Picking an AI SOC provider used to mean comparing features, integrations, funding, and how much of the analyst workflow a product claimed to automate.
This approach tells buyers less than it used to, now that established security vendors are all announcing named agentic capabilities. CrowdStrike has Charlotte AI AgentWorks, Microsoft has expanded Security Copilot with security agents, and Palo Alto Networks has continued adding agentic capabilities across Cortex and its wider security portfolio.
When most vendors can point to agents and long integration lists, neither tells you much about how the product will handle an investigation. A better place to look is what happens when the platform receives an alert for which nobody has already built a workflow.
The Playbook Is a Better Test Than the Feature List
Most provider comparisons rely on information that is easy to collect: funding, integration counts, feature breadth, and published product capabilities. Those are also the numbers vendors have the most control over. They don’t tell you whether the SOC still needs somebody to build and maintain the investigative workflow.
A buyer can end up paying for “agentic AI” only to discover that somebody still has to build and maintain the workflows behind it.
SOAR automation works by executing logic written in advance. Someone had to decide which steps an investigation should take, encode the branches, and keep that logic working as tools, schemas, and detections changed.
AI can reduce the work involved. Natural-language tools can write playbooks, agent builders can make workflows easier to create, and AI can make decisions inside an existing workflow. None of that necessarily removes the workflow itself.
A different model plans the investigation when the alert arrives. Prophet Security’s AI SOC Analyst is one example. It plans the questions to ask, gathers evidence from the security stack, and uses each finding to decide where the investigation goes next. The investigation does not have to be mapped in advance.
Can It Handle an Alert Nobody Planned For?
A platform that can investigate a new alert type without waiting for somebody to write the workflow has started to displace the role SOAR played in the investigation. That SOAR-displacement capacity is a more useful way to compare AI SOC platforms.
If a person still has to define or maintain the workflow, AI may have made the existing automation easier to operate, but the underlying dependency remains. Deterministic workflows still work well for predictable actions. For an AI SOC evaluation, find out how much investigative logic somebody has to write before the automation works.
Ask where the investigative path comes from: does a person define it in advance, or does the platform work it out as evidence comes in? Then find out what workflows the team still has to maintain after deployment.
The test that reveals more is to give the platform an alert type with no pre-built workflow and see whether it can investigate without somebody mapping the steps first.
How Providers Handle the Playbook Question
Palo Alto Networks uses AgentiX to bring AI reasoning into the Cortex automation environment, including existing playbooks. AI can make decisions within those workflows, but the playbook remains part of the automation model.
With CrowdStrike, Charlotte AI AgentWorks gives security teams a no-code way to create agents. The analyst defines the agent’s mission and the actions it is authorized to take. That makes automation easier to build, but a person is still responsible for defining what the agent is there to do.
Microsoft offers an especially direct example of AI-assisted workflow creation. Sentinel’s Playbook Generator turns natural-language instructions into automation workflows. It reduces the work of creating a playbook without removing the playbook from the process.
After an investigation, SentinelOne can use Purple AI to propose Hyperautomation workflows for similar cases. Teams can capture what worked and reuse it when the same type of work comes up again. The result is still a stored workflow for future automation.
Intezer puts autonomous investigation ahead of the response workflow. Its AI handles the investigation and decision-making, while defined response actions can still be passed downstream to SOAR.
Prophet Security answers the playbook question by letting you add your own playbooks or take the playbook out of the investigation entirely. Its AI SOC Analyst plans each investigation as the alert arrives, choosing the next query from what the previous one returned, so an alert type nobody anticipated does not wait for a workflow to be authored. Response actions can be automated or include a human-in-the-loop gate.
Stellar Cyber has added agentic AI to its Open XDR platform, including automated triage before an alert reaches an analyst. It describes the model as human-augmented, with AI handling investigative work while analysts remain part of the process.
Exaforce was built around an AI-native architecture rather than adding AI to an existing SOAR product. Its investigation engine combines semantic data models, behavioral analytics, and LLMs to reason over security evidence rather than relying only on a predefined investigative sequence.
The playbook question is explicit in 7AI‘s positioning. Its agents are designed to reason through alerts without requiring a pre-existing rule or workflow to map the investigative path first.
Natural language is also central to Anvilogic. Analysts can use Blueprints to author automation without writing code, making workflows faster to create while keeping the analyst involved in defining them.
Give the Vendor Something It Hasn’t Seen Before
You do not need another integration spreadsheet to find out how much of the investigation the platform can handle itself.
Ask the vendor to investigate an alert type for which there is no pre-built workflow. Don’t let anyone prepare a playbook first. Watch what happens when the alert lands.
See whether somebody has to define the steps before the platform can proceed. If it can start investigating on its own, watch how it decides what to check, whether it changes course as evidence comes in, and how it reaches the verdict.
—
Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications. She is also a regular writer at Bora.
