AI SOC agents for enterprise buyers
Asked as “AI SOC agent”, and as “AI SOC analyst for alert triage”, on behalf of an enterprise B2B company. 49 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each. Added to the November 2026 Edition.
Standing · first-choice share
31%
Contested · Conifers CognitiveSOC 10%
31Dropzone AI10Conifers CognitiveSOC08CrowdStrike Charlotte AI51others
31% of first choices, contested.
Since October 2026▲+17Since October 2026: 14% → 31%, +17 points. Past the 11-point floor: movement.Dropzone AI held the lead, +17 points on 14%, past the floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
Dropzone AI33%Contested▲+14Since October 2026: 19% → 33%, +14 points. Past the 11-point floor: movement.Standing →Mid-marketDropzone AI35%Contested▲+11Since October 2026: 24% → 35%, +11 points. Past the 11-point floor: movement.Standing →EnterpriseDropzone AI31%Contested▲+17Since October 2026: 14% → 31%, +17 points. Past the 11-point floor: movement.This page
Dropzone AI33%Contested▲+14Since October 2026: 19% → 33%, +14 points. Past the 11-point floor: movement.Standing →Mid-marketDropzone AI35%Contested▲+11Since October 2026: 24% → 35%, +11 points. Past the 11-point floor: movement.Standing →EnterpriseDropzone AI31%Contested▲+17Since October 2026: 14% → 31%, +17 points. Past the 11-point floor: movement.This pageThe standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Dropzone AI31%7%42endorsed leader▲+17Since October 2026: 14% → 31%, +17 points. Past the 11-point floor: movement.14% → 31%
Dropzone AI31%7%42endorsed leader▲+17Since October 2026: 14% → 31%, +17 points. Past the 11-point floor: movement.14% → 31%02
CrowdStrike Charlotte AI8%3%38accepted challenger▲+3Since October 2026: 5% → 8%, +3 points. Inside the 11-point floor: within noise.5% → 8%
CrowdStrike Charlotte AI8%3%38accepted challenger▲+3Since October 2026: 5% → 8%, +3 points. Inside the 11-point floor: within noise.5% → 8%03Torq AI SOC Platform6%3%33accepted challenger▼−3Since October 2026: 9% → 6%, −3 points. Inside the 11-point floor: within noise.9% → 6%
04
Prophet Security6%0%18accepted challenger▲+1Since October 2026: 5% → 6%, +1 point. Inside the 11-point floor: within noise.5% → 6%
Prophet Security6%0%18accepted challenger▲+1Since October 2026: 5% → 6%, +1 point. Inside the 11-point floor: within noise.5% → 6%05
Palo Alto Networks Cortex XSIAM6%13%23accepted challenger▲+6Since October 2026: 0% → 6%, +6 points. Inside the 11-point floor: within noise.0% → 6%
Palo Alto Networks Cortex XSIAM6%13%23accepted challenger▲+6Since October 2026: 0% → 6%, +6 points. Inside the 11-point floor: within noise.0% → 6%06
UnderDefense Agentic AI SOC6%7%15accepted challenger▼−8Since October 2026: 14% → 6%, −8 points. Inside the 11-point floor: within noise.14% → 6%
UnderDefense Agentic AI SOC6%7%15accepted challenger▼−8Since October 2026: 14% → 6%, −8 points. Inside the 11-point floor: within noise.14% → 6%07Microsoft Security Copilot4%17%35accepted challenger▼−3Since October 2026: 7% → 4%, −3 points. Inside the 11-point floor: within noise.7% → 4%
08
Intezer AI SOC2%0%27accepted challenger▼−7Since October 2026: 9% → 2%, −7 points. Inside the 11-point floor: within noise.9% → 2%
Intezer AI SOC2%0%27accepted challenger▼−7Since October 2026: 9% → 2%, −7 points. Inside the 11-point floor: within noise.9% → 2%09
SentinelOne Purple AI2%0%17accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
SentinelOne Purple AI2%0%17accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%Show the four products at 0%, ordered by negative rate
13
Splunk Enterprise Security0%17%12accepted challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%
Splunk Enterprise Security0%17%12accepted challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%11
ReliaQuest GreyMatter0%12%16accepted challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%
ReliaQuest GreyMatter0%12%16accepted challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%12
Swimlane Turbine0%7%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
Swimlane Turbine0%7%15accepted challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%10
Google Security Operations Lab in the set0%0%17accepted challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%
Google Security Operations Lab in the set0%0%17accepted challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
Google Security Operations is made by Google, whose model Gemini 3.5 Flash is in the set. On the four share prompts that model made it the first choice zero times of 4; the other thirteen models zero times of 52. Lab treatment is defined on the method page; the row is marked, not excluded.
