Customer evidence
CloudHesive adopts Arctic Wolf Aurora Agentic SOC
CloudHesive reported 50% fewer alerts requiring triage and 99% faster investigation-to-remediation after adopting Arctic Wolf.
Source: the company's LinkedIn post
Cyberfuturists · 15 October–22 October 2026
AI in the SOC Market Maturity Map
How is AI-led SOC automation evolving, and which vendors show material change in capabilities, commercial traction, workforce, funding, partnerships, customer adoption, positioning, or risk?
Vendors that use AI to detect, investigate and respond to threats, and to automate the work of security operations (SOC) teams. It covers AI SOC analysts and agentic SOC platforms, and the established SIEM, XDR, EDR and SOAR platforms adding the same capabilities. 117 vendors, 15 October–22 October 2026.
Generated 22 October 2026, 19:11 UTC
Market Maturity MapWhere 97 of the market's 100 vendors are mapped today, based on how active they are, how they are growing and how fast they are moving.
Vendors placed by size and by growth, from public data we collect: headcount, followers, funding, customers, open roles, launches and mentions. It does not rate product quality, customer satisfaction or strategy. Computed 2026-10-22 over the last 90 days.
Highlight Show
AI SOC 88AI MDR 9
Highlight Show
AI SOC 88AI MDR 9Incumbent 19
Who is where — Executing 15, Scaling 29, Building 35, Emerging 18; accelerating 17, growing 58, holding 22, innovating 35, hiring 13, raised in the last year 27, acquired 3, pivoted 1, large incumbents 19
Marks after a name: ◌ innovating · ⚒ hiring · $ raised in the last year · "(was …)" moved stage since the previous map. Each mark belongs to the name before it.
Executing (15) — the largest vendors: scale of 75 and over
7AI $, Exaforce ◌ $, BlinkOps $, Anvilogic ◌ $, Stellar Cyber ◌, Dropzone AI ◌ $, Intezer ◌, Prophet Security ◌ $, Kai Security ◌, Artemis Security ◌ ⚒ $, Qevlar ⚒, Daylight Security ◌ $, TENEX.AI ⚒, Strike48 (A Devo company) ◌, Legion Security
Scaling (29) — scale from 50 to 75
Eventus Security, D3 Security ◌, Cantina ◌ $, TechBridge Consultancy Services, Mate Security $, HawkEye ◌, UnderDefense ◌, Simbian ◌, Crogl ◌, AquilaI ◌, Twine Security, Binalyze ◌, DeepTempo, Securaa, BEYON Cyber, Method Security ⚒ $, Andesite, Command Zero, Fig Security $, Beacon Security ⚒ $, Cognna ◌ $, StrikeReady $, Spectrum Security ◌ $, Tuskira ◌, Nebulock ◌ $, Cylerian ◌, Conifers AI ◌ $, Mars Security ◌, Backline AI ◌
Building (35) — scale from 25 to 50
Rilian $, AiStrike ⚒ $, Spharaka ◌, Wraithwatch ⚒, Nua, Embed Security, Variance (was Intrinsic) ⚒, Bricklayer AI ◌, Imperum ◌ $, Sevii ◌ $, Camelot Secure ◌, Redblock, Secure.com $, PRE Security, Tenacium $, guarddog, Detections AI (was System Two Security) ◌ $, Mave $, Cotool ◌ $, Joon, Arcanna.ai ⚒, RedCarbon, SecsphereSOC, Alpha Level, Spacewalk AI, HTCD, AISOC, Seculyze, Tencyle, Sleuth Kit Labs, Louie AI ◌, Almanax, Elezar, Arambh Labs, HoundBytes
Emerging (18) — the smallest vendors: scale under 25
CipherData ⚒, Threatlens, Tier4ai, FlintX, WiseBee ⚒, Priam Cyber AI, HarkX, TandemTrace ⚒, VisionHeight, Miru Labs, CounterShadow, SOCNova, Tracecat, Vinci Logic, NextSOC, VigilBase ⚒, SOC Jedi.ai, Huntbase ◌
Accelerating (17) — momentum of 67 and over
Exaforce, Artemis Security, Daylight Security, Detections AI (was System Two Security), Bricklayer AI, 7AI, Prophet Security, Nebulock, Method Security, Dropzone AI, Kai Security, Mate Security, Cognna, Spharaka, Qevlar, Crogl, Stellar Cyber
Growing (58) — momentum from 33 to 67
VigilBase, Tuskira, Legion Security, Twine Security, Mars Security, BlinkOps, Cantina, Binalyze, Secure.com, AquilaI, Spectrum Security, Anvilogic, Eventus Security, Intezer, Cylerian, Rilian, AiStrike, Fig Security, Huntbase, Sevii, UnderDefense, Cotool, CipherData, Embed Security, WiseBee, Simbian, HawkEye, Wraithwatch, D3 Security, Backline AI, Camelot Secure, Tracecat, SOCNova, Mave, BEYON Cyber, TechBridge Consultancy Services, RedCarbon, Miru Labs, Louie AI, Imperum, Variance (was Intrinsic), Strike48 (A Devo company), Beacon Security, TENEX.AI, Arambh Labs, guarddog, Andesite, Seculyze, Conifers AI, Alpha Level, VisionHeight, NextSOC, Threatlens, DeepTempo, HTCD, Redblock, StrikeReady, HoundBytes
