Facts checked Nov 9, 2026
As of November 6, 2026, we found no independent test with published results for any of the twelve AI SOC agents compared here, and every accuracy figure we read for these products comes from a seller or a study tied to one. So this comparison leaves accuracy out. It covers what a buyer can settle before a pilot: which alerts each agent picks up, what it may do without a person, how that is limited, and what record it leaves.
An AI SOC agent here is software that starts from an alert with no analyst prompt, gathers evidence and returns a verdict. Vendors also sell it as agentic SOC or autonomous SOC.
"Not stated" means not stated on the public pages we read as of November 6, 2026. It is never a claim that a product lacks a feature. Everything below is what each vendor says its agent does.
Has anyone independently tested these agents?
Not with published results that we could find, as of November 6, 2026. Vectra, a seller, says "No benchmark yet compares shipping commercial vendor products," which matches what we found. The research benchmarks we found test models or research agents, not products a buyer can sign for.
MITRE's Enterprise 2026 round may be the first independent evidence. It is "a single evaluation track for EDR, XDR, MDR, MSSP, SIEM, AI SOC, and cloud security vendors." MITRE's FAQ gives a draft results review window of November 9-20, 2026 and a "December 2026 public publication." The same FAQ says "participant-specific results are delivered privately, with MITRE publishing aggregated findings." We found no public participant list, so we do not know which of the twelve took part. In our view, even good results will show investigation quality, not how an agent behaves on your alerts or what its auto-closes miss.
Why these twelve, and who is out?
A product had to pass three gates, and a reader can check each.
- Function. The vendor's public material says the agent starts from an alert with no analyst prompt, gathers evidence and returns a verdict. This rests on vendor self-description. It keeps out copilots that wait for a question; it does not show the agent works.
- Outside naming. This explains scope and is not a sign of quality. Standalone products must appear in both reports from SACR (Software Analyst Cyber Research): August 4, 2025 (13 vendors) and July 30, 2026 (18 vendors). A buyer signing a multi-year contract wants a product with some public history. SACR says its 2026 report is "purely independent, with no vendor relationship influencing any rankings." Its reports rest on interviews, briefings, demonstrations and, in 2025, vendor questionnaires. The 2025 report also describes "rigorous benchmarking and real-world evaluations"; the part of its scoring sheet we could read lists vendor answers. We found no published test results in either report, and no funding disclosure. Platform vendors must say they are a Leader in Gartner's 2026 Magic Quadrant for Endpoint Protection or its 2025 Magic Quadrant for SIEM. Those are the vendors' own statements about gated reports.
- Public statement. A page open without login or a sales call says what the agent does or may do alone, and how that is approved or limited. Marketing pages count. This gate measures openness; failing it says nothing about a product.
Standalone, in: D3 Security, Dropzone AI, Exaforce, Intezer, Prophet Security, Torq. Platform, in: CrowdStrike, Google, Microsoft, Palo Alto Networks, SentinelOne, Splunk. We compare the agent, not the platform. Two admissions are narrow: Palo Alto's alert-started route is a preview feature, and SentinelOne's rests on a reprint.
Out:
- 7AI misses by a narrow margin. It is in SACR's 2026 report but not the 2025 one, so it does not meet the both-reports condition.
- Rapid7 is out because we found no Leader statement. Its documentation says that for three supported integration sources the agent "can close Alerts autonomously when the evidence is conclusive," and that Agentic SOC "is available to a limited set of US-based customers as part of a Limited Availability release."
- Mate Security and Securonix were not assessed in this comparison, which says nothing about either product.
What you can read before a sales call. Public documentation: Microsoft, Google, Splunk, Palo Alto, D3, Dropzone and Torq. Marketing pages only: CrowdStrike, Exaforce, Intezer and Prophet. Exaforce's and Intezer's documentation redirects to a login, and we found no public product documentation for Prophet.