Head to head
Dropzone AI vs UnderDefense Agentic AI SOCDropzone AI vs Prophet SecurityDropzone AI vs Huntress Managed EDR
Head-to-head pages are published for mid-market buyers, so these open on mid-market figures, not enterprise.All twenty-one head-to-head pages: the top seven products, each against each
Dropzone AI vs CrowdStrike Charlotte AIDropzone AI vs Microsoft Security CopilotDropzone AI vs Radiant SecurityUnderDefense Agentic AI SOC vs Prophet SecurityUnderDefense Agentic AI SOC vs Huntress Managed EDRUnderDefense Agentic AI SOC vs CrowdStrike Charlotte AIUnderDefense Agentic AI SOC vs Microsoft Security CopilotUnderDefense Agentic AI SOC vs Radiant SecurityProphet Security vs Huntress Managed EDRProphet Security vs CrowdStrike Charlotte AIProphet Security vs Microsoft Security CopilotProphet Security vs Radiant SecurityHuntress Managed EDR vs CrowdStrike Charlotte AIHuntress Managed EDR vs Microsoft Security CopilotHuntress Managed EDR vs Radiant SecurityCrowdStrike Charlotte AI vs Microsoft Security CopilotCrowdStrike Charlotte AI vs Radiant SecurityMicrosoft Security Copilot vs Radiant Security
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
0102T03
040506M07
080910111213Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Dropzone AI31%
Dropzone AI31%02CrowdStrike Charlotte AI8%
CrowdStrike Charlotte AI8%03Torq AI SOC Platform6%
04Prophet Security6%
Prophet Security6%05Palo Alto Networks Cortex XSIAM6%
Palo Alto Networks Cortex XSIAM6%06UnderDefense Agentic AI SOC6%
UnderDefense Agentic AI SOC6%07Microsoft Security Copilot4%
08Intezer AI SOC2%
Intezer AI SOC2%09SentinelOne Purple AI2%
SentinelOne Purple AI2%10Google Security Operations0%
Google Security Operations0%11ReliaQuest GreyMatter0%
ReliaQuest GreyMatter0%12Swimlane Turbine0%
Swimlane Turbine0%13Splunk Enterprise Security0%
Splunk Enterprise Security0%What they warned about
Two of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.20, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, GLM 4.7 FlashX, MiniMax M2.5 and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Microsoft Security Copilot
17%
6 of 35 labels negative · 5 of 14 models · 2 hard negative
“Pure consumption/token-based models (e.g., some Microsoft Security Copilot or Palo Alto Cortex XSIAM deployments) can lead to unpredictable TCO” Grok 4.20, budget prompt
Palo Alto Networks Cortex XSIAM13%
3 of 23 labels negative · 3 of 14 models · 1 hard negative
“can lead to unpredictable TCO as alert volumes or AI reasoning scale—especially risky for large companies” Grok 4.20, budget prompt
Arctic Wolf100%
2 of 2 labels negative · 2 of 14 models · 2 hard negative
“Arctic Wolf: Forces proprietary vendor lock-in; requires replacing existing SIEM infrastructure” Kimi K2, negative prompt
ReliaQuest GreyMatter12%
2 of 16 labels negative · 2 of 14 models · 2 hard negative
“ReliaQuest: Heavy reliance on AI agents but returns tickets without actionable answers” Kimi K2, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
80 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 992 links across 288 sites, every framing counted. Ranked by the number of answers carrying the site or page. 65 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · GitHub41 answers · 55 citations · 10 models
vendor site · UnderDefense31 answers · 63 citations · 12 models
vendor site · Stellar Cyber27 answers · 30 citations · 10 models
vendor site · Simbian25 answers · 38 citations · 11 models
24 answers · 48 citations · 10 models
vendor site · Intezer23 answers · 37 citations · 10 models
vendor site · ReliaQuest23 answers · 33 citations · 10 models
vendor site · Swimlane19 answers · 20 citations · 9 models
17 answers · 23 citations · 7 models
vendor site · Rework16 answers · 21 citations · 9 models
vendor site · Conifers.ai16 answers · 18 citations · 10 models
