D3 Security
D3 Security sells Morpheus, an AI security operations platform with a deterministic playbook engine and four autonomy modes. It places first of 14 at 7.08, nearly a point above the next platform, on 19 of 25 documented containment actions, approval gates and a command-level audit record. It publishes no time-to-contain figure with a method.
What D3 Security is
Morpheus is D3 Security's platform for triaging and investigating alerts and running responses. By the vendor's own description (d3security.com, read 2026-11-03) it traces each alert across identities, endpoints, cloud and email, then recommends or runs a response. It keeps a deterministic playbook engine and case management from the older SOAR lineage.
The company says Morpheus was built from scratch over 24 months and has been generally available since August 2025 (d3security.com/company/staying-power, read 2026-11-03, vendor claim). The autonomy setting runs from Deterministic through AI-Assisted and AI-Led to Autonomous. A buyer chooses how much the AI decides, per the vendor.
vendor claim Morpheus is an AI security operations platform. It triages and investigates alerts, traces each alert across identities, endpoints, cloud and email, and recommends or runs responses. It keeps a deterministic playbook engine and case management, and it has an autonomy setting from fully deterministic to autonomous. d3security.com, read
Products named: Morpheus, Morpheus integrations marketplace.
Ownership. Company describes itself as employee-owned with no outside investors setting its roadmap. One search for acquisition or rebrand news found none. Results were mostly D3's own pages. vendor claim d3security.com, read
4 to 8 mingrade C
Published time to contain
| Figure | Metric | Sample and who measured | Grade | Source |
|---|---|---|---|---|
| Containment time of 4 to 8 minutes once the response plan is approved | time to contain | not published. Measured by vendor. Date: not stated. | C | vendor claim d3security.com, read |
| Up to 95 percent of alerts triaged and L2-investigated in under two minutes | adjacent measure | not published. Measured by vendor. Date: not stated. | C | vendor claim d3security.com, read |
D3 Security's figure reaches grade C: a vendor number with no sample, so it is not comparable with a number measured another way. The guide to vendor response-time numbers lists the questions to ask.
19 of 255 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, D3 Security documents 19 as native or partner on the pages read: 19 native, 0 partner, 0 custom step only, 6 not documented. Coverage share is 76 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| D3 Security19 of 25 documented | D3 Security: Require MFA re-enrolment, not documented | D3 Security: Quarantine a delivered message, not documented | D3 Security: Remove a URL rewrite exemption, not documented | D3 Security: Disable IAM user or access key, not documented | D3 Security: Revoke cloud session, not documented | D3 Security: Add to a threat list on the NDR, not documented | |||||||||||||||||||
Basis: Command and permission tables on docs.d3security.com integration pages (Morpheus). D3 states its integrations are built and maintained by D3, read as native. Pages carry 'last updated' dates from 2025 for several integrations. Read 2026-11-04.
Limits: Per-integration pages are long; the action names were extracted from command tables and permission tables.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
7.08rank 1 of 14
Rubric scores
D3 Security sits alone in its band: no other platform is within 0.25 of its total.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 7.7 | 1.925 | documented. 19 of 25 containment actions documented as native or partner (76 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 4.0 | 0.600 | not documented. No time-to-contain figure; the only timing claim is that a broken integration is repaired "typically inside 18 minutes", which is integration repair, not incident response. vendor claim d3security.com, read |
| Approval, rollback and blast-radius controls documented | 15 | 8.0 | 1.200 | documented. Page states "Built-in approval gates at every command-risk tier" and configurable gates for autonomous modes; rollback and blast-radius controls are not stated. vendor claim d3security.com, read |
| Explanation and audit trail | 15 | 8.5 | 1.275 | documented. Page describes an audit record "Immutable, timestamped, attributed at the command level" covering playbook steps, analyst approvals, integration calls and outcomes, with "regulator-ready" exports. vendor claim d3security.com, read |
| Integration depth documented | 10 | 8.5 | 0.850 | documented. Page states "800+ connectors" and names Splunk, Sentinel, CrowdStrike, SentinelOne, Okta, Zscaler and Fortinet; action-level list not read. vendor claim d3security.com, read |
| Detection-to-response coupling | 8 | 6.0 | 0.480 | partial. Describes SIEM, EDR and XDR integrations and a SIEM alert triage use case; does not say whether Morpheus ingests detections without a SIEM. d3security.com, read |
| Pricing transparency | 6 | 3.5 | 0.210 | not documented. No prices; page says the agreement is structured on alert volume, deployment model and autonomy modes. d3security.com, read |
| Deployment and data handling | 6 | 9.0 | 0.540 | documented. Page states Azure cloud with residency in the United States, Canada, Ireland or Japan, and a fully isolated on-premises option keeping LLM inference in the customer environment. vendor claim d3security.com, read |
| Total | 100 | 7.08 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where D3 Security is strong
