AI SOC Analyst Vendor Visibility Index

Dropzone AI Tops Every Engine for AI SOC Analyst Vendors

Share of answers naming each core AI SOC analyst vendor, by engine.

ChatGPT Gemini Perplexity All engines

0%10%20%30%40%50%60%

All

1Dropzone AI

51.3%47.6–55.1

2Microsoft

44.9%41.2–48.7

3Prophet Security

40.8%37.1–44.5

4Torq

37.1%33.5–40.8

5CrowdStrike

29.0%25.7–32.6

6D3 Security

21.6%18.6–24.8

7Intezer

21.1%18.2–24.4

8Radiant Security

15.2%12.7–18.1

9SentinelOne

12.4%10.1–15.1

10Palo Alto Networks

12.2%9.9–14.9

11Simbian

11.9%9.7–14.6

12Google

10.6%8.5–13.1

Source: Ranking Atlas, AI SOC Analyst Vendor Visibility Index, October 2026 edition. 112 buyer questions, each asked twice on ChatGPT, Gemini and Perplexity, on 18 October 2026: 224 answers per engine, 672 in all. Right column: share of all 672 answers, with its 95% interval (Wilson). Data: ai-soc-analyst-vendor-visibility-index.csv

Show the data as a table

Vendor	ChatGPT	Gemini	Perplexity	All engines	95% interval
Dropzone AI	126 of 224 (56.3%)	114 of 224 (50.9%)	105 of 224 (46.9%)	345 of 672 (51.3%)	47.6% to 55.1%
Microsoft	124 of 224 (55.4%)	94 of 224 (42.0%)	84 of 224 (37.5%)	302 of 672 (44.9%)	41.2% to 48.7%
Prophet Security	87 of 224 (38.8%)	82 of 224 (36.6%)	105 of 224 (46.9%)	274 of 672 (40.8%)	37.1% to 44.5%
Torq	86 of 224 (38.4%)	88 of 224 (39.3%)	75 of 224 (33.5%)	249 of 672 (37.1%)	33.5% to 40.8%
CrowdStrike	83 of 224 (37.1%)	62 of 224 (27.7%)	50 of 224 (22.3%)	195 of 672 (29.0%)	25.7% to 32.6%
D3 Security	24 of 224 (10.7%)	59 of 224 (26.3%)	62 of 224 (27.7%)	145 of 672 (21.6%)	18.6% to 24.8%
Intezer	23 of 224 (10.3%)	38 of 224 (17.0%)	81 of 224 (36.2%)	142 of 672 (21.1%)	18.2% to 24.4%
Radiant Security	35 of 224 (15.6%)	16 of 224 (7.1%)	51 of 224 (22.8%)	102 of 672 (15.2%)	12.7% to 18.1%
SentinelOne	32 of 224 (14.3%)	21 of 224 (9.4%)	30 of 224 (13.4%)	83 of 672 (12.4%)	10.1% to 15.1%
Palo Alto Networks	28 of 224 (12.5%)	28 of 224 (12.5%)	26 of 224 (11.6%)	82 of 672 (12.2%)	9.9% to 14.9%
Simbian	7 of 224 (3.1%)	35 of 224 (15.6%)	38 of 224 (17.0%)	80 of 672 (11.9%)	9.7% to 14.6%
Google	30 of 224 (13.4%)	18 of 224 (8.0%)	23 of 224 (10.3%)	71 of 672 (10.6%)	8.5% to 13.1%

Key Findings

1. Dropzone AI is the most-named vendor on every engine. It was named in 51.3% of answers overall and placed first on ChatGPT, Gemini and Perplexity, sharing first place on Perplexity with Prophet Security (46.9%).
2. Specialists and platforms split the top five. Three specialists (Dropzone AI, Prophet Security, Torq) and two platform AI modules (Microsoft Security Copilot, CrowdStrike Charlotte AI) fill the top five. The top five hold 59.3% of all core mentions.
3. Buyer type changes the leader for two groups. Microsoft leads for UK and EU buyers (52.4%) and regulated-industry buyers (39.3%). Dropzone AI leads or shares the lead for the other six.
4. The engines disagree on the second tier. Intezer was named in 36.2% of Perplexity answers and 10.3% of ChatGPT answers. Simbian was named in 17.0% of Perplexity answers and 3.1% of ChatGPT answers.
5. Adjacent platforms take almost half the mentions. Of 4,286 counted vendor mentions, 1,984 (46.3%) were adjacent products, mostly SIEM and XDR platforms, and 136 of the 672 answers named no core vendor at all.