vendor site · Palo Alto Networks15 answers · 18 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
31 answers · 10 models
20 answers · 10 models
15 answers · 9 models
15 answers · 9 models
14 answers · 9 models
14 answers · 8 models
11 answers · 8 models
11 answers · 5 models
11 answers · 7 models
11 answers · 8 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “ai soc agent”, “ai soc agents”, “best ai soc agent”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Dropzone AI dropzone.ai | 31% | 139 | 1,300 | 32 | 1,652 | 3 | ||
| Conifers CognitiveSOC conifers.ai | 10% | 20 | 0 | 163 | 37 | 9 | ||
| CrowdStrike parent site CrowdStrike Charlotte AI 8% | 8% | 89 | 74,000 | 5,130 | ||||
| UnderDefense MAXI underdefense.com UnderDefense Agentic AI SOC 6%, UnderDefense MAXI 2% | 8% | 70 | 10 | 0 | 11,823 | 10 | 1 | |
| Torq AI SOC Platform torq.io | 6% | 86 | 5,966 | 6 | 7 | |||
| Prophet Security prophetsecurity.ai | 6% | 68 | 0 | 1,142 | 11 | 1 | ||
| Palo Alto Networks parent site Palo Alto Networks Cortex XSIAM 6% | 6% | 86 | 40,500 | 1,088 | ||||
| Microsoft parent site Microsoft Security Copilot 4% | 4% | 111 | 2,240,000 | 403,136 | ||||
| Palo Alto Networks Cortex AgentiX paloaltonetworks.com | 4% | 11 | 951,391 | $383 | 106 | 7 | ||
| Intezer AI SOC intezer.com | 2% | 75 | 40 | 0 | 1,595 | 1 |
Google's top ten for the three searches hold 24 sites; 5 of them are among the sites the models cited here (conifers.ai, paloaltonetworks.com, reliaquest.com, stellarcyber.ai, underdefense.com). The first result for “ai soc agent” is prophetsecurity.ai.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best AI SOC agent for an enterprise B2B company?”Paraphrase“Which AI SOC analyst for alert triage would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade AI SOC agents and how do they differ?”Budget-constrained“What is the best AI SOC agent for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating an AI SOC agent. What should we look at?”Negative“Which AI SOC agents should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceDropzone AIChangedno first choiceUnderDefense MAXIno first choicenothing named
Two alternatives
Intezer AI SOC, Prophet SecurityTwo alternatives
Conifers CognitiveSOC, Intezer AI SOCGPT-5.4 miniPalo Alto Networks Cortex AgentiXPalo Alto Networks Cortex XSIAMChangedCrowdStrike Charlotte AI, Palo Alto Networks Cortex AgentiXCrowdStrike Charlotte AIno first choicenothing named
Two alternatives
CrowdStrike Falcon, Google Security OperationsFour alternatives
CrowdStrike Charlotte AI, Microsoft Security Copilot, SentinelOne Purple AI, Splunk Enterprise Security's AI SOC analyst agentFour alternatives
7AI Agentic SOC Platform, Google Security Operations, IBM AgentOps, Splunk Enterprise Security agentic capabilitiesOne alternative
Microsoft Agent 365Gemini 3.5 Flashno first choiceDropzone AI, Prophet SecurityChangedno first choiceCrowdStrike Charlotte AI, SentinelOne Purple AIagainst: Microsoft Security Copilotno first choicenothing named
Eleven alternatives
CrowdStrike Charlotte AI, Dropzone AI, Google Security Operations, Microsoft Security Copilot, Palo Alto Networks Cortex Cloud, Prophet Security, ReliaQuest GreyMatter, Simbian AI-SOC Agent, Swimlane Turbine, Tines, Torq AI SOC PlatformFour alternatives
CrowdStrike Charlotte AI, Microsoft Security Copilot, Palo Alto Networks Cortex XSIAM, Torq AI SOC PlatformSix alternatives
CrowdStrike Charlotte AI, Dropzone AI, Intezer AI SOC, Microsoft Security Copilot, Prophet Security, Torq AI SOC PlatformFour alternatives
Dropzone AI, Intezer AI SOC, Prophet Security, Torq AI SOC PlatformPerplexity SonarPalo Alto Networks Cortex AgentiXProphet SecurityChangedPalo Alto Cortex AgentiX, XSIAMagainst: 7AI, Conifers CognitiveSOCD3 Morpheusagainst: Dropzone AI, Palo Alto Networks Cortex XSIAM, Torq AI SOC Platformno first choiceagainst: 7AI, CrowdStrike Charlotte AI, Dropzone AI, Exaforce, Microsoft Security Copilot, Palo Alto Cortex agents