SentinelOne. Its product pages refused automated access, so they were not available to us, and its open cells below are questions for SentinelOne. What we state comes from Help Net Security's August 3, 2026 reprint of the company's announcement. It says Purple AI and Singularity Hyperautomation "now autonomously investigate alerts, reach verdicts, and execute responses," that "security teams set the boundaries first, deciding where AI acts on its own and where it stops for human sign-off," and that Purple AI Agentic Investigation "has been running in customer environments since June." The newer Hyperautomation workflow capabilities, it says, "are expected to be generally available later this quarter"; whether they have reached general availability is open. A Nasdaq copy of a SentinelOne release of May 27, 2026 says the company was "positioned in the Leaders Quadrant" and "maintains FedRAMP High Authorization across its Endpoint, Purple AI, CNAPP, and Hyperautomation solutions."
Separate product or the agent you already own?
In our reading of the vendors' statements, platform agents mostly work their own vendor's alerts, and standalone products sell reach across tools. Accuracy cannot settle the choice, so it rests on the tables below. Turning on what you own can still need a specific edition, a paired product or metered capacity.
CrowdStrike's agent evaluates "first-party security detections." Google's runs only on data ingested in its SIEM, though its supported log types include third-party EDR data from CrowdStrike, SentinelOne and Microsoft Defender for Endpoint. Microsoft's covers named Defender alert types. By contrast, Dropzone's documentation lists alert sources including AWS GuardDuty, CrowdStrike, Microsoft Defender and Splunk, and Exaforce's page names "third-party tools like Splunk and CrowdStrike."
Start from where your alerts sit. If most come from one vendor's tools and your volume fits its caps, pilot that agent first. If your queue crosses tools or runs over a documented cap, add a standalone product.
Which alerts does each agent pick up on its own?
Platform agents cover a defined slice, and several have caps. Depending on the product, an alert over a cap waits or is never judged; each row says which. Details come from Microsoft's Security Alert Triage Agent (Preview) documentation, updated July 2, 2026, Google's Triage Agent documentation, updated November 4, and Splunk's Enterprise Security 8.8 documentation, updated November 3.
Platform track
Agent | Picks up with no prompt | Documented gaps and caps |
|---|---|---|
CrowdStrike Charlotte AI Detection Triage (product page) | First-party detections | Third-party alerts: not stated. Caps: not stated |
Google Triage and Investigation Agent | Alerts on data ingested in Google SecOps SIEM; by default it starts five minutes after the alert | No SOAR connector alerts. Quota "typically around 10 investigations per hour per tenant (for example, 5 manual triggers, 5 automatic triggers)"; there is no queue, and the agent "doesn't automatically analyze" alerts beyond the limit: they "require manual triage" |
Microsoft Security Alert Triage Agent | A subset of Defender alert types: email and collaboration, including phishing (generally available); identity and cloud, including containers (preview). Microsoft expects the set to grow | The agent "doesn't triage alerts resolved by alert tuning" |
Palo Alto Cortex AgentiX | The alert-started route is Agentic Response, a preview; your automation rules choose the alerts. Palo Alto's best-practices page says it "isn't enabled by default" | Caps: not stated |
SentinelOne Purple AI | Reprint: "autonomously investigate alerts" | Ask SentinelOne: coverage limits and caps |
Splunk Enterprise Security | Incoming findings, automatically once turned on | The agent "only works on the first 10 findings produced by a detection" when one produces more than 10 "at a single time"; about 200 findings per tenant per day. Finding groups and intermediate findings are not triaged |
Standalone track
Agent | Picks up with no prompt | Documented gaps and caps |
|---|---|---|
D3 Security | Events the AI investigates, then decides to dismiss or escalate | Over a run limit an event is skipped (the default) or paused until the limit resets; "D3 sets which one for your site." An event still paused after 24 hours is skipped, a number D3 can change |
Dropzone AI | Alerts from its connected sources; marketing: "works every alert as it lands" | Alerts ingested but not investigated, for example over thresholds or on error, sit in a Stopped list. 10 investigations run at once, "the current system limit"; alerts beyond that wait in a Queued stage |
Exaforce | Marketing: its own detections and "third-party tools like Splunk and CrowdStrike" | Caps: not stated |
Intezer | Marketing: connects to endpoint tools (CrowdStrike, SentinelOne, Microsoft Defender), identity, reported phishing and cloud tools | Caps on alert volume: not stated |
Prophet Security | Marketing: a full investigation "on 100% of alerts, at every severity" | Caps: not stated |
Torq | Knowledge base: "Every alert receives a verdict" | Auto Triage is off by default; access comes through Torq Support. Caps: not stated |
What can each agent close or change without a person?