- Vendor claim: the platform page lists built-in approval gates at every command-risk tier, with gates that can be configured for the autonomous modes. The wording names a gate per risk tier, which is the level of detail the rubric asks for. d3security.com, read
- Vendor claim: the audit record is described as immutable, timestamped and attributed at the command level, covering playbook steps, analyst approvals, integration calls and outcomes. The page also says the record exports in a form suited to regulators. d3security.com, read
- Vendor claim: Morpheus runs on Azure with data residency in the United States, Canada, Ireland or Japan, and offers a fully isolated on-premises option that keeps LLM inference in the customer environment. d3security.com, read
Where D3 Security is behind
- Time-to-contain evidence: a figure without a method. The remediation page claims containment in 4 to 8 minutes once the response plan is approved, with no sample, period or measurer, and the figure leaves out analyst review time before approval. A separate claim, an integration repaired typically inside 18 minutes, measures connector repair, not an incident. d3security.com, read
- The platform page states approval gates but no rollback and no blast-radius control. A reader cannot tell from public pages how a wrong isolation or account disablement is undone. d3security.com, read
- The page describes SIEM, EDR and XDR integrations and a SIEM alert triage use case. It does not say whether Morpheus ingests detections without a SIEM in front. d3security.com, read
What only D3 Security has
D3 names Cortex XSOAR, Splunk SOAR, Swimlane, Torq and Tines in a free migration program for customers leaving those SOAR products, per its pricing page. d3security.com, read
nonelisted
Pricing as published
vendor claim Fixed annual subscription by daily alert volume tier (500 to 10,000 alerts per day, custom above). Named-user licences at a per-user annual rate. Flat per-alert rate for volume above the tier. Threat Hunting module licensed with the Morpheus tier. AI token costs stated as included. d3security.com, read
Trial or free tier. No Morpheus trial found on the pricing page. It offers a Start My Free Cost Review and a free migration program for customers leaving legacy SOAR products. d3security.com, read
Integrations. 800 published as a count; named: Splunk, Microsoft Sentinel, QRadar, Chronicle, CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black, VirusTotal, MISP, Recorded Future, Mandiant, Okta, CyberArk. vendor claim d3security.com, read
7names on its pages
Named customers
Customers below are names on D3 Security's own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- PwC, Scotia Bank, S&P Global, Cummins. d3security.com, read
- Disney, London Stock Exchange Group, Government of Ontario. d3security.com, read
1dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2026-11 | Planned target for Morpheus Threat Hunting module (early access open to existing customers). Module not yet released as of 2026-11-03. Date is a planned target. | vendor claim d3security.com, read |
7graded
Claims D3 Security makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| Up to 95 percent of alerts reach a graded verdict or L2-depth investigation in under two minutes | Not stated. Measured by vendor. | C | vendor claim d3security.com, read |
| 98 percent production triage accuracy | Not stated. Measured by vendor. | C | vendor claim d3security.com, read |
| Drift repair at 18-minute MTTR, against 4 to 6 weeks for manual repair | Not stated. Measured by vendor. | C | vendor claim d3security.com, read |
| About 90 seconds end to end on a typical alert through the five-stage pipeline | Not stated. Measured by vendor. | C | vendor claim d3security.com, read |
| Reduced 145,000 alerts to 200 needing human review for one MSSP customer, a reduction of over 99 percent | One MSSP customer, unnamed. Measured by customer. | C | vendor claim d3security.com, read |
| Self-healing integrations: 70 percent fewer integration escalations within 90 days, 3.2 times faster repair, 800 analyst hours recovered a year in a 10-person SOC | Not stated. Measured by vendor. | C | vendor claim d3security.com, read |
| Morpheus found root cause in all three attack scenarios; a Microsoft Copilot run found none | Three scenarios, not described. Measured by vendor. | D | vendor claim d3security.com, read |
Who should shortlist D3 Security
- You must show a reviewer an approval gate per command-risk tier and a command-level audit record before you buy.
- You need a data-residency choice or an on-premises option that keeps model inference inside your environment.
- You are leaving Cortex XSOAR, Splunk SOAR, Swimlane, Torq or Tines and want a vendor with a named migration program.
D3 Security places 1st of 14 at a total of 7.08, with 19 of 25 containment actions documented. The highest total on the rubric, nearly a point above the next platform, built on 19 of 25 documented containment actions, approval gates and a command-level audit record. Coverage carries 25 percent of the total. The gap to close is a published time to contain with a method.
The same platform under other weights
- Regulated financial: 1st of 14, total 7.51.
- Lean team: 1st of 14, total 6.73.
- MSSP: 1st of 14, total 7.21.
- Microsoft estate: 1st of 14, total 6.91.
- CrowdStrike estate: 1st of 14, total 7.01.
Compare D3 Security
- D3 Security alternatives: 3 gaps and 5 platforms that answer them.
- D3 Security against Cyware, totals 7.08 and 6.11.
- D3 Security against Google Security Operations, totals 7.08 and 6.09.
- D3 Security against Palo Alto Cortex XSOAR, totals 7.08 and 5.91.
- D3 Security against Swimlane (Turbine), totals 7.08 and 5.84.
Facts on this page were read 2026-11-04 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.