What the Data Shows

One specialist leads on all three engines

Dropzone AI also leads or shares the lead for six of the eight buyer types. That is an unusually consistent position: the next three vendors change order from engine to engine. At the level of individual mentions, the top two vendors hold 28.1% of core mentions and the top ten hold 83.4%, so the category is concentrated around a small group.

Platform AI modules hold a third of core mentions

Seventeen companies in the core class sell a broad security platform and count here only through a named AI analyst product. Together they took 34.1% of core mentions. Their share depends on the question. On response questions it was 45.9% and on threat hunting 45.1%. On MSSP multi-tenancy questions it was 19.1% and on cost questions 25.9%. When buyers ask about taking action in their own environment, the engines lean towards the platforms they may already run. When buyers ask about economics or multi-tenant service, specialists take more of the answer.

Buyer type changes the answer for regulated and European buyers

The two buyer types Microsoft leads also have the highest platform share of core mentions (50.7% for UK and EU buyers, 45.0% for regulated industries) and the most answers with no core vendor. Elsewhere, D3 Security ranks sixth overall and second for MSSP and MDR providers. For a vendor, the overall rank can hide a strong position with one buyer and a weak one with another.

The engines rank the second tier differently

D3 Security was named in 27.7% of Perplexity answers and 10.7% of ChatGPT answers. Each engine was consistent with itself (Table 4), so the differences come from the engines, not from run-to-run noise. Visibility measured on one engine is not a proxy for the other two.

Adjacent platforms take almost half the answers

One answer in five named no core vendor at all. The engines named 51 core vendors, and only 14 cleared the main-table line. A buyer asking about AI analysts is often answered with the platform the analyst would sit on.

How to Read the Tables

The four views answer different questions: Tables 1 and 2 rank vendors overall, the buyer-type view shows the top five for each buyer type, and the engine view shows each engine's own top five. A vendor's position often differs between views, and that difference is usually the most useful thing to know.

Why the Line Is 7 Questions

A vendor is ranked only if it was named in 7 or more of the 112 questions in at least one engine run. Below that, the difference between one appearance and two reflects run-to-run variation more than a real gap. 37 further core entries and 44 further adjacent entries were named at least once but fell below the line. All of them are in the appendix and the CSV. Two core entries came close, with a best single run of 5 questions: Conifers.ai and Swimlane, whose platform also ranks in the adjacent table. If a product was never named, that is a result rather than an omission.

How We Measured

Questions. 112 questions written in the voice of real buyers: 14 for each of eight buyer types, covering shortlist, capability and open problem questions. No question names a brand. Every question was reviewed for wording that would favour one kind of vendor, and the set was fixed before collection.

Collection. Each question was asked twice on ChatGPT, Gemini and Perplexity on 18 October 2026 (Singapore time), with no system message or prior conversation, set to US location and English. All 672 answers were collected.

Counting. A company counts once per answer, however many times it is named. A mention counts when the answer recommends or lists the product as an option. Products named only as something to avoid, as the buyer's existing tools, as an integration target or as a source do not count.

Classes. Core and adjacent are defined under Tables 1 and 2. OT security monitoring tools are out of scope.

Score. Visibility % is the mean of the six engine-run percentages, so each engine counts equally.

Acquired products. A product bought by another company counts under its owner on the collection date, and the label says so wherever the acquired brand was named: Cisco (incl. Splunk), Google (incl. Mandiant), Zscaler (incl. Red Canary), Sophos (incl. Secureworks) and Mastercard (incl. Recorded Future). Where a single answer named both brands, it counts once.

How Consistent Each Engine Was Between Runs

Engine	Core: rank correlation	Core: top-10 overlap	Adjacent: rank correlation	Adjacent: top-10 overlap
ChatGPT	0.817	9 of 10	0.784	9 of 10
Gemini	0.927	10 of 10	0.708	10 of 10
Perplexity	0.973	9 of 10	0.892	9 of 10

Scroll for more →

All three engines returned a similar core ranking twice, with Perplexity the most stable. The index still averages two runs per engine and does not rely on one.

