AI SOC and security-analyst agents
Quick answer
AI SOC and security-analyst agents lists 51 verified listings for Security operations, alert investigation and threat detection in dataset v0.1.27 (generated 2026-10-27).
Verified listings that share threat-detection and security-operations task tags as AI SOC / security-analyst agents.
This is not a ranking or score.
Verified listings that share threat-detection and security-operations task tags as AI SOC / security-analyst agents. This update adds Mave agentic SecOps. Marlin investigates SaaS and agentic-AI risk and returns guided remediation (humans execute). General SecOps/ITOps/CloudOps automation platforms (including Mindflow) are omitted. Email-security specialists are compared on the email-security table. Ontinue and Blackpoint are managed-service offerings (AI agents investigate; vendor analysts or high-confidence policy decide). Arctic Wolf TX-RAMP Level 2 names Managed Detection and Response/Managed Risk (platform-only). Fields below are from the open dataset. This is not a ranking or score.
Key facts
From this dataset
- 51 verified listings on this page, with headquarters in 6 HQ regions and 13 countries.
- Dataset version 0.1.27, generated 2026-10-27.
- Security operations, alert investigation and threat detection
Cite as: Agent Index by Heritage Services, AI SOC and security-analyst agents, dataset v0.1.27 (https://theagentindex.io/compare/ai-soc-analysts/)
FAQ (from this dataset)
What is listed on this use-case table?
Security operations, alert investigation and threat detection 51 verified listings from Agent Index dataset v0.1.27.
How many listings are on this page?
51 verified listings in dataset v0.1.27 (2026-10-27).
Which listings are headquartered in India, Asia-Pacific or Australia/NZ?
8 of 51 listings on this page publish an HQ in India, Asia-Pacific or Australia/New Zealand: CloudSEK AI Agents (Singapore), HarkX Agentic AI SOC platform (multi-agent triage, threat hunting, investigation and automated response) (India), ManageEngine Log360 Cloud Zia Agents (Investigation, Alert Correlation and User Activity Review agents) (India), NTT DOCOMO BUSINESS WideAngle AI SOC (AI Agent log analysis with managed SOAR auto-response) (Japan), RaonSecure OneSOAR (AI autonomous security control tower) and OneHacker (AI pentester) from the ONE AI agentic platform (South Korea), Spharaka Sphere (agentic AI SOC platform with autonomous investigation and policy-bounded response) (India), TrendAI Vision One Agentic SIEM and Companion (Japan), WedgeX AI SOC Agent (Australia).
Is this a ranking?
No. This is not a ranking or score. Order is mechanical (from dataset fields such as name, framework-tag count or table membership), not a paid placement or quality judgement.
| Field |  CloudSEK AI Agents |  CrowdStrike Charlotte AI |  Darktrace Cyber AI Analyst |  Qevlar AI |  Sophos MDR AI Agents (Triage and Case Investigation) |  Dropzone AI SOC Analyst |  Torq AI SOC Platform (Socrates and HyperAgents) |  Sekoia Elevate (AI SOC agents) |  Exaforce Exabots (agentic SOC) | AAndesite Human-AI SOC (Azimuth for Government) |  D3 Morpheus (agentic AI SOC platform) |  Imperum Virtus AI SOC agents (Triage, Pilot, Email Phishing) |  Prophet AI (AI SOC Analyst, Threat Hunter and Detection Engineer agents) |  7AI agentic security platform |  ReliaQuest GreyMatter Agentic Teammates (GreyMatter for Government) |  SentinelOne Purple AI (agentic AI security analyst) |  Abnormal AI Security Mailbox (Abnormal AI for Government) |  TrendAI Vision One Agentic SIEM and Companion |  Cyble Blaze AI |  Google Security Operations Triage and Investigation Agent |  Microsoft Security Copilot Phishing Triage Agent (Defender) |  WedgeX AI SOC Agent |  Attic IVON (Agentic MDR for Microsoft 365) |  Reliance Cyber RADAR |  Securonix Sam, the AI SOC Analyst (Agentic Mesh) |  Swimlane AI SOC (Intelligent Deep Agents on Turbine) |  ManageEngine Log360 Cloud Zia Agents (Investigation, Alert Correlation and User Activity Review agents) |  Fortinet FortiSOC (agentic AI SOC platform with FortiAI-Assist) |  Arctic Wolf Aurora Agentic SOC (Swarm of Experts agents) |  NTT DOCOMO BUSINESS WideAngle AI SOC (AI Agent log analysis with managed SOAR auto-response) |  Zscaler Agentic SOC (specialized AI agents for triage, investigation and inline containment) |  Command Zero Agent Zero (autonomous security analyst) |  Bricklayer AI security agents (agentic platform for the AI security workforce) |  Ontinue ION MXDR autonomous investigations (agentic AI SOC for Microsoft Defender and Sentinel) |  Blackpoint AI SOC Agent for ITDR (autonomous identity threat containment for Microsoft 365 and Google Workspace) |  Spharaka Sphere (agentic AI SOC platform with autonomous investigation and policy-bounded response) |  Gambit Cyber Vizier AI and KnightGuard AI agents (agentic CTEM and security workflow automation) |  Anomali Agentic AI in ThreatStream Next-Gen and the Anomali Data Lake (autonomous triage, scoring and investigation agents) |  HarkX Agentic AI SOC platform (multi-agent triage, threat hunting, investigation and automated response) |  CloudPeek agentic security operations platform (automatic triage, agent-run investigations and approval-gated response) |  Priam AVA (autonomous L1 alert triage and investigation agent with evidence-backed