It differs in kind, not only in setting, so there is no single "closes alone: yes/no" column. Microsoft's agent resolves false positives itself. Splunk's closes only if an admin allows it. Google's closing sits in a playbook outside the triage agent. CrowdStrike's own statements differ by date; see its row. Dropzone's documentation describes closing as a person's click.
Platform track
Agent | Closing | Actions and default |
|---|---|---|
CrowdStrike | Current product page: teams "decide whether to escalate, close, or route detections based on their own criteria and configured playbooks." Its February 13, 2025 release says Charlotte AI "triages detections autonomously, filtering out false positives and closing low-risk alerts," with "customer-defined bounded autonomy" | "Does not take automated response actions by default." Actions run autonomously or need approval, as teams configure them. By default, prebuilt agents are limited to generating information, summaries and recommendations (marketing page) |
Agent closing: not stated. A playbook can "auto-close alerts confirmed as benign or informational" | A verdict can start a remediation playbook automatically, such as host isolation or account suspension. For sensitive actions, playbooks "can include manual approval steps": approval is a step you add | |
Microsoft | False positives: classified and resolved by the agent. True positives: the incident stays open and in progress for an analyst | Classification and resolution. Containment: not stated |
Palo Alto | Not stated as a built-in function | Runs commands, playbooks and scripts assigned to it and "requires user input only to approve sensitive actions." Agents "do not automatically execute any actions marked as sensitive": they pause and create a pending task. New actions are sensitive by default, and you can change that per action; the page advises clearing it only for actions that change nothing |
SentinelOne | Ask SentinelOne | Reprint: "execute responses," with teams deciding "exactly where Purple AI is permitted to execute autonomously." Which actions: ask |
Splunk | Only if allowed. The Triage agent "never changes any fields"; it updates the AI-suggested disposition and does not overwrite an analyst's. A setting lets the AI SOC analyst "close findings when identified as Benign Positive." We read these as two agents on one page | Allowed actions can include starting investigations or closing findings. SOAR response actions are set to Automatic run or Approval required; a post-triage rule can run a playbook |
Standalone track
Agent | Closing | Actions and default |
|---|---|---|
D3 Security | Yes, under Dismiss rules you write (Attack Path Discovery docs, 18.6). A clause on the AI's own confidence "never fires"; D3's docs say to describe the evidence instead | Investigation "stays read-only." Per its autonomy-modes page, "the analyst approves every state-changing action until you move the mode"; the four modes run from Deterministic to fully Autonomous |
Dropzone AI | Docs describe closing as a click on "Close Investigation." Auto-close: not stated | Custom Python response actions, for admins only, run automatically when investigations complete, from over 50 triggers; approval step on those: not stated. Containment Actions are separate: the docs show "1-click Containment Actions" a person applies with Run, under a page headed "Remediator + Automatic Containment," so ask which applies. A banner says the docs "may be out of date" during a hosting outage |
Exaforce | A customer's choice: auto-close false positives by alert type, severity and priority, or close them manually | Workflows run autonomously or with human approvals; gates apply by action sensitivity, user risk, confidence and business hours (marketing) |
Intezer | Vendor guide, which ranks Intezer first: it "resolves most alerts autonomously." Its pricing page lists "Auto-resolution of false positive alerts." Limits on closing: not stated | Disabling users or isolating devices can run automatically through API or webhook, or route to analyst review. Analysts can "review or override escalated alerts." |
Prophet Security | Not stated for the product | Vendor says it "takes only the response actions a customer has approved," from notifications to quarantining a machine, previewed and backtested (marketing pages; no product docs found) |
Torq | Torq's dashboard docs refer to alerts closed "through human analyst action, Socrates-guided investigation, or automated workflows." Conditions for closing without a person: not stated. The "Do nothing" mapping keeps the alert on the Auto Triage pages but out of other reporting views | By default no post-triage actions are taken until verdict-to-action mappings are configured, though each source starts with default settings: true positives "Trigger workflow," false positives "Do nothing." Non-malicious alerts can trigger detection tuning "without analyst involvement"; analysts can confirm or change any verdict. Agentic action runs human-in-the-loop (the agent consults an analyst before acting) or human-on-the-loop (it acts and notifies the analyst) |
What limits its reach, and how do you stop it?
