Skip to content
AI Cyber Compare

Vendor profiles

SOC vendor profiles: thirteen AI SOC and SOAR products, facts only

The short answer

We profiled thirteen vendors from their public pages, read in September 2026 and updated on 13 October 2026: ten whose primary model is the AI SOC analyst and three SOAR platforms. Mate Security is featured first; the rest are listed alphabetically. None are ranked. Use the filter to narrow by model, or the fit finder to order them by your needs.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

Desk research from public vendor pages: vendor facts read September 2026, updated 2026-10-13. Editorial reading of what vendors publish; we did not run the products and did not interview vendors.

Filter by operating model

Showing thirteen of thirteen vendors.

Mate Security

Mate is the AI SOC platform built on a home-grown security context graph, running continuous detection / continuous response (CD/CR) and replacing SOAR by translating playbooks into Gamebooks.

AI SOC analystReplaces SOAR
Work strip for Mate Security: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, shared; Nights and weekends, not described.TriageAI agentInvestigateAI agentRespondSharedTuneSharedNights and weekendsNot described
Integrations: Not published
Pricing: Not published
Deployment: Mate says it is built on AWS infrastructure and sells through AWS Marketplace. Its trust…
Read the profile

7AI

An agentic security platform whose investigations show each agent's mission, tools, requests, responses and conclusion.

AI SOC analystMDRWorks beside SOAR
Work strip for 7AI: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, shared; Nights and weekends, provider's analysts.TriageAI agentInvestigateAI agentRespondSharedTuneSharedNights and weekendsProvider's analysts
Integrations: Not published
Pricing: Not published
Deployment: Available through the AWS Security Hub Extended plan (announced 26 February 2026). Self-h…
Read the profile

Artemis Security

An AI-native security operations platform that detects, investigates and stops attacks, with 300+ response actions behind per-action approval.

AI SOC analystSOARMDRReplaces SOAR
Work strip for Artemis Security: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, shared; Nights and weekends, provider's analysts.TriageAI agentInvestigateAI agentRespondSharedTuneSharedNights and weekendsProvider's analysts
Integrations: 240+ connectors (Artemis states), including Splunk, Splunk SOAR, Microsoft Sentinel, Crow…
Pricing: Not published
Deployment: Hot-path data ingested, high-volume data queried where it lives; on-premises execution of…
Read the profile

Conifers CognitiveSOC

An agentic AI SOC platform built multi-tenant for MSSPs, deployable in a customer's own Azure tenant.

AI SOC analystReplaces SOAR
Work strip for Conifers CognitiveSOC: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, shared; Nights and weekends, not described.TriageAI agentInvestigateAI agentRespondSharedTuneSharedNights and weekendsNot described
Integrations: 90+ (homepage). A May 2026 release said 60+.
Pricing: Not published
Deployment: SaaS on Conifers-hosted Azure, or private cloud in the customer's own Azure tenant; proce…
Read the profile

Cortex XSOAR

Palo Alto Networks' SOAR platform, with Cortex AgentiX described as its next generation.

SOARAI SOC analystAdds AI inside SOAR
Work strip for Cortex XSOAR: Triage, rules you write; Investigate, shared; Respond, rules you write; Tune, your analysts; Nights and weekends, rules you write.TriageRules you writeInvestigateSharedRespondRules you writeTuneYour analystsNights and weekendsRules you write
Integrations: 900+ prebuilt integrations and automation packs; thousands of security actions in the Mar…
Pricing: Not published
Deployment: Cortex XSOAR 8 SaaS, Cortex XSOAR 8 On-prem (end of life 30 September 2029 per Palo Alto…
Read the profile

Dropzone AI

An AI SOC analyst that investigates alerts end to end and hands response to the SOAR you already run.

AI SOC analystWorks beside SOAR
Work strip for Dropzone AI: Triage, AI agent; Investigate, AI agent; Respond, rules you write; Tune, not described; Nights and weekends, AI agent.TriageAI agentInvestigateAI agentRespondRules you writeTuneNot describedNights and weekendsAI agent
Integrations: 90+ across 14 categories, including SOAR tools (Cortex XSOAR, Splunk SOAR, Tines, Torq, D…
Pricing: Priced on investigation capacity ("Pay for the Investigation Capacity Your Team Needs").…
Deployment: Standard service; Enterprise with a dedicated single-tenant environment; MSSP with a dedi…
Read the profile

Exaforce

An agentic SOC in which Exabots handle detection, triage, investigation and response, run by your team or managed by Exaforce.