verdicts) |  CounterShadow AMI (Autonomous Machine Intelligence) – autonomous SOC triage, investigation and response |  AppOmni Marlin AI (autonomous SaaS and agentic-AI risk investigation) |  SOCRadar AI Agents (specialist threat-intelligence, attack-surface, digital-risk and alarm-triage agents) |  Strike48 agentic SecOps platform (pre-built SOC agent team and no-code agent builder over federated logs, cloud or air-gapped on-prem) |  Mave agentic SecOps (AI SOC agents) | |||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | CloudSEK | CrowdStrike | Darktrace | Qevlar AI | Sophos | Dropzone AI | Torq | Sekoia.io | Exaforce | Andesite | D3 Security | Imperum | Prophet Security | 7AI | ReliaQuest | SentinelOne | Abnormal AI | Trend Micro (TrendAI) | Cyble | Palo Alto Networks | Google Cloud | Microsoft | WedgeX | Attic Security | Reliance Cyber | Datadog | Securonix | Swimlane | ManageEngine (Zoho Corporation) | Fortinet | Arctic Wolf (Arctic Wolf Networks) | NTT DOCOMO BUSINESS (NTTドコモビジネス株式会社, formerly NTT Communications) | Zscaler (Zscaler, Inc.) | Command Zero (Command Zero, Inc.) | Bricklayer AI (Bricklayer AI Inc.) | Ontinue (Ontinue AG) | Blackpoint Cyber (Blackpoint Holdings, LLC) | Spharaka Networks (Spharaka Networks Private Limited) | Gambit Cyber (Gambit Cyber B.V.) | Crogl (Crogl, Inc.) | Anomali (Anomali, Inc.) | HarkX (HarkX Technologies Global Private Limited) | Decanos (Decanos GmbH) | RaonSecure (라온시큐어) | CloudPeek (CloudPeek Limited) | Priam Cyber AI (Priam Cyber AI Ltd) | CounterShadow (CounterShadow Ltd) | AppOmni | SOCRadar (SOCRadar Cyber Intelligence Inc.) | Strike48 (Devo Technology, Inc.) | Mave (Mave Security Ltd.) |
| HQ | Singapore · Asia Pacific | United States · North America | United Kingdom · Europe | France · Europe | United Kingdom · Europe | United States · North America | Israel · Middle East | France · Europe | United States · North America | United States · North America | Canada · North America | Netherlands · Europe | United States · North America | United States · North America | United States · North America | United States · North America | United States · North America | Japan · Asia Pacific | United States · North America | United States · North America | United States · North America | United States · North America | Australia · Australia and New Zealand | Netherlands · Europe | United Kingdom · Europe | United States · North America | United States · North America | United States · North America | India · India | United States · North America | United States · North America | Japan · Asia Pacific | United States · North America | United States · North America | United States · North America | Switzerland · Europe | United States · North America | India · India | Netherlands · Europe | United States · North America | United States · North America | India · India | Germany · Europe | South Korea · Asia Pacific | United Kingdom · Europe | United Kingdom · Europe | United Kingdom · Europe | United States · North America | United States · North America | United States · North America | Israel · Middle East |
| Primary category | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security |
| Also listed in | Security, Risk | Security | Security | Security | Security | Security | Security | Security | Security | Security, Compliance | Security | Security | Security | Security | Security, Compliance | Security, Compliance | Security, Compliance | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security | Security |
| Summary | Predictive attack-path platform whose AI agents correlate digital-risk, attack-surface and threat signals into validated paths, plus AIVigil for exposed AI and agentic workflows. | Agentic AI analyst for cybersecurity within the CrowdStrike Falcon platform, assisting detection, investigation and response workflows. | Purpose-built agentic AI that autonomously investigates security alerts, tests hypotheses and produces natural-language incident reports for SOC teams. | Autonomous AI SOC platform that triages, enriches and investigates security alerts across SIEM/XDR, EDR and other tools and returns a documented verdict for analysts. | Sophos's managed detection and response service uses in-house AI agents for alert triage and case investigation, with Sophos analysts supervising and owning response decisions. | AI agents for the SOC: an AI SOC Analyst that investigates alerts end to end and shows its reasoning, plus an AI Threat Hunter and AI Threat Intel Analyst. | Agentic SOC platform where the Socrates orchestrator plans and delegates to specialised HyperAgents for alert triage, investigation and response automation. | Agentic AI SOC analyst inside the Sekoia SOC platform: agents autonomously investigate every alert and case, show their reasoning and produce audit-ready reports for analyst validation. | Four role-based AI agents (Detect, Triage, Investigate, Respond) on Exaforce's own security data platform, covering detection engineering, tier-3 triage, threat hunting and playbook-driven response with approval gates. | Agentic SOC platform with configurable agents for alert triage, enrichment, investigation and remediation under analyst oversight; its government offering is FedRAMP High authorized. | Agentic SOC platform that autonomously triages, investigates and responds