Reach is set by permissions and per-action gates, and stopping is documented for only some products.
Platform track
Agent | Limits on what it can do | Stopping, and when it cannot run |
|---|---|---|
CrowdStrike | Autonomous or approval, set by the customer. Scoping by asset: not stated | Credit caps control consumption. Pause control: not stated |
Approval is a playbook step, as above. Permissions to use the agent are on a separate IAM page. What it acts under: not stated | With only the included Security Tokens, running out means no new agents, but running ones "run to completion"; paid tokens are used after the included ones, and running out of those brings an overage unless you set a limit. Automatic investigations are a setting (Settings > Investigation > Gemini Investigations) | |
Microsoft | Alert types toggled on or off. Runs under an identity you choose: a new Microsoft Entra Agent ID (recommended) or an existing user account. Permissions include Security Copilot (read), Security data basics (read) and Alerts (manage); email and collaboration alerts add email metadata (read) and email content (read) | Pause or Run, held by a Security Administrator. On a user account, if authentication expires the agent stops functioning, and the identity isn't compatible with Privileged Identity Management (PIM) or Temporary Access Pass (TAP). Microsoft also says, for Security Copilot generally, that requests stop when provisioned capacity runs out unless other capacity exists |
Palo Alto | Rule-triggered agents run "with administrator permissions, limited to the actions assigned to the agent"; "Sensitive actions still require a user's approval." Follow-up messages run with the sender's permissions | System agents can be enabled or disabled |
SentinelOne | Reprint: teams set the boundaries. Mechanism and permissions: ask | Ask |
Splunk | Per-action Automatic or Approval; the agent inherits SOAR permissions; one sample asks for double confirmation before disabling a user | The agent is turned on per detection, from the Detections page. Pause control: not stated |
Standalone track
Agent | Limits on what it can do | Stopping, and when it cannot run |
|---|---|---|
D3 Security | State changes gated by command-risk tag and mode | Change the mode. At a limit, events pause or skip; the events list shows how many wait |
Dropzone AI | Response actions: admins only, sandboxed, execution time and resources limited. Approval step on them: not stated. Containment actions: enabled or disabled per remediator | "Live enable/disable controls for automation execution." Stopped alerts can be refreshed by hand |
Exaforce | Gates as above; on timeout it falls back to "pause, rollback, or limited containment" | Pause control: not stated beyond that |
Intezer | Product page: remediation "can be easily automated with explicit human approval." Mechanism: not stated | Not stated |
Prophet Security | Actions scoped and permissioned; the customer decides when its track record justifies widening scope | Not stated |
Torq | Rules can override the AI; for example, alerts on critical assets or high-value users are always treated as critical. Rules apply only to alerts ingested after the rule is created | A "Do nothing" mapping takes no action after triage |
What record does each agent leave?
Most vendors say actions are logged, and several say what the log holds. Export and retention are stated for only a few, so they appear in the vendor questions.
Agent | Record | Export and retention |
|---|---|---|
CrowdStrike | "Execution traces, agent version history and rollback" | Not stated |
Investigation panel; Cloud audit logs, but Admin Read must be turned on in the Chronicle API permission types | Not stated | |
Microsoft | Agent actions "recorded in Microsoft Purview audit logs" | Agent page: not stated. Microsoft's Purview Audit documentation describes export to CSV and retention by license |
Palo Alto | "All actions an agent executes are logged" in an audit dataset showing the acting agent, user and prompt context, model, inputs and telemetry; automated runs record the user as Agentic Response | Default: six months for cases, issues, assistant chats and related artifacts; a paid add-on extends it |
SentinelOne | Reprint: actions "traceable, auditable, and overrideable." Contents: ask | Ask |
Splunk | AI analysis panel with a step-by-step timeline and the evidence behind each conclusion | Audit export: not stated |
D3 Security | Marketing: "One unified trail per incident." A skipped or paused event says what happened and when it can run | Not stated |
Dropzone AI | Action output, errors and status logged; every rule evaluation recorded; system events give an audit trail | Filter log kept 30 days by default; system events can be downloaded as a JSON file |
Exaforce | "Every decision and approval is fully audited"; each triage outcome carries a rationale, key indicators, affected principals and resources, and links to logs and evidence | Not stated |
Intezer | Product page: "transparent triage logic, clear explanations." Log contents: not stated | Not stated |
Prophet Security | "Every question asked, every query run, and every reasoning step is documented" | Not stated |
Torq | "All actions are logged"; each alert has a history from ingestion and enrichment to verdict, severity changes and case closure | Not stated |
What does each need to run, and how is it charged?
