Skip to content
AI Cyber Compare

LESSON 10 OF 10 · RUNNING · 3 MIN READ

Plan your exit before you sign: data, detections and playbooks

The short answer

Every SOC model creates something you will want to keep: playbooks, detections, case history, learned context or a provider's notes. Before signing, ask what you can export, in what format, and what stays behind. Lock-in hides in different places in each model, and an exit plan is cheapest to write on day one.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

Why plan an exit now?

Because it is cheap now and expensive later. On day one you have bargaining power over contract terms and a clear picture of what you are putting in. Three years later you have years of case history, tuned detections and habits built around one product.

Where does lock-in hide in each model?

  • SOAR: the playbooks themselves. They encode years of decisions in one vendor's format. Moving them means translating or rebuilding them.
  • AI SOC analyst platforms: learned context. Several vendors describe learning from your team's decisions. Mate Security describes a Security Context Graph of memories and decision traces; Torq says SOC Brain learns from past investigations and analyst verdicts, with a private model per customer. Ask what of that can leave with you.
  • MDR: knowledge on the provider's side. Detections written for you, notes about your environment and case history may sit in the provider's systems.
  • SIEM copilot: less lock-in of its own, but it deepens dependence on the SIEM it lives in.

What should you ask for?

  1. Export of case history, including verdicts, evidence and actions, in a documented format.
  2. Export of detections and automation written for you, in a format another tool can read.
  3. For learned context: a readable export of the memories, rules or instructions the product built from your team's decisions, or a clear statement that none exists.
  4. A deletion commitment and a timeline for your data after exit. Vendors that describe data handling publicly, such as Prophet Security's single-tenant datastores with a bring-your-own-key option, make this conversation easier.
  5. Support horizons: for on-premises editions, note any stated end of life. Palo Alto's documentation, for example, lists 30 September 2029 as the end of life for Cortex XSOAR 8 On-prem.

How does this change the model choice?

It rarely decides the model, but it can decide between two vendors of the same model. If two products fit your team equally, prefer the one that answers the export questions in writing.

A closing check

Before you sign anything, write one paragraph titled "How we would leave". If you cannot write it, you are not ready to sign.

Who should review the exit paragraph?

The SOC lead, procurement and whoever owns data protection. Each reads it from a different angle: operations asks whether the team could keep working during a switch, procurement asks what the contract allows, and data protection asks what remains with the vendor. If all three accept it, sign. If not, the gaps are your negotiation list.

Words in this lesson: SOAR, AI SOC analyst, MDR, SIEM copilot, SIEM

Sources

Source: Mate Security platform page · Read 27 Sep 2026

Source: Torq news: SOC Brain · Published 27 Jul 2026 · Read 27 Sep 2026

Source: Cortex XSOAR documentation · Read 27 Sep 2026

Source: Prophet Security: security page · Read 27 Sep 2026

Back to lesson 1The four SOC operating models, and who does the work in eachWhat each SOC operating model buys you, who carries the work in each, and why the lines between them are blurring in 2026.

Read next

Inventory your stackA short inventory of alert sources, playbooks and response actions that tells you which SOC model fits and which vendor questions matter most.MDRA service in which a provider's analysts monitor your alerts, investigate them and respond or advise, usually around the clock.Asked oftenShort answers to common SOC model questions.