# AI Cyber Compare

> A decision guide for security operations teams choosing between an AI SOC analyst platform, SOAR, MDR and a SIEM copilot, with fact-based profiles of thirteen vendors. No scores.

## Decide

- [Home](https://aicybercompare.com/): the four operating models, who carries the alert queue in each, and the 13 profiled vendors, Mate Security featured first, the rest alphabetical.
- [Which model](https://aicybercompare.com/which-model): decision guide by team size, alert volume, current stack, autonomy and sourcing.
- [Fit finder](https://aicybercompare.com/fit-finder): five questions that order the four models by your answers and list the 13 vendors by how many of your needs their pages document.
- [Fact table](https://aicybercompare.com/fact-table): pick two to 13 vendors and compare their facts side by side.
- [How we profile](https://aicybercompare.com/how-we-profile): sources, flags, the work strip, the fit finder point table and exclusions.

## Models

- [AI SOC analyst platform](https://aicybercompare.com/model/ai-soc-analyst): Software agents that triage and investigate alerts the way an analyst would, and in some products take response actions within limits you set.
- [SOAR playbook engine](https://aicybercompare.com/model/soar): Security orchestration, automation and response: a workflow engine that runs playbooks your team writes in advance, across many integrated tools.
- [Managed detection and response (MDR)](https://aicybercompare.com/model/mdr): A service in which a provider's analysts monitor your alerts, investigate them and respond or advise, usually around the clock.
- [SIEM copilot](https://aicybercompare.com/model/siem-copilot): An AI assistant inside a SIEM or security console that answers questions in plain language, summarizes incidents and drafts queries when an analyst asks.

## Vendor profiles

- [All vendor profiles](https://aicybercompare.com/vendors): the 13 profiled vendors, Mate Security featured first, the rest alphabetical.
- [Mate Security](https://aicybercompare.com/vendor/mate-security): Mate is the AI SOC platform built on a home-grown security context graph, running continuous detection / continuous response (CD/CR) and replacing SOAR by translating playbooks into Gamebooks.
- [7AI](https://aicybercompare.com/vendor/7ai): An agentic security platform whose investigations show each agent's mission, tools, requests, responses and conclusion.
- [Artemis Security](https://aicybercompare.com/vendor/artemis-security): An AI-native security operations platform that detects, investigates and stops attacks, with 300+ response actions behind per-action approval.
- [Conifers CognitiveSOC](https://aicybercompare.com/vendor/conifers): An agentic AI SOC platform built multi-tenant for MSSPs, deployable in a customer's own Azure tenant.
- [Cortex XSOAR](https://aicybercompare.com/vendor/cortex-xsoar): Palo Alto Networks' SOAR platform, with Cortex AgentiX described as its next generation.
- [Dropzone AI](https://aicybercompare.com/vendor/dropzone-ai): An AI SOC analyst that investigates alerts end to end and hands response to the SOAR you already run.
- [Exaforce](https://aicybercompare.com/vendor/exaforce): An agentic SOC in which Exabots handle detection, triage, investigation and response, run by your team or managed by Exaforce.
- [Intezer](https://aicybercompare.com/vendor/intezer): An AI SOC that investigates alerts at forensic depth and routes incidents to SOAR and ticketing, priced by endpoints.
- [Prophet Security](https://aicybercompare.com/vendor/prophet-security): An AI SOC analyst with scoped response actions and an optional 24x7 human review service.
- [Splunk SOAR](https://aicybercompare.com/vendor/splunk-soar): Splunk's SOAR, now a native capability inside Splunk Enterprise Security.
- [Tines](https://aicybercompare.com/vendor/tines): A workflow platform for AI agents, apps and automation that positions itself as a modern SOAR, with an AI SOC use case built from workflows.
- [Torq AI SOC Platform](https://aicybercompare.com/vendor/torq): Agentic AI on top of Hyperautomation: AI agents for triage and investigation plus a no-code automation engine.
- [Vega](https://aicybercompare.com/vendor/vega): An agentic cyber defense platform that runs hunting, detection and triage on data where it lives, and recommends next actions to analysts.