Five alternatives
CrowdStrike Charlotte AI, Intezer AI SOC, Microsoft Security Copilot, Prophet Security, SentinelOne Purple AISeven alternatives
CrowdStrike Charlotte AI, Dropzone AI, Microsoft Security Copilot, Palo Alto, SentinelOne Purple AI, Swimlane Turbine, Torq AI SOC PlatformNine alternatives
CrowdStrike Charlotte AI, Dropzone AI, Exaforce, Intezer AI SOC, Microsoft Security Copilot, Prophet Security, Swimlane Turbine, Torq AI SOC Platform, UnderDefense Agentic AI SOCOne alternative
Google Security OperationsGrok 4.20Palo Alto Networks Cortex XSIAMagainst: Dropzone AI, UnderDefense MAXIDropzone AIChangedagainst: Microsoft SentinelCrowdStrike Charlotte AIConifers CognitiveSOCagainst: Microsoft Security Copilot, Palo Alto Networks Cortex XSIAMno first choiceagainst: Auto-GPT, LangChain
Three alternatives
CrowdStrike Charlotte AI, Intezer AI SOC, Microsoft Security CopilotSix alternatives
Cortex XSOAR, CrowdStrike Charlotte AI, Intezer AI SOC, Panther, ReliaQuest GreyMatter, Stellar Cyber Open XDRSeven alternatives
Intezer AI SOC, Microsoft Security Copilot, Radiant Security, SentinelOne Purple AI, Torq AI SOC Platform, UnderDefense Agentic AI SOC, Vectra AIThree alternatives
Intezer AI SOC, Torq AI SOC Platform, UnderDefense Agentic AI SOCMistral SmallDropzone AIMicrosoft Security Copilot, Torq AI SOC PlatformChangedPalo Alto Networks Cortex XSIAM, ReliaQuest GreyMatterDropzone AI, UnderDefense Agentic AI SOCno first choicenothing named
Two alternatives
Intezer AI SOC, Torq AI SOC PlatformTwo alternatives
CrowdStrike Charlotte AI, Dropzone AISix alternatives
CrowdStrike Charlotte AI, Dropzone AI, Intezer AI SOC, Microsoft Security Copilot, Torq AI SOC Platform, UnderDefense MAXIOne alternative
Seceon SERA AutoSOCDeepSeek V4 FlashCrowdStrike Charlotte AIPalo Alto Networks Cortex XSIAMChangedno first choiceArctic Wolf Aurora Agentic SOCagainst: Microsoft Security Copilot, Palo Alto Networks Cortex XSIAM, UnderDefense Agentic AI SOCno first choiceagainst: Splunk Enterprise Security, Swimlane Turbine
Four alternatives
Dropzone AI, Microsoft Security Copilot + Sentinel, Palo Alto Networks Cortex XSIAM, Prophet SecurityTwo alternatives
CrowdStrike Charlotte AI, Simbian AI-SOC AgentNine alternatives
Cortex AgentiX, CrowdStrike Charlotte AI, Dropzone AI, Google Security Operations, Intezer AI SOC, Microsoft Security Copilot, Palo Alto Networks Cortex XSIAM, SentinelOne Purple AI, Torq AI SOC PlatformOne alternative
CrowdStrike Charlotte AILlama 4 Maverickno first choiceDropzone AI, ThreatDefence, VDF.AIChangedno first choiceDropzone AI, Intezer AI SOC, Torq AI SOC Platformno first choicenothing named
Qwen 3.7 FlashConifers CognitiveSOCTorq AI SOC PlatformChangedDarktraceUnderDefense Agentic AI SOCagainst: CrowdStrike, Datadog, Palo Alto Networks, Splunk Enterprise Securityno first choicenothing named
Five alternatives
Palo Alto Networks Cortex XSIAM, SentinelOne Purple AI, Splunk Enterprise Security, Torq AI SOC Platform, UnderDefense MAXIThree alternatives
CrowdStrike, Microsoft Security Copilot, Stellar Cyber Open XDRThree alternatives
CrowdStrike Falcon, Microsoft Sentinel, Palo Alto NetworksOne alternative
Google Security OperationsKimi K2Dropzone AIDropzone AIHeldReliaQuest GreyMatterD3 Security Morpheus AI Leader, Dropzone AIno first choiceagainst: Arctic Wolf, CrowdStrike Falcon Complete, ReliaQuest GreyMatter
Four alternatives
CrowdStrike Charlotte AI, Intezer AI SOC, Microsoft Security Copilot, Torq AI SOC PlatformThree alternatives
Charlotte AI, ReliaQuest GreyMatter, Securonix with Sam AI SOC AnalystTen alternatives