Holding (22) — momentum under 33
PRE Security, Command Zero, Arcanna.ai, HarkX, TandemTrace, FlintX, Spacewalk AI, Tier4ai, Priam Cyber AI, SOC Jedi.ai, Securaa, Sleuth Kit Labs, CounterShadow, Vinci Logic, Tencyle, Tenacium, Nua, Elezar, Joon, AISOC, Almanax, SecsphereSOC
Innovating (35) — top third by launches, corroborated launches, research posts and engineering hiring; a marker across every tier
Exaforce, Artemis Security, Prophet Security, Dropzone AI, Daylight Security, Kai Security, Stellar Cyber, Anvilogic, Intezer, Cantina, Crogl, Nebulock, Binalyze, Cognna, AquilaI, D3 Security, UnderDefense, Bricklayer AI, Strike48 (A Devo company), HawkEye, Simbian, Tuskira, Spharaka, Detections AI (was System Two Security), Spectrum Security, Mars Security, Cylerian, Backline AI, Sevii, Conifers AI, Camelot Secure, Cotool, Imperum, Louie AI, Huntbase
Hiring (13) — top third by open roles per 100 staff, with at least 3 roles open; a marker across every tier
VigilBase (6 open roles, 200 per 100 staff), Variance (was Intrinsic) (9 open roles, 45 per 100 staff), Wraithwatch (6 open roles, 38 per 100 staff), Artemis Security (23 open roles, 37 per 100 staff), CipherData (4 open roles, 36 per 100 staff), Beacon Security (9 open roles, 36 per 100 staff), TandemTrace (3 open roles, 33 per 100 staff), Arcanna.ai (7 open roles, 29 per 100 staff), Method Security (9 open roles, 29 per 100 staff), WiseBee (4 open roles, 27 per 100 staff), Qevlar (22 open roles, 25 per 100 staff), AiStrike (12 open roles, 22 per 100 staff), TENEX.AI (43 open roles, 21 per 100 staff)
Raised in the last year (27) — a round dated inside the last 365 days, from the vendor's own post, a matched news event or the Crunchbase news list
Prophet Security (round not stated, 2026-10), StrikeReady (round not stated, 2026-09), 7AI (Series A, 2026-08), Mate Security (Seed, 2026-07), Cantina (round not stated, 2026-07), Beacon Security (Seed, 2026-07), Imperum (Seed, 2026-07), Anvilogic (round not stated, 2026-07), Nebulock (Series A, 2026-06), Exaforce (Series B, 2026-05), Detections AI (was System Two Security) (round not stated, 2026-05), Spectrum Security (Seed, 2026-04), Rilian (Seed, 2026-04), Artemis Security (Series A, 2026-04), Tenacium (round not stated, 2026-03), Daylight Security (Series A, 2026-03), Cotool (Seed, 2026-03), Fig Security (Seed, 2026-03), Sevii (round not stated, 2026-02), Dropzone AI (Series B, 2026-01), AiStrike (Seed, 2026-01), Mave (Seed, 2026-01), Cognna (Series A, 2025-12), Secure.com (Seed, 2025-11), Method Security (Seed, 2025-11), BlinkOps (round not stated, 2025-11), Conifers AI (Strategic, 2025-10)
Acquired (3) — on the record, not on the map
Wirespeed — by Coalition, 2025-11-06; Kenzo Security — by Rapid7, 2026-03-26; Radiant Security — by Cribl (AI technology assets), 2026-08-19
Pivoted (1) — left this market for another; on the record, not on the map
Zaun — now security for AI (securing AI systems and agents), no longer AI for security operations
Large incumbents (19) — in this market, but too large to compare on size; listed, not on the map
Arctic Wolf; CrowdStrike; Elastic; Exabeam; Fortinet; Google SecOps (Google); IBM; Leidos; Mandiant (Google); Microsoft; Palo Alto Networks; Rapid7; Sekoia; SentinelOne; ServiceNow; Splunk (Cisco); Swimlane; Torq; Trellix
Analyst notes and adjustments (21)
- Redblock: Active. Was marked closed on 31 Aug 2026 from a Crunchbase record that belonged to a different company (RedBlock, a blockchain firm at redblock.network). That record was retired on 9 Oct 2026. Redblock posts on LinkedIn (9 posts in the 30 days to 8 Oct), launched SailPoint AI agent deployment in March 2026, and is hiring.