across the full alert lifecycle, grading every verdict by its evidence and deferring to a human when uncertain. | Amsterdam-built autonomous SOC platform whose Virtus agents triage every alert through a 7-stage pipeline, return a verdict with confidence and evidence, and hand cases to an investigation agent, with sovereign/on-prem AI options. | Agentic AI SOC platform whose agents investigate every alert end to end, respond through scoped Agent Actions autonomously or with sign-off, hunt threats and tune detections. | Boston-based agentic security platform where swarms of specialised AI agents categorise, investigate and reach a determination on every alert, escalating only what needs a person, with optional managed service (PLAID ELITE). | Agentic AI security operations platform whose six persona-based Agentic Teammates investigate and triage alerts and execute approved containment actions; GreyMatter for Government is FedRAMP Authorized (Moderate). | Agentic AI security analyst in the Singularity platform that runs alert investigations to a verdict and, with Singularity Hyperautomation, triggers response within pre-approved policies; SentinelOne says Purple AI is FedRAMP High authorized. | Autonomous agent for email security operations that triages user-reported emails, removes related malicious campaign messages across the organisation and replies to reporters; included in Abnormal AI for Government, which is FedRAMP and GovRAMP Moderate authorized. | Trend Micro's SOC stack (now under the TrendAI brand) pairing an Agentic SIEM and Agentic SOAR with purpose-built agents and the Trend Companion AI assistant. | Multi-agent cybersecurity engine across Cyble's threat-intelligence, endpoint and cloud products: agents hunt, correlate IOCs, isolate endpoints, block domains and draft reports, with human-in-the-loop guardrails. | Palo Alto Networks' agentic layer for Cortex: prebuilt and custom security agents that investigate and resolve cloud and SOC issues across Cortex Cloud, XSIAM and XDR, with configurable autonomy and approvals. | AI agent in Google Security Operations that autonomously investigates SIEM alerts and returns a verdict, confidence score, timeline and next steps. | Security Copilot agent in Microsoft Defender that autonomously triages user-reported phishing, resolves false positives and explains each verdict. | Australian AI SOC agent that enriches, investigates and recommends escalate/close actions on alerts, proposing containment for human approval. | Dutch AI SOC agent for Microsoft 365 SMBs that triages, investigates and contains identity alerts across Defender, Sentinel and Entra ID with human sign-off. | UK agentic MDR platform on Google Security Operations with specialist AI agents for detection engineering, triage, response and self-healing, under human oversight. | AI agent in Datadog Cloud SIEM that autonomously investigates security signals and returns evidence-backed Benign or Suspicious verdicts. | An AI SOC analyst built into the Securonix Unified Defense SIEM that triages, correlates and enriches alerts, writes investigation summaries and prepares cases, coordinated by the Agentic Mesh of specialized agents under human approval. | Swimlane's AI SOC product, built on its Turbine automation platform, uses autonomous 'deep agents' to plan and run alert investigations, with explainable decisions, auditable actions and AI-generated plans that analysts can review and turn into playbooks. | AI agents inside ManageEngine's Log360 Cloud SIEM: an Investigation Agent that runs multi-stage alert investigations and writes an investigation report, prebuilt Alert Correlation and User Activity Review agents, and a no-code Agent Studio for custom SOC agents. | Cloud-delivered SOC platform (SIEM, SOAR, UEBA, ITDR, threat intelligence and case management in one SaaS) whose agentic AI investigates and correlates alerts across assets and identities, then recommends or executes response actions under analyst oversight. | Agent-led managed SOC on the Aurora Superintelligence Platform: a 'Swarm of Experts' of oversight, authoritative and process agents runs triage, investigation, response, threat hunting, threat intel and detection engineering, with Arctic Wolf's human experts in the loop for novel cases and critical decisions. | Japanese managed AI SOC service in which NTT DOCOMO BUSINESS's own AI Agent periodically reviews Microsoft Sentinel incidents, correlates endpoint, network and authentication logs and writes an analysis report back, and Sentinel's managed SOAR playbooks then respond to the alerts automatically, with NTT security experts on call. | AI-first security operations product launched September 2026. Specialized autonomous AI agents triage alerts, investigate root cause, assign evidence-backed verdicts and trigger response workflows, and Zscaler's inline Zero Trust controls can automatically isolate users, block command-and-control traffic and cut off lateral movement. | Autonomous and AI-assisted SOC investigation platform from Austin, Texas. Its LLM agent, Agent Zero, investigates alerts end to end across identity, endpoint, cloud, email and SaaS, auto-closes routine cases with documented reasoning, and escalates the rest with a replayable chain of evidence for analysts to confirm or override. | Agentic cybersecurity