AI SOC analystMDRReplaces SOAR
Work strip for Exaforce: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, not described; Nights and weekends, provider's analysts.TriageAI agentInvestigateAI agentRespondSharedTuneNot describedNights and weekendsProvider's analysts
Integrations: 130+ across IaaS, SaaS, identity, endpoint, SIEM, SOAR, email, ticketing, threat intel an…
Pricing: Not published
Deployment: Not published
Read the profile

Intezer

An AI SOC that investigates alerts at forensic depth and routes incidents to SOAR and ticketing, priced by endpoints.

AI SOC analystWorks beside SOAR
Work strip for Intezer: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, not described; Nights and weekends, not described.TriageAI agentInvestigateAI agentRespondSharedTuneNot describedNights and weekendsNot described
Integrations: 100+
Pricing: Two tiers: Starter (one alert source) and Complete (all alert sources), both priced by en…
Deployment: Not published
Read the profile

Prophet Security

An AI SOC analyst with scoped response actions and an optional 24x7 human review service.

AI SOC analystMDRReplaces SOAR
Work strip for Prophet Security: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, shared; Nights and weekends, provider's analysts.TriageAI agentInvestigateAI agentRespondSharedTuneSharedNights and weekendsProvider's analysts
Integrations: 200+ out of the box.
Pricing: Not published
Deployment: Single-tenant; customer data in individual datastores; bring-your-own-key option; runs on…
Read the profile

Splunk SOAR

Splunk's SOAR, now a native capability inside Splunk Enterprise Security.

SOARSIEM copilotAdds AI inside SOAR
Work strip for Splunk SOAR: Triage, rules you write; Investigate, rules you write; Respond, rules you write; Tune, your analysts; Nights and weekends, rules you write.TriageRules you writeInvestigateRules you writeRespondRules you writeTuneYour analystsNights and weekendsRules you write
Integrations: 300+ third-party tools and 2,800+ automated actions.
Pricing: Not published
Deployment: Cloud, on-premises or hybrid.
Read the profile

Tines

A workflow platform for AI agents, apps and automation that positions itself as a modern SOAR, with an AI SOC use case built from workflows.

SOARAI SOC analystReplaces SOAR
Work strip for Tines: Triage, AI agent; Investigate, shared; Respond, shared; Tune, your analysts; Nights and weekends, not described.TriageAI agentInvestigateSharedRespondSharedTuneYour analystsNights and weekendsNot described
Integrations: Not published
Pricing: Free edition: unlimited users and connectors, 3 live workflows, one-time $50 AI allowance…
Deployment: Shared stack, self-hosted or hybrid; Tines says AI features are available wherever Tines…
Read the profile

Torq AI SOC Platform

Agentic AI on top of Hyperautomation: AI agents for triage and investigation plus a no-code automation engine.

AI SOC analystSOARReplaces SOAR
Work strip for Torq AI SOC Platform: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, shared; Nights and weekends, not described.TriageAI agentInvestigateAI agentRespondSharedTuneSharedNights and weekendsNot described
Integrations: 300 pre-built integrations and 4,000+ pre-built steps, plus AI-generated integrations.
Pricing: Not published
Deployment: Described as cloud-native. Other options: not described on the pages reviewed.
Read the profile

Vega

An agentic cyber defense platform that runs hunting, detection and triage on data where it lives, and recommends next actions to analysts.

AI SOC analystSIEM copilotWorks beside SOAR
Work strip for Vega: Triage, AI agent; Investigate, AI agent; Respond, your analysts; Tune, shared; Nights and weekends, not described.TriageAI agentInvestigateAI agentRespondYour analystsTuneSharedNights and weekendsNot described
Integrations: Not published
Pricing: Not published
Deployment: Runs on Vega's Security Analytics Mesh against data where it lives; Vega says no migratio…
Read the profile
  • Your analysts
  • Rules you write
  • AI agent
  • Provider's analysts
  • Shared
  • Not described

Model definitions are general descriptions of each category. MDR providers and SIEM copilots have lighter profiles built from vendor pages read in October 2026; they are not in the fact table, fit finder vendor list or pair pages, which compare the thirteen AI SOC and SOAR products on the same 11 capabilities.

Which MDR providers and SIEM copilots did we profile?