Limitations

This is one collection window, so answers can change week to week. Real users with their own history, location or settings may see different answers. Coding was done by a single coder against a fixed codebook, with every judgement call logged. Counts measure how often a vendor is named, not whether the recommendation is favourable. Results for a buyer type rest on 14 questions. Vendors mentioned only once in running text may be missing, so the count of rarely named vendors is a minimum.

The 112 buyer questions, grouped by buyer type

Enterprise SOC lead (head of SOC or detection and response, 5,000+ staff, 24x7 in-house SOC)

ID	Stage	Question
ES01	Shortlist	We run a 24x7 SOC for a 20,000-person company and are drowning in alerts. Which AI SOC analyst platforms should be on our shortlist? Compare the leading vendors.
ES02	Shortlist	Which agentic SOC products are strongest for a large enterprise SOC that wants AI to triage and investigate every alert, and why?
ES03	Shortlist	We have budget this year to add AI-driven alert triage to a large in-house SOC. Which vendors should we evaluate first?
ES04	Shortlist	What are the best autonomous SOC analyst tools for a global enterprise with an existing SIEM and SOAR? Give a shortlist with pros and cons.
ES05	Vendor selection	I lead detection and response at a Fortune 500 company. Which AI SOC analyst product should we buy to cut mean time to respond? Recommend specific products.
ES06	Vendor selection	We are writing an RFP for AI that investigates alerts end to end and drafts response actions. Which vendors should we invite?
ES07	Solution exploration	Which products use AI agents to investigate security alerts automatically, gathering evidence across EDR, identity, cloud and email?
ES08	Requirements	Which AI SOC tools work on top of an existing SIEM without forcing us to move our log data?
ES09	Requirements	Which AI SOC analyst platforms show their full reasoning and evidence for every verdict so senior analysts can audit them?
ES10	Requirements	Which AI triage tools can take containment actions, such as isolating a host or disabling an account, with human approval?
ES11	Requirements	Which agentic SOC products learn from our analysts' past decisions and tune themselves to our environment?
ES12	Requirements	Which AI tools can handle tier 1 alert triage around the clock so our analysts focus on threat hunting?
ES13	Problem framing	How should a large enterprise SOC introduce AI analysts without losing control of response decisions?
ES14	Problem framing	What does a mature AI-assisted SOC look like in 2026, and what tools does it rely on?

Mid-market CISO with a small team (500-3,000 staff, 2-5 security analysts)

ID	Stage	Question
MM01	Shortlist	I am CISO at a 1,200-person company with three security analysts. Which AI SOC analyst tools give us the most coverage? Compare the main options.
MM02	Shortlist	Which AI SOC products work best for a mid-sized company that cannot afford a 24x7 security team?
MM03	Shortlist	We want AI to handle alert triage so our small team can sleep at night. Which vendors should we look at?
MM04	Shortlist	Which AI SOC analyst products can give a mid-market company 24x7 alert coverage without outsourcing to a managed service?
MM05	Vendor selection	Which AI SOC analyst product would you recommend for a 2,000-employee company that already has an EDR and a cloud SIEM?
MM06	Vendor selection	Which AI security analyst tool should a lean security team buy this year to investigate alerts automatically?
MM07	Requirements	Which AI SOC tools are quick to deploy, with value in days rather than months, for a small security team?
MM08	Requirements	Which AI triage products integrate with common EDR, identity and email tools out of the box?
MM09	Requirements	Which AI tools investigate suspicious login and phishing alerts automatically and tell us which ones are real?
MM10	Requirements	Which AI SOC analyst products have pricing that works for a company with fewer than five security staff?
MM11	Validation	How accurate are AI SOC analyst tools at separating real threats from false positives, and which vendors publish evidence?
MM12	Requirements	Which tools let a small team run after-hours alert response with AI and only page a human for real incidents?
MM13	Problem framing	How can a security team of three cover alerts 24x7 without burning out?
MM14	Problem framing	Is AI alert triage mature enough to trust for a mid-sized company, or is it still hype?