platform that deploys, coordinates and governs teams of role-based and tool-specialist AI agents to triage alerts, investigate incidents, run threat-intelligence and threat-hunting work and track vulnerability remediation inside analyst-approved procedures, with every agent action auditable. | Zurich-headquartered managed detection and response provider for Microsoft Defender and Sentinel whose ION MXDR service uses a team of AI agents to run autonomous Tier 2-level incident investigations (aggregate telemetry, form and test hypotheses) before handing a step-by-step summary to an Ontinue Cyber Defender. | AI SOC agent inside Blackpoint's managed ITDR service that autonomously contains high-confidence credential attacks on Microsoft 365 and Google Workspace accounts: it suspends the account, forces a password reset, ends active sessions and logs its reasoning, and escalates anything below its confidence threshold to a human SOC analyst. Generally available since July 8, 2026. | Indian-built agentic SOC platform (SIEM, SOAR, UEBA, XDR and threat hunting in one) where AI agents triage and investigate every alert to a conclusion and execute containment inside a customer-defined policy envelope, staging higher-impact actions for a named approver. | Netherlands-headquartered continuous threat exposure management (CTEM) platform, KnightGuard, whose Vizier AI layer uses coordinated AI agents (CTI analyst, SOC analyst, red and blue team, ITOps) to monitor the attack surface, turn threat intel into deployable detections, validate them and orchestrate response. | Self-hosted AI SOC whose agents pick up alerts from SIEM, SOAR and ticketing queues, investigate each one end to end across the customer's own tools, hunt threats and investigate advisories, and only trigger SOAR playbooks once an evidence gate is passed, with a full audit trail for the analyst's decision. | Intelligence-native agentic SOC layer: ThreatStream Next-Gen and the Anomali Data Lake ship with autonomous triage, scoring and investigation steps, Tier 1/2 triage agents, a stack-ranked decision queue and automated Priority Intelligence Requirement monitoring, with analysts setting how much autonomy the agents get. | Bengaluru-built AI-native SOC platform in which specialised AI agents correlate and score alerts, run scheduled threat hunts, investigate cases and execute containment and automated response actions across SIEM, EDR/XDR, cloud and SOAR tools, with multi-tenant support for MSSPs. | Berlin security platform whose specialist AI agents triage alerts, assemble investigations, run continuous threat hunts, execute containment and update compliance reporting across connected tools such as CrowdStrike, Splunk, Elastic, SentinelOne, Microsoft Sentinel and Wiz, with autonomy levels, escalation thresholds and approval gates set per agent and per action type. | Seoul security and authentication vendor's agentic AI products: OneSOAR runs security operations from natural-language commands, automates account changes for joiners, movers and leavers, and on detecting anomalous behaviour immediately executes autonomous defence such as account lock, session termination, MFA step-up and admin alerts; OneHacker runs continuous, autonomous AI penetration tests from Pentest-Graph scenarios with white-hacker verification. | UK agentic SOC platform that sits on top of existing SIEM, cloud, endpoint and threat-intelligence tools: it automatically triages every new alert, runs AI-agent follow-up investigations across connected tools, writes the incident summary and can act within per-workflow authority levels (advise, approve, act), including in on-premises or fully air-gapped deployments. | London-based agentic SOC product: AVA investigates every alert from SIEM/EDR/XDR sources by testing malicious and benign hypotheses against the customer's environment and closes it with a defensible verdict (true positive, false positive or inconclusive with the missing evidence named), producing an audit-ready investigation report for enterprise SOCs and MSSP/MDR teams. | UK autonomous SOC product: AMI plans and runs investigation of every SIEM/EDR alert across connected tools without playbooks, returns a true/false-positive verdict with severity and logged evidence in about eight minutes, and can isolate hosts, block IPs or disable accounts under approvals the customer configures. | US SaaS-security product whose Marlin AI engine autonomously correlates posture, identity and threat signals across SaaS and AI apps, opens investigations without a prompt, and delivers expert-guided remediation steps so teams can cut investigation and resolution time. | Roster of specialist agents inside the SOCRadar threat-intelligence platform: customers deploy agents, set each one's skills, scope and access, and green-light sensitive steps. Agents cover threat-actor and ransomware intelligence, detection-rule writing, IoC enrichment, identity/credential exposure, vulnerability analysis, brand and dark-web monitoring, phishing-domain hunting, external attack surface and Shodan recon, and alarm triage that records verdicts and asks before changing an alarm's status. | Agentic orchestration platform for SOC and IT teams from the company behind the Devo log platform: purpose-built micro agents triage and investigate alerts, analyse phishing, hunt threats, write and tune detections and help with compliance over logs queried in place across SIEMs and data lakes, with configurable human approval and an audit trail; available as SaaS, isolated compute or an air-gapped on-prem appliance. | Agentic SecOps platform whose governed AI agents investigate every alert across the security tools a company already runs, hunt threats, improve detections and trigger authorised response actions, without ingesting data into a new lake; teams set policies, permissions and approval gates. |