## MDR and copilot profiles

- [Arctic Wolf Aurora MDR](https://aicybercompare.com/vendor/arctic-wolf): Arctic Wolf's managed detection and response, with 24x7 monitoring, response actions and a named Concierge team for every customer.
- [CrowdStrike Falcon Complete](https://aicybercompare.com/vendor/crowdstrike-falcon-complete): CrowdStrike's 24/7 managed detection and response service, which it calls agentic MDR.
- [Daylight Security](https://aicybercompare.com/vendor/daylight-security): An AI-native managed service in which AI agents and Daylight's senior experts run detection, investigation and response 24/7.
- [Expel MDR](https://aicybercompare.com/vendor/expel): Expel's managed detection and response, sold in three packages that all include 24x7 Expel SOC monitoring and access to Expel Workbench.
- [Zscaler MDR (formerly Red Canary)](https://aicybercompare.com/vendor/zscaler-mdr): Red Canary's MDR, now sold as Zscaler Managed Detection and Response: 24/7 human-led, AI-powered support across identity, endpoint, cloud, email and network.
- [CrowdStrike Charlotte AI](https://aicybercompare.com/vendor/crowdstrike-charlotte-ai): CrowdStrike's AI for the SOC, which it describes as agentic: it "reasons, decides, and acts at machine speed" across domains.
- [Google Security Operations with Gemini](https://aicybercompare.com/vendor/google-secops-gemini): Google's security operations platform, unifying SIEM, SOAR and threat intelligence, with Gemini for natural-language search, investigation chat, case summaries and response recommendations.
- [Microsoft Security Copilot](https://aicybercompare.com/vendor/microsoft-security-copilot): Microsoft's generative AI assistant for security, available as a standalone experience or embedded in Microsoft Security products, priced in security compute units (SCUs).

