SCORING

How we score AI SOC platforms

SHORT ANSWER

We score ten AI SOC platforms from 0 to 10 on seven weighted criteria, using only their public pages, read on 27 September, 11 October and 13 October 2026. Totals are computed in code from the weights on this page. We did not test the products.

By The Alert Desk · AI SOC Compared · Published 2026-09-27 · Updated 2026-10-14

What does the hand-off score measure?

How much of the alert queue a small security team could hand to a platform, as its own public pages describe it: how far it investigates without a person, how finely the team can set and pull back its autonomy, how readable its reasoning is, and what it takes to connect, host, migrate to and buy. It is not a measure of overall product quality.

It answers one buying question: Which AI SOC platform can a lean team trust to investigate and act on alerts end to end, with the controls to decide how much it does on its own? A platform can have the longest integration list here and still score modestly if its pages say little about how far it investigates or how its autonomy is controlled.

Which criteria and weights do we use?

The seven criteria. Weights sum to 100.
Code	Criterion	Weight	Question
DEPTH	Investigates end to end	20%	Does it take an alert from intake to a verdict, gathering the evidence across your tools without a person doing the lookups?
DIAL	Autonomy you can dial	20%	Can the team decide, per category or action, whether it only recommends, waits for sign-off or acts alone, and pull that autonomy back?
WHY	Shows its reasoning	15%	Can an analyst read why it reached a verdict: the evidence, the steps and tool calls, and challenge or correct it?
REACH	Reaches your data sources	15%	How many alert sources and tools does it publish connections for, and how does it read your data?
DATA	Hosting and data handling	10%	Which hosting options, tenancy, key control, residency and security attestations does it publish?
CARRY	Brings SOAR playbooks along	10%	If you already run SOAR playbooks, does it translate them, rebuild them quickly, or keep them running beside it?
PRICE	Pricing clarity	10%	Can a buyer see a price, a pricing unit or a procurement path before a sales call?

Why these weights?

End-to-end investigation and autonomy control carry the most weight, 20% each, because they decide whether a small team can hand work off at all: the platform has to finish the investigation, and the team has to stay in charge of what it does next. Readable reasoning and reach into your data sources carry 15% each: a verdict you cannot check quickly saves little time, and an alert source the platform cannot query is an alert it cannot investigate. Hosting and data handling, bringing SOAR playbooks along, and pricing clarity carry 10% each. Playbooks sit at 10% because many lean teams run few or no SOAR playbooks; the sensitivity table shows the order with that weight at zero. No weight is above 30%.

How sensitive is the order to the weights?

Weights are a judgment, so here is what changes when they move. Each row shows the top four under different weights, computed by the same code.

Top four platforms under alternative weights. Ties are marked with =.
Weighting	1st	2nd	3rd	4th
Equal weights (each criterion 1/7)	Mate Security 7.57	Prophet Security 7.00	Dropzone AI =6.86	Torq AI SOC Platform =6.86
No playbooks to move (playbooks 0, depth 25, control 20, reasoning 15, sources 20, handling 10, pricing 10)	Mate Security 7.80	Prophet Security 7.50	Torq AI SOC Platform 7.25	Dropzone AI 7.20
Connections and hosting first (sources 25, handling 20, depth 15, control 15, reasoning 10, playbooks 5, pricing 10)	Mate Security =7.40	Prophet Security =7.40	Torq AI SOC Platform 7.15	Dropzone AI 7.10
Buying first (pricing 25, handling 20, sources 15, depth 15, control 10, reasoning 10, playbooks 5)	Mate Security 6.85	Dropzone AI 6.75	Prophet Security 6.65	Conifers CognitiveSOC 6.20

Under 'Buying first' weights the top two are Mate Security and Dropzone AI. The analyst hours calculator lets you set your own weights.

How is a total calculated?

Total = sum of (criterion score × weight) ÷ 100. Scores are whole numbers from 0 to 10. Totals are shown to two decimals; platforms with the same shown total share a rank. Nothing is hand-typed: every table, rank and winner is generated from one data file.