| Frameworks (vendor-stated) | — | — | — | — | — | TX-RAMP | TX-RAMP | — | — | FedRAMP, SOC 2, ISO 27001, HIPAA, TX-RAMP | — | — | — | — | FedRAMP, TX-RAMP | FedRAMP, GovRAMP, TX-RAMP | FedRAMP, GovRAMP, TX-RAMP | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — |
| FedRAMP (Marketplace, listing scope) | — | — | — | — | — | — | — | — | — | Andesite Azimuth for Government · FedRAMP Authorized · FR2520950455 · High · authorized 2026-02-26 | — | — | — | — | GreyMatter for Government · FedRAMP Authorized · FR2428740308 · Moderate · authorized 2026-07-08 | SentinelOne Singularity Platform High · FedRAMP Authorized · FR1919071020A · High · authorized 2024-09-10 | Abnormal AI for Government · FedRAMP Authorized · FR2425960757 · Moderate · authorized 2025-04-11 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — |
| Frameworks (vendor-claimed) | NIST AI RMF, EU AI Act | — | — | — | NIS2, NIST | — | — | — | — | NIST SP 800-53, NIST CSF, ISO 42001, PCI DSS, HITRUST, CSA STAR | — | — | — | — | FedRAMP, TX-RAMP, FISMA, CMMC, SOC 2, ISO 27001, HIPAA, PCI DSS | FedRAMP, GovRAMP, TX-RAMP | FedRAMP, GovRAMP, TX-RAMP | — | — | FedRAMP | FedRAMP | — | — | — | — | FedRAMP, GovRAMP, TX-RAMP | — | — | — | — | TX-RAMP | — | — | — | — | — | — | CERT-In Directions, DPDP Act, SOC 2 Type I, RBI cyber security directions, SEBI CSCRF | — | — | — | — | — | — | — | — | — | FedRAMP, SOC 2, HIPAA, GDPR | — | — | — |
| Capabilities / tasks | threat detection, vendor risk, security operations | threat detection, incident response, security operations | threat detection, incident response, security operations | security operations, alert triage, incident response, threat detection | security operations, alert triage, incident response, threat detection | security operations, alert triage, threat detection | security operations, alert triage, incident response, workflow automation | security operations, alert triage, incident response, threat detection | security operations, alert triage, threat detection, incident response | security operations, alert triage, incident response, government compliance | security operations, alert triage, incident response, threat detection | phishing triage, email security, security operations, alert triage, incident response, case investigation | security operations, alert triage, incident response, threat detection | security operations, alert triage, incident response, threat detection | security operations, alert triage, incident response, threat detection, government compliance | security operations, alert triage, case investigation, threat detection, government compliance | phishing triage, email security, security operations, alert triage, incident response, remediation, government compliance | security operations, threat detection, incident response, alert triage | threat detection, security operations, incident response, threat intelligence | cloud security, security operations, incident response, workflow automation | security operations, alert triage, incident response, threat detection | phishing triage, email security, security operations, alert triage, incident response, threat detection | security operations, alert triage, incident response, threat detection | security operations, alert triage, incident response, threat detection, remediation | security operations, alert triage, incident response, threat detection | cloud security, alert triage, security operations, threat detection | security operations, alert triage, case investigation, threat detection, incident response | security operations, alert triage, case investigation, incident response, workflow automation | security operations, alert triage, case investigation, threat detection, incident response | security operations, alert triage, incident response, threat detection, case investigation | security operations, alert triage, incident response, threat detection, threat intelligence | security operations, alert triage, incident response, threat detection | security operations, alert triage, case investigation, incident response, threat detection | security operations, alert triage, case investigation, threat detection | security operations, alert triage, case investigation, incident response, threat intelligence, vulnerability management | security operations, alert triage, case investigation, incident response, threat detection | incident response, threat detection, alert triage, security operations | security operations, alert triage, case investigation, incident response, threat detection | threat intelligence, exposure management, attack surface, threat detection, security operations | security operations, alert triage, case investigation, threat detection, incident response | security operations, alert triage, case