MDR providers

Arctic Wolf Aurora MDR

Arctic Wolf's managed detection and response, with 24x7 monitoring, response actions and a named Concierge team for every customer.

MDR
Work strip for Arctic Wolf Aurora MDR: Triage, provider's analysts; Investigate, provider's analysts; Respond, provider's analysts; Tune, not described; Nights and weekends, provider's analysts.TriageProvider's analystsInvestigateProvider's analystsRespondProvider's analystsTuneNot describedNights and weekendsProvider's analysts
Pricing: Not published
Read the profile

CrowdStrike Falcon Complete

CrowdStrike's 24/7 managed detection and response service, which it calls agentic MDR.

MDR
Work strip for CrowdStrike Falcon Complete: Triage, provider's analysts; Investigate, provider's analysts; Respond, provider's analysts; Tune, not described; Nights and weekends, provider's analysts.TriageProvider's analystsInvestigateProvider's analystsRespondProvider's analystsTuneNot describedNights and weekendsProvider's analysts
Pricing: Contact sales (CrowdStrike pricing page).
Read the profile

Daylight Security

An AI-native managed service in which AI agents and Daylight's senior experts run detection, investigation and response 24/7.

MDR
Work strip for Daylight Security: Triage, shared; Investigate, shared; Respond, provider's analysts; Tune, provider's analysts; Nights and weekends, provider's analysts.TriageSharedInvestigateSharedRespondProvider's analystsTuneProvider's analystsNights and weekendsProvider's analysts
Pricing: Not published
Read the profile

Expel MDR

Expel's managed detection and response, sold in three packages that all include 24x7 Expel SOC monitoring and access to Expel Workbench.

MDR
Work strip for Expel MDR: Triage, provider's analysts; Investigate, provider's analysts; Respond, shared; Tune, not described; Nights and weekends, provider's analysts.TriageProvider's analystsInvestigateProvider's analystsRespondSharedTuneNot describedNights and weekendsProvider's analysts
Pricing: Not published
Read the profile

Zscaler MDR (formerly Red Canary)

Red Canary's MDR, now sold as Zscaler Managed Detection and Response: 24/7 human-led, AI-powered support across identity, endpoint, cloud, email and network.

MDR
Work strip for Zscaler MDR (formerly Red Canary): Triage, shared; Investigate, provider's analysts; Respond, provider's analysts; Tune, shared; Nights and weekends, provider's analysts.TriageSharedInvestigateProvider's analystsRespondProvider's analystsTuneSharedNights and weekendsProvider's analysts
Pricing: Not published
Read the profile

SIEM copilots

CrowdStrike Charlotte AI

CrowdStrike's AI for the SOC, which it describes as agentic: it "reasons, decides, and acts at machine speed" across domains.

SIEM copilot
Work strip for CrowdStrike Charlotte AI: Triage, AI agent; Investigate, AI agent; Respond, shared; Tune, not described; Nights and weekends, not described.TriageAI agentInvestigateAI agentRespondSharedTuneNot describedNights and weekendsNot described
Pricing: Not published
Read the profile

Google Security Operations with Gemini

Google's security operations platform, unifying SIEM, SOAR and threat intelligence, with Gemini for natural-language search, investigation chat, case summaries and response recommendations.

SIEM copilot
Work strip for Google Security Operations with Gemini: Triage, not described; Investigate, shared; Respond, shared; Tune, shared; Nights and weekends, not described.TriageNot describedInvestigateSharedRespondSharedTuneSharedNights and weekendsNot described
Pricing: Standard, Enterprise and Enterprise Plus packages, priced by ingestion and including 12 m…
Read the profile

Microsoft Security Copilot

Microsoft's generative AI assistant for security, available as a standalone experience or embedded in Microsoft Security products, priced in security compute units (SCUs).

SIEM copilot
Work strip for Microsoft Security Copilot: Triage, not described; Investigate, shared; Respond, not described; Tune, not described; Nights and weekends, not described.TriageNot describedInvestigateSharedRespondNot describedTuneNot describedNights and weekendsNot described
Pricing: Priced in security compute units (SCUs): provisioned SCUs for routine workloads (a minimu…
Read the profile

Lighter profiles: each carries the date its facts were read. Not part of the fact table, fit finder vendor list or pair pages, which compare the thirteen AI SOC and SOAR products on 11 capabilities.