CrowdStrike Charlotte AI, D3 Morpheus, Dropzone AI, Google Security Operations, Intezer AI SOC, Microsoft Security Copilot, Palo Alto Cortex AgentiX, Swimlane Turbine, Torq AI SOC Platform, XSIAMOne alternative
Microsoft Security CopilotGLM 4.7 FlashXConifers CognitiveSOCProphet SecurityChangedno first choiceCrowdStrike Charlotte AI, Dropzone AIno first choiceagainst: 7AI, Arctic Wolf, Exaforce, Qevlar, Radiant Security, ReliaQuest GreyMatter
Four alternatives
Simbian AI-SOC Agent, Splunk Enterprise Security, Stellar Cyber Autonomous SOC, UnderDefense Agentic AI SOCFour alternatives
CrowdStrike Charlotte AI, Intezer AI SOC, Microsoft Security Copilot, SentinelOne Purple AIEight alternatives
CrowdStrike Charlotte AI, Darktrace, Dropzone AI, Intezer AI SOC, Microsoft Security Copilot, Splunk Enterprise Security, Torq AI SOC Platform, UnderDefense MAXITwo alternatives
Microsoft Security Copilot, SentinelOne Purple AIMiniMax M2.5Conifers CognitiveSOCMicrosoft Security CopilotChangedDropzone AIagainst: Microsoft Security CopilotUnderDefense Agentic AI SOCagainst: Microsoft Security Copilotno first choicenothing named
Four alternatives
CrowdStrike Charlotte AI, Palo Alto Networks Cortex XSIAM, ReliaQuest GreyMatter, Swimlane TurbineThree alternatives
Securonix Sam, Simbian AI-SOC Agent, Splunk Enterprise SecurityFive alternatives
CrowdStrike Charlotte AI, Intezer AI SOC, Prophet Security, ReliaQuest GreyMatter, Torq AI SOC PlatformTwo alternatives
CrowdStrike Charlotte AI, Palo Alto Networks Cortex XSIAMGPT-6 LunaDropzone AIDropzone AIHeldno first choiceD3 Security's Morpheus AIno first choicenothing named
Four alternatives
Charlotte AI, Google SecOps Agentic SOC, Microsoft Security Copilot, Palo Alto Networks Cortex XSIAMTwo alternatives
Google's Triage and Investigation Agent, Microsoft's Security Alert Triage AgentTwo alternatives
Dropzone AI, Prophet SecurityTwo alternatives
Crogl, Dropzone AIMuse Glimmer 30BConifers CognitiveSOCDropzone AIChangedno first choiceDropzone AIno first choiceagainst: Microsoft 365 Copilot
Seven alternatives
CrowdStrike Charlotte AI, Microsoft Sentinel with Security Copilot agents, Palo Alto Networks Cortex AgentiX, Palo Alto Networks Cortex XSIAM, ReliaQuest GreyMatter, Seceon SERA AutoSOC, Torq AI SOC PlatformFive alternatives
CrowdStrike Charlotte AI, Microsoft Security Copilot Security Alert Triage Agent, Palo Alto Networks Cortex XSIAM, ReliaQuest GreyMatter, UnderDefense Agentic AI SOCFifteen alternatives
CrowdStrike Charlotte AI, D3 Morpheus, Dropzone AI, Google Security Operations, Intezer AI SOC, Microsoft Security Copilot, Microsoft Sentinel, Palo Alto Cortex AgentiX, Palo Alto Networks Cortex XSIAM, Seceon SERA AutoSOC, SentinelOne Purple AI, Splunk Enterprise Security, Stellar Cyber Open XDR, Torq AI SOC Platform, UnderDefense Agentic AI SOCTwo alternatives
Microsoft Security Copilot, UnderDefense Agentic AI SOCBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 10:04 | no | 0 | 3 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 15:23 | yes | 4 | 8 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 11:39 | yes | 10 | 21 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 17:01 | yes | 10 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:53 | yes | 8 | 13 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 10:39 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 15:30 | yes | 22 | 28 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 16:02 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 19:04 | yes | 5 | 23 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 14:16 | yes | 13 | 27 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 10:50 | yes | 15 | 20 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 18:47 | yes | 5 | 30 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 16:48 | yes | 5 | 29 