow, and you can model it against your own alert counts before the first call.

Why does approval matter more than autonomy?

More vendors say their product can act alone (11) than describe how a person approves an action before it runs (9). For a team writing a response action catalog, the approval controls are what turn "the product can act" into "the product acts only where we said". If a vendor's pages do not describe them, ask for a demonstration of the approval flow and of how autonomy is pulled back.

How should you use the count?

Take the flags marked Not described for the vendors on your shortlist and turn each into a written question. Ask for written answers, not a call. A vendor that answers in writing gives you something to check against the contract; one that answers only in a demo gives you a memory.

Which gaps matter for which model?

The gaps weigh differently depending on the model you lean toward. If you want a provider's people at night, the managed option flag is the one to check first. If you must keep data in a region or in your own cloud, residency and customer hosting narrow the list sharply. If you depend on many playbooks, the playbook flag and the vendor's position on SOAR decide more than anything else. The fit finder turns your answers into exactly this list of needs and shows, for each vendor, which of them its pages describe.