investigation, threat intelligence, threat detection | security operations, alert triage, case investigation, incident response, threat detection | alert triage, case investigation, threat detection, incident response, security operations | security operations, incident response, threat detection, identity governance, pen test management, attack surface | security operations, alert triage, case investigation, incident response | alert triage, case investigation, security operations, threat detection | security operations, alert triage, case investigation, incident response | alert triage, case investigation, security operations, identity governance | threat intelligence, attack surface, alert triage, case investigation, security operations, threat detection | security operations, alert triage, case investigation, incident response, phishing triage, threat detection | security operations, alert triage, case investigation, threat detection, incident response, threat intelligence |
| Pricing (as published) | Not verified | Not verified | Not verified | Not published | Not published | Quote-based (priced per AI analyst; each covers up to 4,000 full investigations per year, unlimited users; enterprise and MSSP pricing on request) | Not published | Not published | Not published | Not published | Not published as list prices. D3's pricing page describes a fixed annual subscription tied to a daily alert-volume tier (500 to 10,000 alerts/day, custom above), named-user licences and a flat per-alert overage rate, with all AI token costs included; request pricing. | Not published | Not published | Not published | Not published (vendor says pricing is based on endpoint count with no AI usage meter). | Purple AI pricing not published; Singularity platform tiers listed from $179.99 per endpoint/year (Complete) and $229.99 (Commercial) on sentinelone.com/pricing. | Not published | Not published | Not published | Not published | No standalone list price. Agent usage is metered in Google SecOps Security Tokens. Google's docs describe complimentary daily tokens for some Enterprise Plus customers and token purchases for Enterprise customers. Token prices are not published. | No standalone price. Requires Microsoft Defender for Office 365 Plan 2 plus Security Copilot security compute units (SCUs). Microsoft says Security Copilot agents are also made available to Microsoft 365 E5 customers. Check Microsoft's Security Copilot pricing for SCU rates. | Not published (the pricing page says 'Talk to us'). | Published: the agentic MDR page lists €6 per user per month, decreasing with more users. The pricing page lists plans from €27/month on annual billing, with incident-handling add-ons (+2x IVON incident handling from €30.15, +5x from €34.20). Prices exclude VAT. Check the pricing page for current amounts. | Not published. | Published: Cloud SIEM starts at $5 per GB analysed per month (billed annually) or $7.50 on-demand. Datadog includes 100 free Bits AI Security Analyst investigations per month per 1 TB analysed (minimum 50). Check the Datadog pricing page for current amounts. | Not published (productivity-based licensing by analyst-equivalent work) | Not published | Not published | Not published | Not published. Included at no added cost for customers on Arctic Wolf Security Operations Bundles and Aurora Managed Endpoint Security (per Arctic Wolf); bundle pricing by quote. | Not published | Not published | Not published | Not published | Not published | Not published. The AI SOC Agent is included with all Blackpoint ITDR service tiers at no additional cost (vendor release); ITDR pricing is by quote, mainly sold through MSP partners. | Not published | Not published (free trial offered) | Free single-user install ($0; 30-day full-feature trial); Enterprise (autonomous investigations, SSO/RBAC, 24/7 support) custom annual pricing | Not published | Not published | Not published (custom quote by protected assets and enabled modules; multi-year and MSSP pricing on request) | Not published | Not published (platform via demo/quote; separate Vulnerability Intelligence agent plugin service is free) | Not published (free single-alert pilot; otherwise via briefing/quote) | Not published | Not published | Agent pricing not published separately. SOCRadar publishes module plans (socradar.io/pricing, checked 2026-10-21), e.g. Advanced Dark Web Monitoring Essential $4,550/year ($600/month) and Cyber Threat Intelligence Essential $14,750/year ($1,625/month); higher tiers and bundles on quote. A free tier with platform access is offered. | Not published | Not published; priced by number of endpoints and security-team size (custom quote form on mave.com/pricing, checked 2026-10-23) |
| Pricing model | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | published-tiers | quote | published-tiers | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | quote | freemium | quote | quote | quote | quote | quote | quote | quote | quote | published-tiers | quote | quote |