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 18:12 | yes | 13 | 19 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 16:39 | yes | 18 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 14:31 | yes | 4 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 19:38 | yes | 10 | 23 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 19:23 | yes | 10 | 4 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 19:17 | yes | 9 | 11 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 18:27 | yes | 5 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 17:42 | yes | 22 | 23 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 09:36 | yes | 5 | 3 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 19:35 | yes | 5 | 21 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 17:12 | yes | 20 | 57 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 11:03 | yes | 21 | 80 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 10:17 | yes | 24 | 69 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 19:00 | yes | 3 | 18 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 18:55 | yes | 12 | 26 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 17:19 | yes | 15 | 15 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 09:22 | yes | 6 | 7 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 12:59 | yes | 9 | 25 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 11:25 | yes | 10 | 7 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 18:11 | yes | 10 | 15 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 15:40 | yes | 5 | 9 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 13:40 | yes | 24 | 45 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 14:24 | yes | 5 | 3 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 08:44 | no | 0 | 33 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 13:30 | yes | 23 | 74 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:15 | yes | 24 | 41 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:35 | yes | 23 | 65 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 09:02 | yes | 8 | 45 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 10:37 | yes | 17 | 44 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 15:24 | yes | 15 | 9 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 14:11 | yes | 4 | 9 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 11:54 | yes | 16 | 25 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 16:03 | yes | 10 | 9 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 19:38 | yes | 15 | 11 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 19:29 | yes | 5 | 5 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 10:29 | yes | 23 | 24 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:20 | yes | 9 | 4 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 16:41 | yes | 5 | 35 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 13:00 | yes | 25 | 44 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:29 | yes | 23 | 88 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 08:47 | yes | 15 | 66 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 09:51 | yes | 3 | 17 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 13:04 | yes | 19 | 36 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 10:28 | yes | 28 | 21 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 12:57 | yes | 4 | 8 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 18:07 | no | 0 | 22 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 09:38 | yes | 10 | 9 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 16:59 | yes | 15 | 17 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 08:52 | no | 0 | 8 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 09:52 | yes | 25 | 28 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 18:37 