MSSP or MDR provider (SOC director or founder, multi-tenant service)

ID	Stage	Question
MS01	Shortlist	We run an MSSP with 150 customers. Which AI SOC analyst platforms are best for a multi-tenant managed security service?
MS02	Shortlist	Which agentic SOC tools help an MDR provider scale to more customers without hiring more analysts? Compare the leaders.
MS03	Shortlist	Which AI triage platforms should a growing MDR company evaluate to lower cost per customer?
MS04	Shortlist	What are the best AI SOC analyst products for managed security providers, and how do they differ?
MS05	Vendor selection	I run SOC operations at an MSSP. Which AI investigation platform should we standardise on across all customer environments?
MS06	Vendor selection	Which AI SOC vendors offer partner or white-label programmes for managed service providers?
MS07	Requirements	Which AI SOC tools keep each customer's data and investigations strictly separated in a multi-tenant SOC?
MS08	Requirements	Which AI triage platforms work across many different SIEMs and EDRs, since every customer uses different tools?
MS09	Requirements	Which AI SOC products produce customer-ready incident reports automatically?
MS10	Solution exploration	Which tools use AI agents to do tier 1 and tier 2 analyst work for a managed detection and response service?
MS11	Requirements	Which AI SOC platforms price per tenant or per alert in a way that suits a managed service?
MS12	Requirements	Which AI investigation tools let MSSP analysts review and approve AI verdicts before customers see them?
MS13	Problem framing	How are MSSPs and MDR providers using AI analysts to stay profitable?
MS14	Problem framing	Will AI SOC analysts replace managed detection and response services, or make them better?

Regulated-industry security lead (healthcare, financial services, critical infrastructure)

ID	Stage	Question
RG01	Shortlist	We are a hospital group with a small SOC. Which AI SOC analyst platforms are suitable for healthcare security? Compare options.
RG02	Shortlist	Which AI SOC products are strongest for a bank that needs explainable, auditable alert decisions?
RG03	Shortlist	Which agentic SOC vendors should a utility or critical infrastructure operator consider for IT and OT alert triage?
RG04	Shortlist	Which AI security analyst tools do regulated financial firms use, and how do they compare?
RG05	Vendor selection	I lead security at an insurer. Which AI SOC analyst product should we buy that will satisfy our auditors and regulators?
RG06	Vendor selection	Which AI alert triage platform would you recommend for a healthcare provider handling patient data?
RG07	Requirements	Which AI SOC tools can be deployed in a private cloud or on premises so security data never leaves our environment?
RG08	Requirements	Which AI SOC analyst platforms keep a complete audit trail of every AI decision and action for regulators?
RG09	Requirements	Which AI SOC tools can contain a compromised account or device automatically, with a human sign-off step auditors can review?
RG10	Requirements	Which AI SOC products help produce incident timelines for regulatory breach notification deadlines?
RG11	Requirements	Which AI SOC tools guarantee customer security data is not used to train their models?
RG12	Validation	What are the risks of letting AI take response actions in a regulated environment, and which tools manage them best?
RG13	Problem framing	How should a regulated organisation govern the use of AI in its security operations centre?
RG14	Problem framing	What should regulators and auditors expect to see when a bank uses AI to triage security alerts?

SOC analyst or detection engineer evaluating tools

ID	Stage	Question
EN01	Shortlist	I am a SOC analyst testing AI triage tools. Which AI SOC analyst products are actually good at investigations? Compare them honestly.
EN02	Shortlist	Which agentic SOC platforms do detection engineers rate highest, and what are their weaknesses?
EN03	Shortlist	What are the best AI tools for a SOC analyst to speed up alert investigation today?
EN04	Shortlist	Which AI SOC analyst tools offer a free trial or proof of concept I can test against our real alerts?
EN05	Vendor selection	Which AI SOC tools can run threat hunts on their own across our logs and report what they find?
EN06	Vendor selection	Which AI investigation tool gives the best results on cloud and identity alerts?
EN07	Requirements	Which AI SOC tools let analysts ask questions about alerts and logs in plain English and get queries back?
EN08	Requirements	Which AI triage platforms let us customise investigation playbooks instead of using a black box?
EN09	Requirements	Which AI SOC tools have an API so we can plug AI verdicts into our own detection pipeline?
EN10	Solution exploration	Which products use AI agents to tune noisy detection rules and reduce false positives?
EN11	Validation	How do I measure whether an AI SOC analyst tool is accurate before we trust its verdicts? Which vendors make this easy?
EN12	Requirements	Which AI tools can investigate an alert across EDR, SIEM and cloud logs and write up the findings like a senior analyst?
EN13	Problem framing	How is AI changing the day-to-day work of SOC analysts?
EN14	Problem framing	What skills should a SOC analyst learn now that AI handles much of alert triage?