- Kenzo Security: Acquired by Rapid7; Crunchbase records the transaction and the company's own LinkedIn post of 26 March 2026 announced it. Listed as acquired, not placed.
- Radiant Security: Cribl bought Radiant Security's AI SOC technology assets on 19 August 2026 (Cribl announcement; second security acquisition this year). Listed as acquired, not placed.
- Zaun: now security for AI (securing AI systems and agents), no longer AI for security operations
- Arctic Wolf: Large incumbent: Arctic Wolf is in this market through the Aurora Agentic SOC (March 2026), run inside its managed detection and response service. Its size is not comparable, so it is listed, not placed.
- CrowdStrike: Large incumbent: CrowdStrike is in this market through Charlotte AI. Its headcount and followers are the whole company's, so it is listed, not placed.
- Elastic: Large incumbent: Elastic is in this market through Elastic Security and the Elastic AI SOC Engine. Its size is not comparable, so it is listed, not placed.
- Exabeam: Large incumbent: Exabeam (merged with LogRhythm in 2024) is an established SIEM vendor in this market through Exabeam Nova. Listed, not placed.
- Fortinet: Large incumbent: Fortinet is in this market through FortiSOC and its FortiAI agents. Its size is not comparable, so it is listed, not placed.
- Google SecOps (Google): Large incumbent: Google is in this market through Google Security Operations (Google SecOps). Its LinkedIn link is Google's company page, not the Google Cloud showcase page, which the collector has not been tested on.
- IBM: Large incumbent: IBM is in this market through ATOM, its agentic SOC engine, delivered mainly through its managed detection and response services. Its size is not comparable, so it is listed, not placed.
- Leidos: Leidos is a defence and IT contractor of about 47,000 staff. It entered this market with UpHold Effect Agentic SOC Automation on 29 Sep 2026. Its headcount and LinkedIn followers describe all of Leidos, not the product.
- Mandiant (Google): Large incumbent: Mandiant, part of Google Cloud since 2022, is in this market through Mandiant Threat Defense. It is tracked apart from Google Cloud (searched as Google Security Operations) so the two product lines stay separate. Listed, not placed.
- Microsoft: Large incumbent: Microsoft is in this market through Security Copilot. Its LinkedIn link is the whole company's page, not Microsoft Security's showcase page, which the collector has not been tested on.
- Palo Alto Networks: Large incumbent: Palo Alto Networks is in this market through Cortex XSIAM and AgentiX. Its headcount and followers are the whole company's, so it is listed, not placed.
- Rapid7: Large incumbent: Rapid7 is in this market through Incident Command and bought Kenzo Security in March 2026. Its size is not comparable, so it is listed, not placed.
- SentinelOne: Large incumbent: SentinelOne is in this market through Purple AI. Its size is not comparable, so it is listed, not placed.
- ServiceNow: Large incumbent: ServiceNow is in this market through Security Operations and its SOC AI Specialist (due December 2026). Its size is not comparable, so it is listed, not placed.
- Splunk (Cisco): Large incumbent: Cisco sells its agentic SOC as Splunk (Splunk Enterprise Security and the Splunk Agentic SOC Workforce) together with Cisco XDR, so this one entry covers both and is searched under both names. Its size is not comparable, so it is listed, not placed.
- Torq: Large incumbent: Torq (476 staff, $332M raised, valued at $1.2B in January 2026) is the largest of the security-automation vendors, so it is listed with the incumbents rather than ranked against startups. Listed, not placed.
- Trellix: Large incumbent: Trellix (McAfee Enterprise and FireEye, owned by STG) is in this market through Trellix Wise. Its size is not comparable, so it is listed, not placed.
Not rated (1) — what each one lacks
A vendor is rated only when we have every input. 1 lack linkedin headcount (latest count); 1 lack linkedin followers; 1 lack open roles per 100 staff.
