# AI SOC agents: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "AI SOC agent" and as "AI SOC analyst for alert triage", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Added to the November 2026 Edition. Page: https://www.gane.ai/index/it/security/ai-soc-agents

**Standing:** Dropzone AI leads with 35% of first choices; verdict contested. 52 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Dropzone AI](https://www.gane.ai/index/it/vendors/dropzone-ai/index.md) | 35% | 4% | 47 |
| 2 | [UnderDefense Agentic AI SOC](https://www.gane.ai/index/it/vendors/underdefense-agentic-ai-soc/index.md) | 17% | 0% | 21 |
| 3 | [Prophet Security](https://www.gane.ai/index/it/vendors/prophet-security/index.md) | 10% | 0% | 23 |
| 4 | [Huntress Managed EDR](https://www.gane.ai/index/it/vendors/huntress-managed-edr/index.md) | 8% | 0% | 11 |
| 6 | [CrowdStrike Charlotte AI](https://www.gane.ai/index/it/vendors/crowdstrike-charlotte-ai/index.md) | 2% | 18% | 28 |
| 7 | [Microsoft Security Copilot](https://www.gane.ai/index/it/vendors/microsoft-security-copilot/index.md) | 2% | 27% | 30 |
| 8 | [Radiant Security](https://www.gane.ai/index/it/vendors/radiant-security/index.md) | 2% | 6% | 16 |
| 19 | [Intezer AI SOC](https://www.gane.ai/index/it/vendors/intezer-ai-soc/index.md) | 0% | 0% | 22 |
| 20 | [Torq AI SOC Platform](https://www.gane.ai/index/it/vendors/torq-ai-soc-platform/index.md) | 0% | 15% | 27 |
| 21 | [SentinelOne Purple AI](https://www.gane.ai/index/it/vendors/sentinelone-purple-ai/index.md) | 0% | 7% | 14 |

Rank is by share of first choices among all 99 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Radiant Security, UnderDefense MAXI; alternatives Arctic Wolf, Dropzone AI
- GPT-5.4 mini: CrowdStrike Charlotte AI; alternatives Google Security Operations' agentic SOC, Microsoft Security Copilot
- Gemini 3.5 Flash: Dropzone AI, Prophet Security; alternatives CrowdStrike Charlotte AI, Intezer AI SOC, Microsoft Security Copilot, SentinelOne Purple AI
- Perplexity Sonar: Arctic Wolf Aurora Agentic SOC; alternatives Dropzone AI, Intezer AI SOC, Microsoft Security Copilot, Radiant Security
- Grok 4.20: Dropzone AI; alternatives Microsoft Security Copilot + Sentinel, Torq AI SOC Platform, UnderDefense Agentic AI SOC
- Mistral Small: Dropzone AI; alternatives Microsoft Security Copilot, SentinelOne Singularity Endpoint, Torq AI SOC Platform
- DeepSeek V4 Flash: UnderDefense Agentic AI SOC; alternatives Arctic Wolf, Dropzone AI
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Dropzone AI; alternatives CrowdStrike Charlotte AI, Microsoft Security Copilot, Torq AI SOC Platform, UnderDefense Agentic AI SOC
- Kimi K2: Dropzone AI; alternatives Huntress Managed EDR, Radiant Security, UnderDefense MAXI
- GLM 4.7 FlashX: Conifers CognitiveSOC; alternatives Dropzone AI, Microsoft Security Copilot
- MiniMax M2.5: UnderDefense Agentic AI SOC; alternatives Arctic Wolf, Dropzone AI, Radiant Security, eSentire
- GPT-6 Luna: Dropzone AI; alternatives Google Security Operations, Microsoft Defender XDR, Microsoft Sentinel
- Muse Glimmer 30B: UnderDefense Agentic AI SOC; alternatives Arctic Wolf, Conifers CognitiveSOC, CrowdStrike Charlotte AI, Intezer AI SOC

## Sources the answers cite

78 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- underdefense.com: 41 answers, 88 citations
- github.com: 39 answers, 62 citations
- intezer.com: 31 answers, 39 citations
- stellarcyber.ai: 26 answers, 36 citations
- swimlane.com: 24 answers, 25 citations
- simbian.ai: 22 answers, 35 citations
- reliaquest.com: 21 answers, 38 citations
- securityboulevard.com: 18 answers, 37 citations

Pages named in the most answers:

- https://github.com/volod-k/agentic-ai-soc-knowledge-base/blob/main/research/how-to-evaluate-vendors/best-agentic-soc-platforms.md (18 answers)
- https://underdefense.com/blog/agentic-soc-platforms (18 answers)
- https://conifers.ai/blog/top-ai-soc-agents (14 answers)
- https://intezer.com/guides/ai-soc/mid-sized-enterprises (13 answers)
- https://reliaquest.com/cyber-knowledge/ai-soc-tools (13 answers)
- https://startupstash.com/best-ai-soc-tools (13 answers)
- https://swimlane.com/blog/best-ai-soc-platforms (13 answers)
- https://trustradius.com/categories/ai-soc-analyst?company-size=mid-sized (13 answers)
- https://resources.rework.com/tools/ai-agents/best-ai-agents-for-cybersecurity-2026 (11 answers)
- https://softwareadvice.com/category/5538-ai-soc-agents (11 answers)

## Warned against

- Microsoft Security Copilot: 8 of 30 labels negative. "enterprise AI SOC solutions like Microsoft Security Copilot, ReliaQuest GreyMatter, or CrowdStrike Charlotte AI are often cost-prohibitive" (Gemini 3.5 Flash, budget prompt)
- Torq AI SOC Platform: 4 of 27 labels negative. "Avoid or deprioritize high-end ones like ... Torq HyperSOC" (Grok 4.20, budget prompt)
- CrowdStrike Charlotte AI: 5 of 28 labels negative. "Avoid or deprioritize high-end ones like ... CrowdStrike Charlotte AI" (Grok 4.20, budget prompt)
- Palo Alto Cortex AgentiX: 3 of 8 labels negative. "Avoid buying a full enterprise platform such as Torq, Palo Alto Cortex AgentiX" (Perplexity Sonar, budget prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Dropzone AI at 35%.

- Radiant Security: 24% to 2%, −22. Cleared the floor by 11 points · rank 2 → 8 of 99.
- Dropzone AI: 24% to 35%, +11. Cleared the floor by 0 points · rank 1 of 99, unchanged.
- Prophet Security: 2% to 10%, +8. Inside the floor by 3 points · rank 8 → 3 of 99.
- Huntress Managed EDR: 2% to 8%, +6. Inside the floor by 5 points · rank 11 → 4 of 99.
- UnderDefense Agentic AI SOC: 13% to 17%, +4. Inside the floor by 7 points · rank 3 → 2 of 99.
- Torq AI SOC Platform: 4% to 0%, −4. Inside the floor by 7 points · rank 4 → 20 of 99.
- SentinelOne Purple AI: 4% to 0%, −4. Inside the floor by 7 points · rank 5 → 21 of 99.
- CrowdStrike Charlotte AI: 0% to 2%, +2. Inside the floor by 9 points · rank 22 → 6 of 99.
- Intezer AI SOC: 2% to 0%, −2. Inside the floor by 9 points · rank 9 → 19 of 99.
- Microsoft Security Copilot: 2% to 2%, ±0. Inside the floor by 11 points · rank 10 → 7 of 99.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.