## Side by side

- [7AI vs Artemis](https://aicybercompare.com/7ai-beside-artemis-security): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Conifers](https://aicybercompare.com/7ai-beside-conifers): facts side by side, each sourced to the vendor's own pages.
- [7AI vs XSOAR](https://aicybercompare.com/7ai-beside-cortex-xsoar): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Dropzone AI](https://aicybercompare.com/7ai-beside-dropzone-ai): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Exaforce](https://aicybercompare.com/7ai-beside-exaforce): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Intezer](https://aicybercompare.com/7ai-beside-intezer): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Mate](https://aicybercompare.com/7ai-beside-mate-security): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Prophet](https://aicybercompare.com/7ai-beside-prophet-security): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Splunk SOAR](https://aicybercompare.com/7ai-beside-splunk-soar): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Tines](https://aicybercompare.com/7ai-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Torq](https://aicybercompare.com/7ai-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [7AI vs Vega](https://aicybercompare.com/7ai-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Conifers](https://aicybercompare.com/artemis-security-beside-conifers): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs XSOAR](https://aicybercompare.com/artemis-security-beside-cortex-xsoar): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Dropzone AI](https://aicybercompare.com/artemis-security-beside-dropzone-ai): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Exaforce](https://aicybercompare.com/artemis-security-beside-exaforce): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Intezer](https://aicybercompare.com/artemis-security-beside-intezer): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Mate](https://aicybercompare.com/artemis-security-beside-mate-security): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Prophet](https://aicybercompare.com/artemis-security-beside-prophet-security): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Splunk SOAR](https://aicybercompare.com/artemis-security-beside-splunk-soar): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Tines](https://aicybercompare.com/artemis-security-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Torq](https://aicybercompare.com/artemis-security-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [Artemis vs Vega](https://aicybercompare.com/artemis-security-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs XSOAR](https://aicybercompare.com/conifers-beside-cortex-xsoar): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs Dropzone AI](https://aicybercompare.com/conifers-beside-dropzone-ai): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs Exaforce](https://aicybercompare.com/conifers-beside-exaforce): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs Intezer](https://aicybercompare.com/conifers-beside-intezer): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs Mate](https://aicybercompare.com/conifers-beside-mate-security): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs Prophet](https://aicybercompare.com/conifers-beside-prophet-security): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs Splunk SOAR](https://aicybercompare.com/conifers-beside-splunk-soar): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs Tines](https://aicybercompare.com/conifers-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs Torq](https://aicybercompare.com/conifers-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [Conifers vs Vega](https://aicybercompare.com/conifers-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [XSOAR vs Dropzone AI](https://aicybercompare.com/cortex-xsoar-beside-dropzone-ai): facts side by side, each sourced to the vendor's own pages.
- [XSOAR vs Exaforce](https://aicybercompare.com/cortex-xsoar-beside-exaforce): facts side by side, each sourced to the vendor's own pages.
- [XSOAR vs Intezer](https://aicybercompare.com/cortex-xsoar-beside-intezer): facts side by side, each sourced to the vendor's own pages.
- [XSOAR vs Mate](https://aicybercompare.com/cortex-xsoar-beside-mate-security): facts side by side, each sourced to the vendor's own pages.
- [XSOAR vs Prophet](https://aicybercompare.com/cortex-xsoar-beside-prophet-security): facts side by side, each sourced to the vendor's own pages.
- [XSOAR vs Splunk SOAR](https://aicybercompare.com/cortex-xsoar-beside-splunk-soar): facts side by side, each sourced to the vendor's own pages.
- [XSOAR vs Tines](https://aicybercompare.com/cortex-xsoar-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [XSOAR vs Torq](https://aicybercompare.com/cortex-xsoar-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [XSOAR vs Vega](https://aicybercompare.com/cortex-xsoar-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Dropzone AI vs Exaforce](https://aicybercompare.com/dropzone-ai-beside-exaforce): facts side by side, each sourced to the vendor's own pages.
- [Dropzone AI vs Intezer](https://aicybercompare.com/dropzone-ai-beside-intezer): facts side by side, each sourced to the vendor's own pages.
- [Dropzone AI vs Mate](https://aicybercompare.com/dropzone-ai-beside-mate-security): facts side by side, each sourced to the vendor's own pages.
- [Dropzone AI vs Prophet](https://aicybercompare.com/dropzone-ai-beside-prophet-security): facts side by side, each sourced to the vendor's own pages.
- [Dropzone AI vs Splunk SOAR](https://aicybercompare.com/dropzone-ai-beside-splunk-soar): facts side by side, each sourced to the vendor's own pages.
- [Dropzone AI vs Tines](https://aicybercompare.com/dropzone-ai-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [Dropzone AI vs Torq](https://aicybercompare.com/dropzone-ai-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [Dropzone AI vs Vega](https://aicybercompare.com/dropzone-ai-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Exaforce vs Intezer](https://aicybercompare.com/exaforce-beside-intezer): facts side by side, each sourced to the vendor's own pages.
- [Exaforce vs Mate](https://aicybercompare.com/exaforce-beside-mate-security): facts side by side, each sourced to the vendor's own pages.
- [Exaforce vs Prophet](https://aicybercompare.com/exaforce-beside-prophet-security): facts side by side, each sourced to the vendor's own pages.
- [Exaforce vs Splunk SOAR](https://aicybercompare.com/exaforce-beside-splunk-soar): facts side by side, each sourced to the vendor's own pages.
- [Exaforce vs Tines](https://aicybercompare.com/exaforce-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [Exaforce vs Torq](https://aicybercompare.com/exaforce-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [Exaforce vs Vega](https://aicybercompare.com/exaforce-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Intezer vs Mate](https://aicybercompare.com/intezer-beside-mate-security): facts side by side, each sourced to the vendor's own pages.
- [Intezer vs Prophet](https://aicybercompare.com/intezer-beside-prophet-security): facts side by side, each sourced to the vendor's own pages.
- [Intezer vs Splunk SOAR](https://aicybercompare.com/intezer-beside-splunk-soar): facts side by side, each sourced to the vendor's own pages.
- [Intezer vs Tines](https://aicybercompare.com/intezer-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [Intezer vs Torq](https://aicybercompare.com/intezer-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [Intezer vs Vega](https://aicybercompare.com/intezer-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Mate vs Prophet](https://aicybercompare.com/mate-security-beside-prophet-security): facts side by side, each sourced to the vendor's own pages.
- [Mate vs Splunk SOAR](https://aicybercompare.com/mate-security-beside-splunk-soar): facts side by side, each sourced to the vendor's own pages.
- [Mate vs Tines](https://aicybercompare.com/mate-security-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [Mate vs Torq](https://aicybercompare.com/mate-security-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [Mate vs Vega](https://aicybercompare.com/mate-security-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Prophet vs Splunk SOAR](https://aicybercompare.com/prophet-security-beside-splunk-soar): facts side by side, each sourced to the vendor's own pages.
- [Prophet vs Tines](https://aicybercompare.com/prophet-security-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [Prophet vs Torq](https://aicybercompare.com/prophet-security-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [Prophet vs Vega](https://aicybercompare.com/prophet-security-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Splunk SOAR vs Tines](https://aicybercompare.com/splunk-soar-beside-tines): facts side by side, each sourced to the vendor's own pages.
- [Splunk SOAR vs Torq](https://aicybercompare.com/splunk-soar-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [Splunk SOAR vs Vega](https://aicybercompare.com/splunk-soar-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Tines vs Torq](https://aicybercompare.com/tines-beside-torq): facts side by side, each sourced to the vendor's own pages.
- [Tines vs Vega](https://aicybercompare.com/tines-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [Torq vs Vega](https://aicybercompare.com/torq-beside-vega): facts side by side, each sourced to the vendor's own pages.
- [AI SOC analyst vs MDR](https://aicybercompare.com/ai-soc-analyst-beside-mdr): the two operating models side by side.
- [AI SOC analyst vs SIEM copilot](https://aicybercompare.com/ai-soc-analyst-beside-siem-copilot): the two operating models side by side.
- [AI SOC analyst vs SOAR](https://aicybercompare.com/ai-soc-analyst-beside-soar): the two operating models side by side.
- [MDR vs SIEM copilot](https://aicybercompare.com/mdr-beside-siem-copilot): the two operating models side by side.
- [MDR vs SOAR](https://aicybercompare.com/mdr-beside-soar): the two operating models side by side.
- [SIEM copilot vs SOAR](https://aicybercompare.com/siem-copilot-beside-soar): the two operating models side by side.