CFO or procurement (headcount cost and business case)

ID	Stage	Question
FP01	Shortlist	Our CISO wants to buy an AI SOC analyst instead of hiring more analysts. Which vendors give the best return on investment?
FP02	Shortlist	Which AI SOC products are the most cost-effective alternative to adding security headcount? Compare pricing models.
FP03	Shortlist	As CFO, which AI security operations vendors should I expect to see in a business case to reduce SOC staffing costs?
FP04	Shortlist	Which AI SOC analyst platforms can cover tier 1 alert triage for less than the cost of hiring one more analyst?
FP05	Vendor selection	Which AI SOC analyst vendor offers the most predictable pricing for a company with growing alert volumes?
FP06	Vendor selection	Procurement needs three AI SOC vendors to compare for a contract next quarter. Which three should we invite?
FP07	Requirements	How much do AI SOC analyst tools typically cost per year, and which vendors price per alert, per user or per asset?
FP08	Requirements	Which AI SOC vendors publish customer results on analyst hours saved or response time reduced?
FP09	Requirements	Which AI SOC vendors include integrations, onboarding and support in the price, with no extra professional services fees?
FP10	Requirements	Which AI SOC vendors offer flexible contracts or pilots so we can prove savings before committing?
FP11	Solution exploration	Which companies sell AI that does the work of a security analyst? List the main vendors.
FP12	Requirements	Which AI SOC analyst tools reduce analyst overtime and after-hours on-call costs?
FP13	Problem framing	How should a CFO evaluate the return on investment of AI in the security operations centre?
FP14	Problem framing	Can AI really reduce security operations headcount, or does it only shift the work?

Cloud-first startup security lead (one to three person security function)

ID	Stage	Question
CS01	Shortlist	I am the only security person at a 150-person cloud startup. Which AI SOC analyst tools can act as my security team? Compare options.
CS02	Shortlist	Which AI SOC products are best for a cloud-native startup running on a public cloud with no SIEM?
CS03	Shortlist	Which AI security analyst tools should a Series B SaaS company consider to handle alerts without hiring a SOC?
CS04	Shortlist	What are the best agentic SOC tools for a startup that runs entirely on SaaS apps, a cloud identity provider and one public cloud?
CS05	Vendor selection	Which AI SOC analyst product would you recommend for a startup preparing for SOC 2 with a two-person security team?
CS06	Vendor selection	Which AI alert triage tool should a fast-growing startup buy first to cover cloud and identity threats?
CS07	Requirements	Which AI SOC tools investigate cloud security alerts from the major public clouds automatically?
CS08	Requirements	Which AI triage tools send findings to our team chat and let me approve response actions from there?
CS09	Requirements	Which AI SOC products can be set up in a day without a dedicated SIEM engineer?
CS10	Requirements	Which AI tools investigate suspicious activity in SaaS apps and identity providers for a small company?
CS11	Requirements	Which AI SOC analyst tools have startup-friendly pricing or a free tier?
CS12	Requirements	Which AI security tools proactively hunt for signs of compromise in our cloud and SaaS logs, not just react to alerts?
CS13	Problem framing	How should a startup with one security engineer handle security alerts as it grows?
CS14	Problem framing	When does a startup need a SOC, and can AI fill that gap?

UK and EU buyer (CISO or SOC lead, European organisation)