| Primary source | https://www.cloudsek.com/ | https://www.crowdstrike.com/en-us/platform/charlotte-ai/ | https://www.darktrace.com/cyber-ai-analyst | https://www.qevlar.com/faq | https://www.sophos.com/en-us/blog/sophos-ai-agents-accelerating-mdr-and-powering-the-agentic-soc | https://www.dropzone.ai/ | https://torq.io/socrates/ | https://www.sekoia.io/en/product/elevate/ | https://www.exaforce.com/exabots | https://andesite.ai/product/ | https://d3security.com/ | https://www.imperum.io/autonomous-soc/virtus-triage | https://www.prophetsecurity.ai/ | https://7ai.com/platform | https://reliaquest.com/security-operations-platform/greymatter-agentic-teammates/ | https://www.sentinelone.com/platform/purple/ | https://abnormal.ai/products/ai-security-mailbox | https://www.trendaisecurity.com/en/platform/security-operations | https://cyble.com/platforms/blaze-ai/ | https://www.paloaltonetworks.com/cortex/agentix | https://docs.cloud.google.com/chronicle/docs/secops/triage-investigation-agent | https://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agent | https://wedgex.ai/product/agent/ | https://atticsecurity.com/en/agentic-mdr/ | https://www.reliancecyber.com/radar | https://www.datadoghq.com/product/ai/bits-security-analyst/ | https://www.securonix.com/products/sam-the-ai-soc-analyst/ | https://swimlane.com/product/ai-soc/ | https://www.manageengine.com/log-management/ai-security/ai-agents-for-security-operations.html | https://www.fortinet.com/products/fortisoc | https://arcticwolf.com/aurora-platform/ | https://www.ntt.com/business/services/security/security-management/wideangle/aisoc.html | https://www.zscaler.com/products-and-solutions/agentic-soc | https://www.commandzero.ai/agent-zero | https://www.bricklayer.ai/platform/ | https://www.ontinue.com/first-to-launch-agentic-ai-mdr/ | https://blackpointcyber.com/press/blackpoint-cyber-unveils-new-identity-threat-ai-soc-agent/ | https://spharaka.com/capabilities/ai-soc | https://gambitcyber.org/press-releases/gambit-cyber-launches-vizier-ai-an-autonomous-security-intelligence-workspace-for-continuous-exposure-management/ | https://www.crogl.com/ | https://www.anomali.com/products/agentic-ai | https://harkx.ai/platform | https://decanos.com/platform/ai-agents | https://www.raon.com/en/solution/onesoar | https://docs.cloudpeek.ai/docs/what-is-cloudpeek/ | https://priam.ai/ | https://countershadow.com/ | https://appomni.com/platform/marlin-ai-autonomous-security/ | https://socradar.io/ai-agents/ | https://www.strike48.com/ | https://www.mave.com/solutions/ai-soc |
| Last checked | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-23 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-18 | 2026-10-19 | 2026-10-19 | 2026-10-19 | 2026-10-19 | 2026-10-19 | 2026-10-19 | 2026-10-19 | 2026-10-19 | 2026-10-19 | 2026-10-20 | 2026-10-20 | 2026-10-20 | 2026-10-20 | 2026-10-20 | 2026-10-20 | 2026-10-20 | 2026-10-21 | 2026-10-21 | 2026-10-23 |
| Official site | https://www.cloudsek.com/ | https://www.crowdstrike.com/en-us/platform/charlotte-ai/ | https://www.darktrace.com/cyber-ai-analyst | https://www.qevlar.com/ | https://www.sophos.com/en-us/services/managed-detection-and-response | https://www.dropzone.ai/ | https://torq.io/socrates/ | https://www.sekoia.io/en/product/elevate/ | https://www.exaforce.com/exabots | https://andesite.ai/product/ | https://d3security.com/ | https://www.imperum.io/autonomous-soc/virtus-triage | https://www.prophetsecurity.ai/ | https://7ai.com/platform | https://reliaquest.com/security-operations-platform/greymatter-agentic-teammates/ | https://www.sentinelone.com/platform/purple/ | https://abnormal.ai/products/ai-security-mailbox | https://www.trendaisecurity.com/en/platform/security-operations | https://cyble.com/platforms/blaze-ai/ | https://www.paloaltonetworks.com/cortex/agentix | https://docs.cloud.google.com/chronicle/docs/secops/triage-investigation-agent | https://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agent | https://wedgex.ai/product/agent/ | https://atticsecurity.com/en/agentic-mdr/ | https://www.reliancecyber.com/radar | https://www.datadoghq.com/product/ai/bits-security-analyst/ | https://www.securonix.com/products/sam-the-ai-soc-analyst/ | https://swimlane.com/product/ai-soc/ | https://www.manageengine.com/log-management/ai-security/ai-agents-for-security-operations.html | https://www.fortinet.com/products/fortisoc | https://arcticwolf.com/aurora-platform/ | https://www.ntt.com/business/services/security/security-management/wideangle/aisoc.html | https://www.zscaler.com/products-and-solutions/agentic-soc | https://www.commandzero.ai/agent-zero | https://www.bricklayer.ai/platform/ | https://www.ontinue.com/first-to-launch-agentic-ai-mdr/ | https://blackpointcyber.com/press/blackpoint-cyber-unveils-new-identity-threat-ai-soc-agent/ | https://spharaka.com/capabilities/ai-soc | https://gambitcyber.org/ | https://www.crogl.com/ | https://www.anomali.com/products/agentic-ai | https://harkx.ai/ | https://decanos.com/platform/ai-agents | https://www.raon.com/en/solution/onesoar | https://cloudpeek.ai/platform/ | https://priam.ai/ | https://countershadow.com/ | https://appomni.com/platform/marlin-ai-autonomous-security/ | https://socradar.io/ai-agents/ | https://www.strike48.com/ | https://www.mave.com/solutions/ai-soc |
Side-by-side data is generated from the open dataset. “Vendor-claimed” frameworks are as marketed by each vendor and not verified by Agent Index; framework tags indicate relevance, not certification. Request current quotes from each vendor before buying. This page does not rank or score vendors. Sponsored comparisons, if any, will be labelled.
