How does Dropzone AI work an alert?
The AI SOC Analyst investigates phishing, endpoint, network, cloud, identity and insider alerts around the clock, querying your tools by API, so no data normalisation is needed. Each investigation produces a report with evidence and reasoning, and an AI Action Graph shows the stages and actions taken. Dropzone also sells an AI Threat Hunter, generally available since July 2026 with 270+ hunt packs mapped to MITRE ATT&CK, and lists an AI Threat Intel Analyst for Fall 2026.
How much can Dropzone AI do on its own?
Dropzone hands response to the SOAR you connect: Cortex XSOAR, Splunk SOAR, Tines, Torq, D3 Security, IBM QRadar SOAR or Swimlane. That keeps your existing approvals and playbooks in place, which is useful if they work, but it means the autonomy dial lives in another product. A lean team without a SOAR would need one, or would act on Dropzone's verdicts by hand.
What does Dropzone AI say about itself?
AI SOC Analyst that investigates alerts end to end by API and hands response to the SOAR you already run.
- Products
- AI SOC Analyst, AI Threat Hunter (generally available since 29 July 2026, with 270+ hunt packs mapped to MITRE ATT&CK) and an AI Threat Intel Analyst listed for Fall 2026.
Source: Dropzone AI press release: AI Threat Hunter generally available (29 July 2026) · Read 27 Sep 2026
- Investigation
- End to end across the tool stack by API, without data normalisation; phishing, endpoint, network, cloud, identity and insider alerts.
Source: Dropzone AI homepage · Read 27 Sep 2026
- Explainability
- Investigation reports with evidence and reasoning; an AI Action Graph of stages and actions.
Source: Dropzone AI homepage · Read 27 Sep 2026
- SOAR
- Response runs through connected SOARs: Cortex XSOAR, Splunk SOAR, Tines, Torq, D3 Security, IBM QRadar SOAR and Swimlane.
Source: Dropzone AI integrations · Read 27 Sep 2026
- Plans
- Enterprise (dedicated single-tenant environment, custom workflow, premium SLAs) and MSSP (multi-tenant, pooled AI analysts) on contact; a proof-of-concept program is offered.
Source: Dropzone AI pricing · Read 11 Oct 2026
- Testing
- Co-founded the AI Proving Grounds Consortium (June 2026) to test AI defenses before production.
Source: Dropzone AI press release: AI Proving Grounds Consortium (3 June 2026) · Read 27 Sep 2026
Which figures does Dropzone AI claim?
What does Dropzone AI cost, and how is it hosted?
The base subscription covers up to 4,000 full investigations per year per AI analyst, with unlimited users, all alert categories, all pre-built integrations, threat intel feeds, an AI chatbot and an 8-hour support SLA, plus volume discounts and extra capacity. Enterprise adds a dedicated single-tenant environment and premium SLAs; the MSSP plan is multi-tenant with pooled AI analysts. Prices are on request, and a proof-of-concept program is offered. Dropzone lists an EU data residency option and SOC 2 Type II.
PRICING Pricing unit published: the base subscription covers up to 4,000 full investigations per year per AI analyst, with unlimited users, all alert categories, all pre-built integrations, threat intel feeds, an AI chatbot and an 8-hour support SLA; volume discounts and extra capacity. Prices on request.
Source: Dropzone AI pricing · Read 11 Oct 2026
HOSTING Standard service; Enterprise with a dedicated single-tenant environment; MSSP with a multi-tenant environment; EU data residency option. SOC 2 Type II.
INTEGRATIONS 90+ integrations across 14 categories, including SOAR platforms.
Where is it strong, and what should you check?
Strengths
- The clearest pricing unit in this set, with what the base subscription includes.
- Single-tenant and EU residency options, plus readable investigation reports.
Check before you buy
- You keep and maintain a SOAR for response.
- Prices require a sales conversation.
Who should choose Dropzone AI?
Choose Dropzone AI if your SOAR already runs response well and your bottleneck is investigation, or if you want to size a purchase on a published unit. Look elsewhere first if you have no SOAR and want the AI SOC to act on its own.