ID	Stage	Question
EU01	Shortlist	We are a German manufacturer looking for an AI SOC analyst platform. Which vendors suit European companies? Compare options.
EU02	Shortlist	Which AI SOC products are best for a UK organisation that needs data kept in the UK or EU?
EU03	Shortlist	Which European AI SOC or agentic SOC vendors should an EU company consider for sovereignty reasons?
EU04	Shortlist	Which AI alert triage tools do European enterprises use, and how do they compare with US vendors?
EU05	Vendor selection	I am CISO at a French bank. Which AI SOC analyst product should we buy that fits DORA and EU data rules?
EU06	Vendor selection	Which AI SOC vendor would you recommend for a Dutch company that needs NIS2 incident reporting support?
EU07	Requirements	Which AI SOC tools host data in the EU and are compliant with GDPR?
EU08	Requirements	Which AI triage platforms help meet NIS2 and DORA incident reporting timelines?
EU09	Requirements	Which AI SOC analyst products can carry out response steps, such as blocking an IP or resetting credentials, across our existing tools?
EU10	Requirements	Which AI SOC tools run threat hunts automatically using new intelligence about attacks on European organisations?
EU11	Validation	How does the EU AI Act affect using AI agents in a security operations centre, and which vendors address it?
EU12	Requirements	Which AI security operations tools support investigation and reporting in languages other than English?
EU13	Problem framing	How are European companies using AI in their security operations centres?
EU14	Problem framing	What should a UK or EU organisation check before letting AI handle security alerts?

Appendix: 81 other vendors named

Filter vendors

Vendor	Table	ChatGPT r1 / r2	Gemini r1 / r2	Perplexity r1 / r2
AAQUILIX	Core	0 / 0	0 / 0	1 / 1
AgileBlue	Core	0 / 0	0 / 0	1 / 1
AgileBlue	Adjacent	0 / 0	0 / 0	1 / 0
Airbus	Adjacent	0 / 0	0 / 1	1 / 1
AirMDR	Adjacent	0 / 0	1 / 1	1 / 1
AISOC Synergy	Core	1 / 1	0 / 0	0 / 0
AISOC.cloud	Core	1 / 1	0 / 0	0 / 0
Amazon (AWS)	Adjacent	2 / 2	2 / 2	1 / 0
Andesite	Core	0 / 1	1 / 0	1 / 1
Anvilogic	Adjacent	1 / 0	0 / 1	3 / 1
AppOmni	Adjacent	0 / 0	0 / 0	1 / 0
Arcanna.ai	Core	0 / 1	0 / 0	1 / 1
Atricore	Core	1 / 1	0 / 0	1 / 1
Blumira	Adjacent	0 / 0	0 / 0	3 / 4
CardinalOps	Adjacent	0 / 0	0 / 0	1 / 1
Cisco (incl. Splunk)	Core	2 / 3	0 / 1	2 / 3
Command Zero	Core	2 / 2	2 / 1	0 / 0
Conifers.ai	Core	3 / 3	4 / 3	4 / 5
Coralogix	Core	0 / 0	0 / 0	2 / 1
Corelight	Core	0 / 0	0 / 0	1 / 1
Corelight	Adjacent	0 / 0	1 / 2	0 / 0
Crogl	Core	2 / 0	1 / 1	1 / 1
Cyberleaf	Adjacent	1 / 1	0 / 1	0 / 0
Cyble	Core	4 / 4	0 / 0	0 / 0
Darktrace	Core	1 / 0	0 / 0	0 / 0
Darktrace	Adjacent	1 / 0	0 / 0	2 / 2
Datadog	Adjacent	3 / 3	6 / 1	0 / 0
DeepTempo	Adjacent	1 / 0	0 / 0	0 / 0
Deepwatch	Adjacent	0 / 0	0 / 1	1 / 1
DXC Technology	Adjacent	1 / 0	0 / 0	2 / 2
Elastic	Core	1 / 2	1 / 0	2 / 2
Embed Security	Core	0 / 0	1 / 0	0 / 0
Exabeam	Core	0 / 1	0 / 0	0 / 0
Exabeam	Adjacent	0 / 0	1 / 2	3 / 3
Exeon Analytics	Adjacent	1 / 1	0 / 0	0 / 0
Expel	Adjacent	3 / 6	2 / 3	5 / 2
Fortinet	Adjacent	1 / 1	1 / 0	0 / 0
Guardz	Adjacent	0 / 1	0 / 0	1 / 2
HarfangLab	Adjacent	2 / 2	0 / 0	0 / 1
Helxon	Core	3 / 1	1 / 2	1 / 0
IBM	Adjacent	3 / 4	4 / 2	1 / 3
Intenax	Core	1 / 1	0 / 0	0 / 0
Legion Security	Core	0 / 0	0 / 0	1 / 1
ManySignal	Core	1 / 1	0 / 0	0 / 0
Mastercard (incl. Recorded Future)	Adjacent	0 / 1	0 / 0	0 / 0
MySoc.ai	Core	3 / 2	0 / 0	1 / 1
NFIR	Adjacent	1 / 0	0 / 0	1 / 1
niluxAI	Core	1 / 2	1 / 0	0 / 0
Nova AI	Core	1 / 0	0 / 0	0 / 0
Nudge Security	Adjacent	1 / 1	0 / 1	0 / 0
Obsidian Security	Adjacent	2 / 1	1 / 0	2 / 1
OMNI-SOC	Adjacent	1 / 1	0 / 1	0 / 0
Orange Cyberdefense	Adjacent	1 / 1	0 / 1	1 / 1
OrbitSOC	Core	1 / 1	0 / 0	0 / 0
Panther	Core	0 / 1	0 / 0	2 / 1
Qevlar AI	Core	4 / 1	1 / 1	3 / 3
Rapid7	Adjacent	2 / 0	1 / 1	1 / 1
Reco	Adjacent	1 / 0	1 / 1	2 / 1
Seceon	Adjacent	0 / 0	2 / 1	6 / 5
Securonix	Core	0 / 1	0 / 0	0 / 0
Securonix	Adjacent	1 / 1	2 / 3	3 / 3
SeraAI	Core	0 / 0	0 / 0	2 / 2
ServiceNow	Adjacent	4 / 2	1 / 2	2 / 2
SOC Prime	Adjacent	0 / 0	0 / 0	2 / 3
SOCFirst AI	Core	2 / 2	0 / 0	0 / 0
SOClogix	Adjacent	1 / 1	0 / 0	0 / 0
SocPilot	Core	1 / 2	0 / 0	0 / 0
SOCRadar	Adjacent	0 / 0	0 / 0	1 / 1
SocTalk	Core	1 / 0	0 / 0	1 / 1
Sophos (incl. Secureworks)	Adjacent	1 / 0	3 / 0	2 / 0
Spharaka	Core	1 / 0	0 / 1	3 / 3
Sumo Logic	Adjacent	1 / 1	0 / 0	1 / 1
Swimlane	Core	1 / 1	2 / 1	5 / 5
TEHTRIS	Adjacent	1 / 2	0 / 0	0 / 0
Todyl	Adjacent	0 / 0	0 / 0	1 / 0
Trellix	Core	0 / 0	0 / 0	1 / 1
Trellix	Adjacent	1 / 0	0 / 0	0 / 1
Vectra AI	Adjacent	2 / 0	3 / 2	3 / 5
Zoho (ManageEngine)	Adjacent	0 / 0	1 / 2	2 / 2
Zscaler	Core	1 / 0	0 / 0	1 / 1
Zscaler (incl. Red Canary)	Adjacent	0 / 3	0 / 2	2 / 1