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 12:00 | yes | 24 | 67 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 12:18 | yes | 25 | 37 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 08:39 | yes | 14 | 125 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 10:38 | yes | 19 | 35 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 11:43 | yes | 4 | 20 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 17:37 | yes | 15 | 22 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 15:19 | yes | 18 | 11 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 08:51 | yes | 5 | 8 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 13:11 | yes | 8 | 22 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 09:37 | yes | 10 | 5 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 19:21 | yes | 5 | 11 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 15:32 | yes | 5 | 6 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 11:45 | yes | 24 | 33 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 16:25 | yes | 5 | 4 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 09:04 | yes | 5 | 27 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 18:08 | yes | 15 | 21 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 13:32 | yes | 24 | 52 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 12:51 | yes | 9 | 47 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 08:50 | yes | 3 | 26 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 12:54 | yes | 14 | 28 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Conifers.ai read as Conifers CognitiveSOC
Conifers.ai (CognitiveSOC) read as Conifers CognitiveSOC
Conifers.ai CognitiveSOC read as Conifers CognitiveSOC
CrowdStrike's Charlotte AI / Agentic SOAR read as CrowdStrike Charlotte AI
Google Security Operations Agentic SOC read as Google Security Operations
Intezer read as Intezer AI SOC
Intezer Autonomous SOC read as Intezer AI SOC
Microsoft Copilot for Security read as Microsoft Security Copilot
Microsoft Security Copilot agents read as Microsoft Security Copilot
Prophet read as Prophet Security
ReliaQuest read as ReliaQuest GreyMatter
SentinelOne read as SentinelOne Singularity
Simbian read as Simbian AI-SOC Agent
Simbian AI read as Simbian AI-SOC Agent
Simbian's AI SOC Agent read as Simbian AI-SOC Agent
Splunk read as Splunk Enterprise Security
Splunk Enterprise read as Splunk Enterprise Security
Stellar Cyber read as Stellar Cyber Open XDR
Stellar Cyber Open XDR Platform read as Stellar Cyber Open XDR
Swimlane read as Swimlane Turbine
Swimlane Turbine AI SOC read as Swimlane Turbine
Torq read as Torq AI SOC Platform
Torq (HyperSOC / Socrates) read as Torq AI SOC Platform
Torq (HyperSOC) read as Torq AI SOC Platform
Torq (Torq HyperSOC) read as Torq AI SOC Platform
Torq (Torq Socrates / HyperSOC) read as Torq AI SOC Platform
Torq HyperSOC read as Torq AI SOC Platform
UnderDefense (MAXI/Agentic AI SOC) read as UnderDefense Agentic AI SOC
UnderDefense MAXI AI SOC read as UnderDefense Agentic AI SOC
Vectra read as Vectra AI
Unresolved, counted raw
7AI Agentic SOC Platform
Crogl
D3 Security Morpheus AI Leader
D3 Security's Morpheus AI
DXC Agentic SOC
Google Cloud Security Operations (Gemini in SecOps)
Google SecOps Agentic SOC
Google Triage Agent
Google's Triage and Investigation Agent
IBM AgentOps
Microsoft Agent 365
Microsoft Security Copilot Security Alert Triage Agent
Microsoft Sentinel with Security Copilot agents
Palo Alto Cortex agents
QRadar SIEM
Seceon SERA
Securonix Sam (AI SOC Analyst)
Securonix with Sam AI SOC Analyst
Splunk AI SOC
Splunk Enterprise Security AI SOC Analyst
Splunk Enterprise Security agentic capabilities
Splunk Enterprise Security's AI SOC analyst agent
Stellar Cyber Autonomous SOC
Swiml
Zentail
Discontinued, still offered
No shut-down product was recommended here.