Why talk about models before products?
Most buying conversations start with a product demo. That skips the bigger decision: who will do the work. A product that is excellent at one model can be the wrong purchase if your team needs another. If you have no one awake at night, the best playbook engine in the world will not approve an action at 3 a.m.
What does each model hand off?
- SOAR hands repeatable work to playbooks your team writes in advance. The engine runs them at any hour, but only for the cases someone predicted.
- An AI SOC analyst platform hands the first pass on every alert to software agents that investigate at run time and reach a verdict with evidence. Some also act within limits you set.
- MDR hands the queue to a provider's analysts under a contract that says what they may do and when they must call you.
- A SIEM copilot hands nothing off. It makes your own analysts faster by answering questions, summarizing incidents and drafting queries when asked.
Which stages move?
We draw each model as a work strip with five stages: triage, investigate, respond, tune, and nights and weekends. In SOAR, rules you write carry triage and response, while people carry tuning. In an AI SOC analyst platform, agents carry triage and investigation, and response is shared. In MDR, the provider carries almost everything, with response shared by contract. With a copilot, your analysts carry every stage with help.
The strips are on each model page and every vendor profile, so you can see where a product departs from its model.
Why are the lines blurring?
Vendors are stretching across models. In our profiles, Torq runs agents on top of a no-code workflow engine, so it covers both the AI SOC analyst and SOAR models. Cortex XSOAR adds agents inside a SOAR through Cortex AgentiX. Prophet Security and 7AI sell optional services in which their own people work the queue, which reaches toward MDR. Splunk describes its SIEM as integrated with agentic AI, with SOAR now native inside it.
That is useful for buyers, but it makes labels less reliable. Ask which stage a product actually carries, not which category its homepage claims.
How should you start?
Write down two facts: how many people can own decisions on your alerts, and how many alerts go unread in a normal week. Those two facts narrow the choice more than any feature list. The fit finder turns them, plus three other answers, into an ordered list of models.
What does this site add?
Each vendor profile shows the product's own work strip next to its model's, so you can see where it departs from the general pattern, and the fact table puts the thirteen side by side. Nothing is scored. The aim is to help you match a model to your team first, and only then compare products within it.
Words in this lesson: Alert, Alert queue, SOAR, AI SOC analyst, MDR