FAQ

Where does my company rank?

Find it in Table 1 or Table 2 and use the row link to share its position. Then check the buyer-type and engine views, because a vendor's position often differs from one buyer type or engine to the next.

Why is my company missing?

It was named in fewer than 7 of the 112 questions in every engine run, or it was never named. Every vendor named at least once is in the appendix and the CSV with its exact figures.

How can a smaller vendor rank ahead of a larger one?

Because this measures how often AI engines name a vendor, not market share or deployments. A widely deployed product can be named rarely, and a smaller one can be named often. Both are accurate descriptions of what the engines said on the collection date.

Why do Microsoft, CrowdStrike and others appear in both tables?

Because the engines named them in both roles. Microsoft Security Copilot counts as core, and Microsoft Sentinel and Defender named on their own count as adjacent. Each table counts the company once per answer.

Why is Splunk not listed separately?

Splunk was owned by Cisco on the collection date, so its mentions count under Cisco, with the label shown. Where one answer named both, it counts once.

Why are buyer-type scores higher than overall scores?

A buyer-type score is out of 84 answers (14 questions, six engine runs), and those questions are written for that buyer, so the relevant vendors appear more often. Compare buyer-type scores with each other and overall scores with each other, but not across the two.

Data and Citation

Download the vendor data (CSV) and the 112 questions (CSV). Both are free to reuse under CC BY 4.0 with credit to Ranking Atlas. Suggested citation: Ranking Atlas, AI SOC Analyst Vendor Visibility Index, October 2026 edition. Corrections and methodology questions: contact@ranking-atlas.com.