SOCAI: linkedin headcount (latest count), linkedin followers, open roles per 100 staff
How the map is computed — weights and rules
| Input | Axis | Weight |
|---|---|---|
| LinkedIn headcount (latest count) | scale | 0.35 |
| Disclosed funding total (optional) | scale | 0.30 |
| Customer evidence, weighted, last 12 months named customer in their own words 3, named in the vendor's words 2, unnamed 1 | scale | 0.25 |
| LinkedIn followers | scale | 0.10 |
| Headcount change in the period (optional) | momentum | 0.30 |
| Launches and partnerships in the period | momentum | 0.25 |
| Earned mentions in the period | momentum | 0.15 |
| Open roles per 100 staff | momentum | 0.15 |
| Crunchbase growth score (secondary) (optional) | momentum | 0.10 |
| Own LinkedIn posts in the period | momentum | 0.05 |
Each input is a percentile rank among the rated vendors; an axis is the weighted mean of its inputs. On the map, the angle is the stage, by scale: Emerging under 25, Building from 25, Scaling from 50, Executing from 75, left to right. The distance from the base is momentum: holding under 33, growing from 33, accelerating from 67. A vendor moves right as it grows and outward as it speeds up.
Executive assessment
2 findingsCustomer announcements from Arctic Wolf, CrowdStrike.
2 customer or deployment announcements, 2 of them naming the customer.
- CloudHesive adopts Arctic Wolf Aurora Agentic SOC (Vendor sources only, 19 Oct 2026)
- Cogentrix Energy uses CrowdStrike Falcon platform (Vendor sources only, 16 Oct 2026)
9 of 117 vendors had a development.
12 developments in 7 days, plus 14 hiring or headcount signals. The 3 most active vendors account for 50% of them (Binalyze 2, IBM 2, Nebulock 2). 81 vendors were watched and had none. 27 are not fully collected yet.
- Binalyze: 2 developments
- IBM: 2 developments
- Nebulock: 2 developments
- Arctic Wolf: 1 development
- Cantina: 1 development
Weekly briefing
Week of 2026-09-14 · approved 22 September 2026AI in the SOC — Week of 2026-09-14
Multiple vendors announced new capabilities or product versions during the week.
Vendors with a development
26 developments · 9 vendors| Vendor | Development | Evidence | Why it matters |
|---|---|---|---|
| Arctic Wolf | CloudHesive adopts Arctic Wolf Aurora Agentic SOC Customer evidence · 19 Oct 2026 | the company's LinkedIn post · 1 source Vendor sources only | |
| CrowdStrike | Cogentrix Energy uses CrowdStrike Falcon platform Customer evidence · 16 Oct 2026 | the company's LinkedIn post · 1 source Vendor sources only | |
| Cantina | Cantina adds Clarion, Connection Panel, Inspector categorization features Product expansion · 19 Oct 2026 | the company's LinkedIn post · 1 source Vendor sources only | |
| Binalyze | Binalyze partners with DIFOSE to strengthen digital forensics capabilities Partnership · 16 Oct 2026 | the company's website · 1 source Vendor sources only | |
| Elastic | Elastic partners with Google for Distributed Cloud AI SecOps integration Partnership · 16 Oct 2026 | the company's website · 1 source Vendor sources only | |
| IBM | IBM introduces vLLM-Hook MIA plugin for AI monitoring Product launch · 21 Oct 2026 | the company's website · 1 source Vendor sources only | |
| Binalyze | Binalyze releases AIR 5.29 digital forensics platform update Product launch · 20 Oct 2026 | the company's website · 1 source Vendor sources only | |
| IBM | IBM releases llm-d 1.0 open-source distributed inference framework Product launch · 20 Oct 2026 | the company's website · 1 source Vendor sources only | IBM releases llm-d 1.0, an open-source distributed inference framework enabling reliable, cost-effective serving of large AI models on enterprise… |
Other developments (18)
| Nebulock | Nebulock launches Agentic Cybersecurity Engineering platform | Product launch · 20 Oct 2026 | 1 source · Vendor sources only |
| Mars Security | Mars Security launches Co-Hunter Instructions for investigation control | Product launch · 19 Oct 2026 | 1 source · Vendor sources only |
| Swimlane | Swimlane launches SentinelOne Scan and Analyze Exposed Credentials Agent | Product launch · 16 Oct 2026 | 1 source · Vendor sources only |
| Nebulock | Nebulock launches Detection Versioning for security detections | Product launch · 15 Oct 2026 | 1 source · Vendor sources only |
| 7AI | 7AI: 38 open roles | Hiring · this period | 1 source · Vendor sources only |
| Artemis Security | Artemis Security: 23 open roles | Hiring · this period | 1 source · Vendor sources only |
| BlinkOps | BlinkOps: 9 open roles | Hiring · this period | 1 source · Vendor sources only |
| Daylight Security | Daylight Security: 12 open roles | Hiring · this period | 1 source · Vendor sources only |
| Dropzone AI | Dropzone AI: 12 open roles | Hiring · this period | 1 source · Vendor sources only |
| Kai Security | Kai Security: 18 open roles | Hiring · this period | 1 source · Vendor sources only |
| Method Security | Method Security: 9 open roles | Hiring · this period | 1 source · Vendor sources only |
| Nebulock | Nebulock: 5 open roles | Hiring · this period | 1 source · Vendor sources only |
| Prophet Security | Prophet Security: 5 open roles | Hiring · this period | 1 source · Vendor sources only |
| Qevlar | Qevlar: 22 open roles | Hiring · this period | 1 source · Vendor sources only |
| Stellar Cyber | Stellar Cyber: 17 open roles | Hiring · this period | 1 source · Vendor sources only |
| TENEX.AI | TENEX.AI: 43 open roles | Hiring · this period | 1 source · Vendor sources only |
| Variance | Variance (was Intrinsic): 9 open roles | Hiring · this period | 1 source · Vendor sources only |
| Wraithwatch | Wraithwatch: 6 open roles | Hiring · this period | 1 source · Vendor sources only |
What this says about the market
Market formation
Most of the market is new: 67 of the 115 vendors with a known founding year were founded in 2023 or later.