Use-case comparisons
- Email security and phishing-response AI agents — 16 listings (Triage of user-reported phishing, autonomous email threat remediation and AI-run phishing simulation)
- Agentic pentesting AI agents — 33 listings (Autonomous or AI-assisted penetration testing, attack-surface testing and exploitable-path verification)
- US public-sector and FedRAMP AI agents — 25 listings (US government, FedRAMP and public-sector compliance or security operations)
- Cloud security (CNAPP) AI agents — 9 listings (Cloud and container security posture, exposure and remediation)
Related
- CloudSEK AI Agents alternatives
- CrowdStrike Charlotte AI alternatives
- Darktrace Cyber AI Analyst alternatives
- Qevlar AI alternatives
- Sophos MDR AI Agents (Triage and Case Investigation) alternatives
- Dropzone AI SOC Analyst alternatives
- Torq AI SOC Platform (Socrates and HyperAgents) alternatives
- Sekoia Elevate (AI SOC agents) alternatives
- Exaforce Exabots (agentic SOC) alternatives
- Andesite Human-AI SOC (Azimuth for Government) alternatives
- D3 Morpheus (agentic AI SOC platform) alternatives
- Imperum Virtus AI SOC agents (Triage, Pilot, Email Phishing) alternatives
- Prophet AI (AI SOC Analyst, Threat Hunter and Detection Engineer agents) alternatives
- 7AI agentic security platform alternatives
- ReliaQuest GreyMatter Agentic Teammates (GreyMatter for Government) alternatives
- SentinelOne Purple AI (agentic AI security analyst) alternatives
- Abnormal AI Security Mailbox (Abnormal AI for Government) alternatives
- TrendAI Vision One Agentic SIEM and Companion alternatives
- Cyble Blaze AI alternatives
- Cortex AgentiX (agents for Cortex Cloud, XSIAM and XDR) alternatives
- Google Security Operations Triage and Investigation Agent alternatives
- Microsoft Security Copilot Phishing Triage Agent (Defender) alternatives
- WedgeX AI SOC Agent alternatives
- Attic IVON (Agentic MDR for Microsoft 365) alternatives
- Reliance Cyber RADAR alternatives
- Datadog Bits AI Security Analyst alternatives
- Securonix Sam, the AI SOC Analyst (Agentic Mesh) alternatives
- Swimlane AI SOC (Intelligent Deep Agents on Turbine) alternatives
- ManageEngine Log360 Cloud Zia Agents (Investigation, Alert Correlation and User Activity Review agents) alternatives
- Fortinet FortiSOC (agentic AI SOC platform with FortiAI-Assist) alternatives
- Arctic Wolf Aurora Agentic SOC (Swarm of Experts agents) alternatives
- NTT DOCOMO BUSINESS WideAngle AI SOC (AI Agent log analysis with managed SOAR auto-response) alternatives
- Zscaler Agentic SOC (specialized AI agents for triage, investigation and inline containment) alternatives
- Command Zero Agent Zero (autonomous security analyst) alternatives
- Bricklayer AI security agents (agentic platform for the AI security workforce) alternatives
- Ontinue ION MXDR autonomous investigations (agentic AI SOC for Microsoft Defender and Sentinel) alternatives
- Blackpoint AI SOC Agent for ITDR (autonomous identity threat containment for Microsoft 365 and Google Workspace) alternatives
- Spharaka Sphere (agentic AI SOC platform with autonomous investigation and policy-bounded response) alternatives
- Gambit Cyber Vizier AI and KnightGuard AI agents (agentic CTEM and security workflow automation) alternatives
- Crogl sovereign AI SOC (autonomous alert investigation, threat hunting and evidence-gated auto-remediation) alternatives
- Anomali Agentic AI in ThreatStream Next-Gen and the Anomali Data Lake (autonomous triage, scoring and investigation agents) alternatives
- HarkX Agentic AI SOC platform (multi-agent triage, threat hunting, investigation and automated response) alternatives
- Decanos AI Agents (Triage, Investigate, Hunt, Response and Compliance agents for autonomous security operations) alternatives
- RaonSecure OneSOAR (AI autonomous security control tower) and OneHacker (AI pentester) from the ONE AI agentic platform alternatives
- CloudPeek agentic security operations platform (automatic triage, agent-run investigations and approval-gated response) alternatives
- Priam AVA (autonomous L1 alert triage and investigation agent with evidence-backed verdicts) alternatives
- CounterShadow AMI (Autonomous Machine Intelligence) – autonomous SOC triage, investigation and response alternatives
- AppOmni Marlin AI (autonomous SaaS and agentic-AI risk investigation) alternatives
- SOCRadar AI Agents (specialist threat-intelligence, attack-surface, digital-risk and alarm-triage agents) alternatives
- Strike48 agentic SecOps platform (pre-built SOC agent team and no-code agent builder over federated logs, cloud or air-gapped on-prem) alternatives
- Mave agentic SecOps (AI SOC agents) alternatives
- Best security AI agents
- CrowdStrike Charlotte AI alternatives
- Darktrace Cyber AI Analyst alternatives