TERMS
SHORT ANSWER
Prophet Security's name for scoped response actions its AI SOC Analyst can take autonomously or with your sign-off. A vendor term.
Vendor term: Prophet Security profile
Source: Prophet Security homepage · Read 27 Sep 2026
See also: Sign-off, Scoped action
A security operations setup in which AI agents carry out alert work, such as triage, investigation and response, rather than only answering questions.
See also: AI SOC platform, Copilot
Dropzone AI's view of the stages and actions in an investigation. A vendor term.
Vendor term: Dropzone AI profile
Source: Dropzone AI homepage · Read 27 Sep 2026
See also: Investigation record
Software that uses AI agents to do alert work a security analyst does: triage, investigation, a verdict and, within limits, response. It sits on top of the SIEM, EDR, identity and mail tools a team already runs.
See also: Agentic SOC, SOAR
The loss of attention that comes from handling more alerts than a team can investigate, so that real incidents are missed among false ones.
See also: Triage
A step that stops an automated action until a named person approves it.
See also: Sign-off, Human in the loop
A record of what an automated system saw, decided and did, with times and approvals, detailed enough to reconstruct a case afterwards.
See also: Investigation record
Mate Security's highest autonomy level, in which trusted categories run end to end under guardrails. A vendor term.
Vendor term: Mate Security profile
Source: Mate Security platform · Read 11 Oct 2026
See also: Recommend only (Mate Security), Supervised (Mate Security)
How much damage an action could cause if it is wrong: the people, systems and processes it affects.
See also: Reversibility
An option in which the customer supplies and controls the encryption key used to protect its data in a vendor's service.
See also: Single-tenant
An AI assistant that answers questions and drafts work for an analyst who stays in charge of each step, as opposed to an agent that works the queue.
See also: Agentic SOC
Confidence, Precision and Reversibility: the three measures Mate Security says it scores each action on, enforced outside the agent loop. A vendor term.
Vendor term: Mate Security profile
Source: Mate Security platform · Read 11 Oct 2026
See also: Reversibility, Guardrail
A record of why an analyst or an agent decided what it did on a case, kept so that later decisions can follow the same reasoning.
Source: Mate Security platform · Read 27 Sep 2026
See also: Security Context Graph (Mate Security)
A gradual change in how well an automated system's decisions match reality, caused by changes in data, tools or behaviour.
See also: Fallback
An automatic reduction in autonomy when a system detects that its decisions no longer match human review.
Source: Mate Security platform · Read 27 Sep 2026
See also: Drift
An alert that looks like a threat but is not. Closing false positives safely is most of the work an AI SOC is bought to take on.
See also: Triage
Searching several data stores in place, at query time, instead of copying all data into one store first.
See also: SIEM
7AI's name for querying security data where it already lives, in SIEMs, data lakes and cloud platforms, without moving it first. A vendor term.
Vendor term: 7AI profile
Source: 7AI press release: Federated SIEM and 7AI Build (27 July 2026) · Read 27 Sep 2026
See also: Federated search
Mate Security's workflow format, which it says can be translated from existing SOAR playbooks while keeping custom logic. A vendor term.
Vendor term: Mate Security profile
Source: Mate Security: Gamebooks · Read 27 Sep 2026
See also: Playbook
A limit on what an automated system may do, enforced by rules the system cannot override.
See also: CPR (Mate Security), Scoped action
A setup in which a person approves each consequential action before it runs.
See also: Human on the loop, Sign-off
A setup in which actions run on their own while a person monitors them and can intervene or stop them.
See also: Human in the loop, Fallback
The evidence, steps, tool queries, conclusion and proposed action behind a verdict, presented so a reviewer can check it.
See also: Verdict, Audit trail
Managed security service provider: a company that runs security operations for several customers, often on multi-tenant tools.
See also: Multi-tenant
Mean time to respond (or to remediate): the average time from an alert to its resolution. Vendors often quote reductions in MTTR as their own figures.
See also: Triage
A service in which several customers share the same infrastructure, with their data kept apart logically.
See also: Single-tenant
A predefined sequence of automated steps triggered by a type of alert, usually in a SOAR.
See also: SOAR, Gamebooks (Mate Security)
Mate Security's lowest autonomy level, in which the platform proposes actions and the team decides what runs. A vendor term.
Vendor term: Mate Security profile
Source: Mate Security platform · Read 11 Oct 2026
See also: Supervised (Mate Security), Shadow mode
How quickly and completely an action can be undone. Reversible actions are the safest candidates for unattended automation.
See also: Blast radius, CPR (Mate Security)
An automated action limited to a defined target, type and set of conditions, so it cannot reach beyond them.
See also: Guardrail, Agent Actions (Prophet Security)
Mate Security's store of memories, decision traces, guardrails and architecture about a customer's environment, used in investigations. A vendor term.
Vendor term: Mate Security profile
Source: Mate Security blog: Introducing the Security Context Graph (19 February 2026) · Read 27 Sep 2026
See also: Decision trace
Running an AI SOC on live alerts while it only recommends, so its verdicts can be compared with analysts' before it acts.
See also: Recommend only (Mate Security)
Security information and event management: the system that collects logs and raises alerts from detection rules.
See also: Federated search, SOAR
A person's approval of a specific action before it runs.
See also: Approval gate
A service in which one customer's environment runs on infrastructure dedicated to that customer.
See also: Multi-tenant, BYOK (bring your own key)
Security orchestration, automation and response: software that runs playbooks across security tools.
See also: Playbook, AI SOC platform
Torq's name for the agent that coordinates its HyperAgents across a case, which Torq calls the quarterback of the agentic SOC. A vendor term.
Vendor term: Torq AI SOC Platform profile
Source: Torq AI SOC Platform · Read 27 Sep 2026
See also: Agentic SOC
Mate Security's middle autonomy level, with a person in the loop for response. A vendor term.
Vendor term: Mate Security profile
Source: Mate Security platform · Read 11 Oct 2026
See also: Human in the loop
Deciding what an alert is and how urgent it is, and closing it with a reason if it is noise.
See also: False positive
An investigation's conclusion about whether an alert reflects real malicious activity, ideally with a stated confidence.
See also: Investigation record
Prophet Security's optional service in which its experts provide 24x7x365 human-in-the-loop review. A vendor term.
Vendor term: Prophet Security profile
Source: Prophet Security homepage · Read 27 Sep 2026
See also: Human in the loop