Founding year known for 115 of 117 vendors.
Products versus customers
Product news outweighs customer announcements. Of 12 developments, 8 were product launches or expansions, 2 partnerships and 2 customer or deployment announcements.
Concentration
Activity is concentrated in three vendors account for 50% of 12 developments. Elsewhere it is spread: the three vendors hiring most hold 40% of 259 open roles (TENEX.AI alone 17%); the three most active accounts published 11% of 300 vendor posts; the three best-funded vendors hold 46% of disclosed funding.
Job listings exist for 29 of 117 vendors; funding is disclosed for 55 of 117.
Developments
RSS15 October–22 October 2026
576 records collected → 26 developments
Customer evidence
Cogentrix Energy uses CrowdStrike Falcon platform
Two-person team automates ~7 hours weekly, runs 32 SOAR workflows, cut cyber insurance 45% saving ~$300,000 over three years.
Source: the company's LinkedIn post
Product expansion
Cantina adds Clarion, Connection Panel, Inspector categorization features
Cantina announced apex-flash-1 model two weeks ago and added Clarion chat, Apex Connection Panel, and Amazon Inspector result categorization.
Source: the company's LinkedIn post
Partnership
Binalyze partners with DIFOSE to strengthen digital forensics capabilities
Binalyze announced a strategic technical services partnership with DIFOSE to strengthen its digital forensics capabilities.
Source: the company's website
Partnership
Elastic partners with Google for Distributed Cloud AI SecOps integration
Elastic Security integrates into Google Distributed Cloud AI SecOps for air-gapped AI-driven threat detection.
Source: the company's website
Product launch
IBM introduces vLLM-Hook MIA plugin for AI monitoring
New plugin lets developers inspect and modify AI generation processes with minimal delay.
Source: the company's website
Product launch
Binalyze releases AIR 5.29 digital forensics platform update
Adds improved large file uploads, redesigned Organization Dashboard, relay-aware deployment links, and faster Investigation Hub data transfers.
Source: the company's website
Product launch
IBM releases llm-d 1.0 open-source distributed inference framework
Enables reliable, cost-effective serving of large AI models on enterprise infrastructure.
Source: the company's website
Product launch
Nebulock launches Agentic Cybersecurity Engineering platform
Unifies threat hunting, detection engineering, insider risk, and alert triage in AI workflows.
Source: the company's website
Product launch
Mars Security launches Co-Hunter Instructions for investigation control
Co-Hunter Instructions let users set standing rules for data sources, workflows, vocabulary applied to every hunt.
Source: the company's LinkedIn post
Product launch
Swimlane launches SentinelOne Scan and Analyze Exposed Credentials Agent
The agent hunts exposed credentials on SentinelOne-managed endpoints, uses Hero AI for triage, and runs deterministically without exposing secrets.
Source: the company's LinkedIn post
Product launch
Nebulock launches Detection Versioning for security detections
The system tracks what changes and why through journals, impact assessments, and full state preservation.
Source: the company's website
Hiring
14 vendors with 5 or more open roles
7AI
Artemis Security
BlinkOps
Daylight Security
Dropzone AI
Kai Security
Method Security
Nebulock
Prophet Security
Qevlar
Stellar Cyber
TENEX.AI
Variance
Wraithwatch
Everything we collected: the 60 most recent of 576 records
Everything matched to this market in the period, including general discussion and anything that did not become a development.