Why start with the stages?
Vendors describe their products in their own words: agents, analysts, copilots, platforms. The work underneath is the same for all of them, and so is the work your team does today. Describing it in stages gives you one yardstick for every demo.
Stage 1: triage
Triage decides what an alert is and how much attention it deserves. A human analyst does this by reading the alert, checking whether it repeats a known pattern and deciding whether it can be closed. Most AI SOC platforms now say they triage every alert, including low-severity and informational ones that a small team usually skips. Mate Security and Intezer both say they investigate 100% of alerts.
Stage 2: investigation
Investigation gathers evidence. For a suspicious sign-in that means looking up the user, the device, the location, recent mail and recent changes in identity settings. The question for a vendor is how far it goes without help: which tools it queries, whether it needs your data copied into its own store first, and whether it covers the alert types you actually see. Dropzone AI, for example, says it queries tools by API with no data normalisation.
Stage 3: verdict
A verdict says what happened and how sure the platform is. It is only useful if someone can check it. Lesson 2 covers what a verdict record should contain.
Stage 4: response
Response is what happens next: disable an account, isolate a host, block a sender, open a ticket. Here platforms split. Some take actions themselves, some propose actions and wait for approval, and some hand response to a SOAR you already run. Track 2 of this course is about choosing how much of this stage to hand over.
Stage 5: close-out
Close-out records what was decided and why, and feeds that back. Some platforms use closed cases to tune future decisions or detections; 7AI, for example, lists detection and hunting beside investigation and response.
What stays with your team?
Even with every stage covered, your team keeps three jobs: setting the limits the platform works within, reviewing a sample of its decisions, and handling what is new. A lean team buys an AI SOC to spend its hours on those three jobs instead of on lookups.
How to use this in a demo
Ask the vendor to walk one of your real alert types through all five stages, and write down for each stage whether the platform does it, proposes it or leaves it. Our autonomy ladder records the same thing from public pages.
Repeat the exercise for your three busiest alert types. A platform that covers all five stages for phishing reports may stop at a verdict for cloud alerts, and the difference decides how many hours it actually returns to a small team.