## SOC primer

- [SOC primer](https://aicybercompare.com/soc-primer): 10 lessons in three tracks on choosing and running a SOC operating model.
- [The Four SOC Operating Models: AI SOC Analyst, SOAR, MDR, Copilot](https://aicybercompare.com/soc-primer/four-operating-models): What each SOC operating model buys you, who carries the work in each, and why the lines between them are blurring in 2026.
- [What an MDR Service Buys You, and What to Check in the Contract](https://aicybercompare.com/soc-primer/what-mdr-buys): Managed detection and response sells people and hours. What that covers, where responsibility splits, and the contract questions that decide whether it works.
- [Copilot or Agent: Answering Questions vs Working the SOC Queue](https://aicybercompare.com/soc-primer/copilot-or-agent): A SIEM copilot answers when asked; an AI SOC agent works alerts on its own. Why that difference decides what happens to unread alerts and the night shift.
- [Measure Your SOC Alert Queue Before You Choose a Model](https://aicybercompare.com/soc-primer/measuring-your-alert-queue): Five measurements to take from your own SIEM and ticketing data before choosing between an AI SOC analyst, SOAR, MDR or a copilot, and how each points to a model.
- [Who Owns Decisions at 3 a.m.? SOC Staffing and Coverage by Model](https://aicybercompare.com/soc-primer/staffing-and-coverage): Each SOC operating model needs a different kind of staffing. Who must be awake, who approves actions and who maintains the system, model by model.
- [Inventory Your SIEM, SOAR and Playbooks Before You Buy](https://aicybercompare.com/soc-primer/stack-inventory): A short inventory of alert sources, playbooks and response actions that tells you which SOC model fits and which vendor questions matter most.
- [Build a Response Action Catalog: Which SOC Actions May Run Alone](https://aicybercompare.com/soc-primer/response-action-catalog): A response action catalog lists every containment and fix action by risk and says who may approve it. How to build one and use it with any SOC model.
- [AI SOC by Day, Provider by Night: Running a Split SOC Model](https://aicybercompare.com/soc-primer/hybrid-day-and-night): Many teams run their own AI SOC platform by day and a provider overnight. How to split the work, what to agree in writing, and the failure points to watch.
- [Hand-offs Between SOC Models: Keeping One Case Record](https://aicybercompare.com/soc-primer/handoffs-between-models): When playbooks, agents, providers and analysts share a queue, hand-offs fail. How to keep one case record and clear ownership across two SOC models.
- [Plan Your Exit Before You Sign: SOC Data, Detections and Playbooks](https://aicybercompare.com/soc-primer/plan-your-exit): Switching SOC models later is expensive if you did not plan the exit. What to keep, what to ask for in the contract, and where lock-in hides in each model.