Mate Security: 9×20 + 9×20 + 9×15 + 7×15 + 6×10 + 9×10 + 4×10 = 790 ÷ 100 = 7.90

What does the autonomy ladder show?

The ladder has five rungs, always in the same order:

TRIAGE: every alert is classified, noise closed with a reason.
INVESTIGATE: evidence gathered across tools to a verdict.
SHOW WORK: the verdict comes with readable evidence and steps.
ACT ON SIGN-OFF: response actions that wait for a person to approve.
ACT ALONE, WITHIN LIMITS: actions run unattended in categories or scopes you choose, with a way to pull autonomy back.

Each rung is Documented (the vendor's own pages describe that step), Partial (described in general terms only, or through another product) or Not documented (not described on the pages reviewed). The ladder is not weighted and is not scored by itself; it is the evidence summary behind the depth, control and reasoning criteria.

Documented on the vendor's pages
Partial: in general terms only, or through another product
Not documented on the pages reviewed

TRIAGEDocumented
Mate says it investigates 100% of alerts, including informational ones.
Source: Mate Security homepage · Read 11 Oct 2026
INVESTIGATEDocumented
Investigations run against the Security Context Graph with domain logic for six alert domains.
Source: Mate Security platform · Read 27 Sep 2026
SHOW WORKDocumented
Verdicts come with an evidence trail; decision traces record why analysts decided past cases.
Source: Mate Security platform · Read 27 Sep 2026
ACT ON SIGN-OFFDocumented
Supervised level: human in the loop for response.
Source: Mate Security platform · Read 11 Oct 2026
ACT ALONE, WITHIN LIMITSDocumented
Auto-run level with CPR checks outside the agent loop; falls back to Supervised on conflict with analysts.
Source: Mate Security platform · Read 11 Oct 2026

A filled rung means the vendor's own pages describe that step. It does not measure how well or how often the step works in your environment.

How is a score decided?

A 9 means the capability is described specifically and goes further than most of the set. A 7 to 8 means it is described clearly but narrower, or with less detail. A 5 to 6 means it exists only in general terms or through another product. A 2 to 4 means we found little or nothing on the pages reviewed. For pricing, 5 means a published pricing unit with what it includes, 4 a marketplace list price for a tier the listing does not define, 3 a described procurement route without a price, and 2 nothing published.

What counts as evidence?

A capability counts only if the vendor's own product page, documentation, trust or pricing page, press release or official blog describes it. Every score links the page used.
Where a vendor does not publish something, we write Not published or Not documented and score conservatively. Absence from the pages we read is not proof that a capability is missing.
Vendor figures, such as MTTR reductions or autonomous remediation rates, are quoted as the vendor's statement and never used as our finding.
Some facts come from search-result text of a vendor page we could not open: Prophet's AWS Marketplace listing, and funding figures for Prophet, Intezer and Conifers taken from news titles. They are labelled that way in the source list.
Vendor facts were read on 27 September or 11 October 2026; each SourceLine shows its read date.

Which platforms are in scope?

Standalone AI SOC platforms that investigate alerts and can take or propose a response: the ten that buyers most often shortlist and whose pages we could read. AI assistants inside a SIEM or EDR platform, SOAR engines and managed detection and response services are out of scope; so is Radiant Security for this edition, because its pages could not be read.

Named products that are not ranked

What are the limitations?

Public sources only. No hands-on testing, no vendor interviews, no access to private documentation or pricing. Vendor pages describe intended capability; real results depend on your alert mix, your tools and your settings. Facts can change after the read date shown next to each source. Treat every score as a starting point and confirm details with the vendor.

How do we handle corrections?

Send a correction through the contact page with the topic Correction to vendor information and a link to the public source. We check it against the vendor's page and update the data; totals recompute automatically.

Frequently asked questions

Did you test these platforms?

No. Scores come from desk research on public pages. Vendor figures are labelled as vendor statements.

Can a vendor pay to change its score?

No. Scores change only when a public source changes.

Can I use my own weights?

Yes. The analyst hours calculator re-weights the ranking, filters by must-haves and prints the formula it uses.