Skip to content
AI Cyber Compare

FIT FINDER · FIVE QUESTIONS

SOC model fit finder: which operating model fits your team?

The short answer

Answer five questions and the finder adds published points for each of the four models, then lists the thirteen profiled vendors by how many of your needs their own pages document. The result below uses default answers until you change them. Nothing is scored for quality: the order comes only from your answers and the table on How we profile.

Answered 5 of 5

How many people work your alert queue today?
How does your alert volume feel?
What do you run today?
How far should software act on its own?
Who should do the work?

Which model fits your answers?

  1. 1AI SOC analystAI SOC analyst platform
    14 of 15
    Why
    • 1 to 5 analysts: 3 points
    • A backlog builds in busy weeks: 2 points
    • A SIEM, no SOAR: 3 points
    • It acts after a person approves: 3 points
    • Our own team, in-house: 3 points
    Work strip for AI SOC analyst platform: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, shared; Nights and weekends, AI agent.TriageAI agentInvestigateAI agentRespondSharedTuneSharedNights and weekendsAI agent

    Read about AI SOC analyst

  2. 2SIEM copilotSIEM copilot
    10 of 15
    Why
    • 1 to 5 analysts: 2 points
    • A backlog builds in busy weeks: 1 point
    • A SIEM, no SOAR: 3 points
    • It acts after a person approves: 1 point
    • Our own team, in-house: 3 points
  3. 3SOARSOAR playbook engine
    8 of 15
    Why
    • 1 to 5 analysts: 1 point
    • A backlog builds in busy weeks: 2 points
    • A SIEM, no SOAR: 1 point
    • It acts after a person approves: 2 points
    • Our own team, in-house: 2 points
  4. 4MDRManaged detection and response (MDR)
    6 of 15
    Why
    • 1 to 5 analysts: 2 points
    • A backlog builds in busy weeks: 2 points
    • A SIEM, no SOAR: 1 point
    • It acts after a person approves: 1 point
    • Our own team, in-house: 0 points

Which vendors document what your answers need?

  • Runs response actions itself
  • Approval or sign-off before actions
  1. 7AIAI SOC analystMDRDocuments 2 of 2 needs
    • Runs response actions itself
    • Approval or sign-off before actions
  2. Artemis SecurityAI SOC analystSOARMDRDocuments 2 of 2 needs
    • Runs response actions itself
    • Approval or sign-off before actions
  3. Conifers CognitiveSOCAI SOC analystDocuments 2 of 2 needs
    • Runs response actions itself
    • Approval or sign-off before actions
  4. Cortex XSOARSOARAI SOC analystDocuments 2 of 2 needs
    • Runs response actions itself
    • Approval or sign-off before actions
  5. ExaforceAI SOC analystMDRDocuments 2 of 2 needs
    • Runs response actions itself
    • Approval or sign-off before actions
  6. Mate SecurityAI SOC analystDocuments 2 of 2 needs
    • Runs response actions itself
    • Approval or sign-off before actions
  7. Prophet SecurityAI SOC analystMDRDocuments 2 of 2 needs
    • Runs response actions itself
    • Approval or sign-off before actions
  8. TinesSOARAI SOC analystDocuments 2 of 2 needs
    • Runs response actions itself
    • Approval or sign-off before actions
  9. Splunk SOARSOARSIEM copilotDocuments 2 of 2 needs
    • Runs response actions itself
    • Approval or sign-off before actions
  10. IntezerAI SOC analystDocuments 1 of 2 needs
    • Runs response actions itself
    • Not describedApproval or sign-off before actions
  11. Torq AI SOC PlatformAI SOC analystSOARDocuments 1 of 2 needs
    • Runs response actions itself
    • Not describedApproval or sign-off before actions
  12. Dropzone AIAI SOC analystDocuments 0 of 2 needs
    • Not describedRuns response actions itself
    • Not describedApproval or sign-off before actions
  13. VegaAI SOC analystSIEM copilotDocuments 0 of 2 needs
    • Not describedRuns response actions itself
    • Not describedApproval or sign-off before actions

Model definitions are general descriptions of each category. MDR providers and SIEM copilots have lighter profiles built from vendor pages read in October 2026; they are not in the fact table, fit finder vendor list or pair pages, which compare the thirteen AI SOC and SOAR products on the same 11 capabilities.

Model fit points = sum over your five answers of the points that answer gives the model (0 to 3 each, maximum 15). Vendor order = number of implied needs the vendor's pages document, then whether the vendor covers the top model, then alphabetical. Point table: How we profile.

Asked often about this page

Is the fit finder a ranking of vendors?

No. It counts how many of the needs implied by your answers each vendor's public pages document. A vendor that documents a capability you did not ask about gets no credit for it.

Why does my answer change the order so much?

Each answer moves up to 3 points per model, and some answers add needs. Outsourcing, for example, gives MDR its maximum and adds the managed service need.

Where do the points come from?

They are editorial judgments, published in full on How we profile so you can check or disagree with them.

Does the finder store my answers?

Only in your own browser, under the key acc-finder-answers, so the page remembers them next time. Nothing is sent to us.