## Reference

- [SOC words](https://aicybercompare.com/soc-words): 35 terms explained, grouped by theme.
- [Asked often](https://aicybercompare.com/asked-often): 24 questions about the four models, the profiled vendors and this site.

## Dispatches

- [Dispatches](https://aicybercompare.com/dispatches): dated analysis from The Triage Desk on choosing and running a SOC operating model.
- [AI SOC Vendor Moves in 2026, Sorted by Which SOC Model They Change](https://aicybercompare.com/dispatches/2026-vendor-moves-by-model): Eighteen dated announcements from January to August 2026, sorted by the operating model they push toward: agents, playbooks, managed people or analyst assistance.
- [What Thirteen SOC Vendors Leave Unpublished: A Count of Not Described](https://aicybercompare.com/dispatches/what-soc-vendors-leave-unpublished): We tracked eleven capabilities across thirteen AI SOC and SOAR vendors. Which ones almost everyone documents, which almost nobody does, and what to ask about the gaps.
- [Three Ways a Small SOC Can Cover the Night Shift in 2026](https://aicybercompare.com/dispatches/covering-the-night-shift): A small security team cannot staff nights. Three ways to cover them: agents with a tight action catalog, a vendor's managed option, or an MDR provider, and how each fails.
- [The One-Page Brief to Send Every SOC Vendor Before the Demo](https://aicybercompare.com/dispatches/one-page-vendor-brief): A one-page brief with your alert sources, playbooks, action catalog and staffing turns a generic SOC vendor demo into an answer to your questions. What goes on the page.
- [Agents Inside the SOAR: What AgentiX and Splunk ES Mean for Teams Staying Put](https://aicybercompare.com/dispatches/agents-inside-soar): Palo Alto's Cortex AgentiX and Splunk's move of SOAR into Enterprise Security add AI without a migration. What that offers teams that keep their SOAR, and its limits.
- [Managed Options From AI SOC Vendors: Watchtower, PLAID ELITE and MDR](https://aicybercompare.com/dispatches/managed-options-from-ai-soc-vendors): Prophet Security's Watchtower and 7AI's PLAID ELITE add vendor people to AI SOC software. How these managed options sit between an AI SOC platform and MDR.
- [Multi-Tenant AI SOC Products and What They Mean for MSSP Customers](https://aicybercompare.com/dispatches/multi-tenant-ai-soc-and-mssps): Dropzone AI and Conifers describe offerings built for MSSPs. What multi-tenant AI SOC means for providers, and what a company buying from an MSSP should ask.
- [NIST's Draft AI Quick-Start for CSF 2.0: What SOC Teams Should Note](https://aicybercompare.com/dispatches/nist-ai-csf-draft-for-soc-teams): NIST's initial public draft of SP 1353 offers AI prompts and use cases for CSF 2.0 analysis and reporting. What it covers, what it does not, and how SOC teams can respond by 15 October.

## Site

- [Contact](https://aicybercompare.com/contact): questions, corrections to vendor facts, privacy requests and copyright notices.
- [Privacy Policy](https://aicybercompare.com/privacy-policy): what this site collects and why.
- [Cookie Policy](https://aicybercompare.com/cookie-policy): how this site handles cookies and browser storage.
- [Terms of Use](https://aicybercompare.com/terms-of-use): terms for using this site.
- [Copyright and DMCA policy](https://aicybercompare.com/dmca): how to send a copyright notice.