Platform agents bring their own prerequisites, and Splunk's are the longest.
Agent | Needs | Charged by |
|---|---|---|
CrowdStrike | Reached through the Falcon console; evaluates first-party detections. Other prerequisites: not stated | AI credits; the page mentions 50 that renew each month |
Google SecOps SIEM. Google says the agent "is not FedRAMP compliant" | Security Tokens; "the tokens needed depend on the agents you run" | |
Microsoft | Security Copilot capacity, plus products and licenses by alert type: Defender for Office P2 for email and collaboration alerts | Security Compute Units (SCU) |
Palo Alto | AgentiX license | Yearly license per user; compute units, 400 a year (Base) or 800 (Enterprise), with more purchasable |
SentinelOne | Reprint: the capabilities are built into the Singularity Platform; "There is no integration work and no additional tooling required." Rest: ask | Ask |
Splunk | Premier edition (Cloud and Cloud Connected on-premises); SOAR paired; frontier models only; contact your Splunk representative to turn on the agent | Not stated |
D3 Security | Marketing: "Full SOAR engine built in" | Run limits are set by your plan |
Dropzone AI | Works over alert sources such as GuardDuty, CrowdStrike, Defender and Splunk | License; stopped alerts do not count against it |
Exaforce | Marketing: a data platform "built to replace your SIEM"; also names third-party tools | Not stated |
Prophet Security | Marketing: "Connect your existing security stack with 200+ out-of-the-box integrations" | Per investigation, "with no data-ingest fees" (vendor summary) |
Torq | Data connectors normalize incoming alerts; Auto Triage needs Torq Support to enable | Not stated |
Intezer | Connected alert sources; documentation behind login | Per endpoint, "rather than a per-alert or data-ingest model" (vendor guide) |
What happens to your contract if a vendor's technology changes hands?
You may be left asking who runs the product. Cribl's release of August 19, 2026 says it "has acquired technology assets from Radiant Security's AI-native security operations center product," including "intellectual property to autonomously triage, investigate, and resolve security alerts," and that it is adapting the technology "to run as an application on its telemetry data platform." SiliconANGLE reports that terms were not disclosed. The release does not mention Radiant's existing customers. Radiant was in both SACR reports, the 2026 one dated 20 days earlier.
What should you ask each vendor?
The SOC lead sends these to each shortlisted vendor before a pilot starts, to close the open cells, and takes the answers into the pilot. Our guide to evaluating an AI SOC tool covers the pilot itself.
- How long are per-verdict evidence and action logs kept, and can you export them?
- What does the agent do when a data source goes silent? Not stated for any product.
- Can closing be limited per alert class, and is a closed alert sampled?
- Over a cap or queue, are you told, and where? D3's events list shows how many events wait.
- Does an approval rule hold for agent actions that arrive through the API?
- Which identity does the agent act under when an automation starts it?
- If the vendor or its technology changes hands, what happens to your data and contract?
- For SentinelOne: what do its current product pages state on coverage, closing, limits, records and metering, and did the Hyperautomation workflows reach general availability?
What changes when MITRE publishes?
This page is refreshed in December. Do not compare across MITRE's modifiers: its citation policy says "Do not compare platform (P, P/AI) and service (S/H, S/AI) configurations against each other," and scores must carry their modifier. (S/AI) means "Autonomous investigation and recommendations"; (P/AI) means "AI enriches alerts; analysts make final decisions." The Investigation Quality Index "measures how effectively a security operation investigates an incident after the first automated alert" and is published separately.