Dropzone AI
Dropzone AI sells a SOC platform that describes itself as agentic, with three agents for alert investigation, threat hunting and threat intelligence, and says analysts own every verdict. It places tenth of 14 at 5.00, with 2 of 25 containment actions documented. Its pages describe investigation, not containment, and publish no price.
What Dropzone AI is
Dropzone describes three agents: an AI SOC Analyst for alert investigation, an AI Threat Hunter and an AI Threat Intel Analyst. Humans set scope, system access and authorization (dropzone.ai/blog/announcing-the-agentic-soc, read 2026-11-03, vendor claim).
The home page says it investigates every alert end to end and shows its work, and that analysts keep final authority over every verdict (dropzone.ai, read 2026-11-03, vendor claim). Containment is not described on the pages read, so a buyer should ask how a response leaves the product and where it runs.
vendor claim Agentic SOC platform. AI agents investigate every alert, hunt for threats and apply new threat intelligence, connecting to a team's existing security tools. Analysts keep final decision-making authority over every verdict. dropzone.ai, read
Products named: AI SOC Analyst, AI Threat Hunter, AI Threat Intel Analyst.
no figureon the pages read
Published time to contain
| Figure | Metric | Sample and who measured | Grade | Source |
|---|---|---|---|---|
| 5x faster response, Indiana Farm Bureau Insurance | time to respond or remediate | one customer, baseline not stated. Measured by vendor. Date: not stated. | C | vendor claim dropzone.ai, read |
None of these is a time to contain, so the home table shows an open bar. Grades run A (independent, method published) to D (unverifiable). The evidence register explains each grade.
2 of 251 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Dropzone AI documents 2 as native or partner on the pages read: 2 native, 0 partner, 0 custom step only, 23 not documented. Coverage share is 8 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Dropzone AI2 of 25 documented | Dropzone AI: Isolate host, not documented | Dropzone AI: Release isolation, not documented | Dropzone AI: Kill process, not documented | Dropzone AI: Quarantine file, not documented | Dropzone AI: Run script or live response, not documented | Dropzone AI: Block hash, not documented | Dropzone AI: Force password reset, not documented | Dropzone AI: Require MFA re-enrolment, not documented | Dropzone AI: Remove from group or role, not documented | Dropzone AI: Delete a delivered message, not documented | Dropzone AI: Quarantine a delivered message, not documented | Dropzone AI: Block sender or domain, not documented | Dropzone AI: Remove a URL rewrite exemption, not documented | Dropzone AI: Pull from quarantine, not documented | Dropzone AI: Disable IAM user or access key, not documented | Dropzone AI: Revoke cloud session, not documented | Dropzone AI: Isolate or stop an instance, not documented | Dropzone AI: Change a security group or firewall rule, not documented | Dropzone AI: Revoke OAuth app consent, not documented | Dropzone AI: Block IP or domain at the firewall, not documented | Dropzone AI: Block at the proxy or DNS filter, not documented | Dropzone AI: Disable a switch port or NAC quarantine, not documented | Dropzone AI: Add to a threat list on the NDR, not documented | ||
Basis: Dropzone documentation (Remediator integrations and Response Actions pages). Remediators exist for CrowdStrike, Google Workspace, Microsoft 365 and Defender, and Okta; only the Google Workspace page names actions in text. Response Actions run customer-written Python 3.11 on investigation triggers, which is a generic script step. Read 2026-11-04.
Limits: Containment action lists for CrowdStrike, Okta and Microsoft 365 are in screenshots, not text.
Note: Response Actions page: customer-written Python runs on over 50 triggers (generic script step). No specific containment script is shown, so no cell is marked custom.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
5.00rank 10 of 14
Rubric scores
Dropzone AI is in a band with Microsoft Sentinel (5.14), Prophet Security (4.87), Mate Security (4.87). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 2.6 | 0.650 | not documented. 2 of 25 containment actions documented as native or partner (8 percent) across 1 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 5.0 | 0.750 | partial. Customer examples only: "5x faster response" (Indiana Farm Bureau Insurance), "85% less manual investigation" (Zapier); no measurement method and no containment time. vendor claim dropzone.ai, read |
| Approval, rollback and blast-radius controls documented | 15 | 5.5 | 0.825 | partial. Page says "Your analysts own every verdict"; no approval tiers, rollback or scope limits for actions, and containment itself is not described. vendor claim dropzone.ai, read |
| Explanation and audit trail | 15 | 7.0 | 1.050 | partial. Page says it "investigates every alert end to end and shows its work"; report format, export and retention not stated. vendor claim dropzone.ai, read |
| Integration depth documented | 10 | 6.5 | 0.650 | partial. Page states "100+ integrations" and "No normalization"; no action list. vendor claim dropzone.ai, read |
| Detection-to-response coupling | 8 | 7.0 | 0.560 | partial. Page says it connects to the security tools a team already uses; which detection sources it takes directly is not stated. dropzone.ai, read |
| Pricing transparency | 6 | 3.0 | 0.180 | not documented. No price on the page; a pricing page is linked. dropzone.ai, read |
| Deployment and data handling | 6 | 5.5 | 0.330 | partial. Page says "No data migration"; an EU data residency page is linked and was not read. vendor claim dropzone.ai, read |
| Total | 100 | 5.00 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Dropzone AI is strong
- Vendor claim: the page says analysts own every verdict and that the agent investigates every alert end to end and shows its work. The report format, export and retention are not stated. dropzone.ai, read
- Vendor claim: the integrations page names Splunk, CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Okta, Wiz and Google Security Operations among its sources. The page shows a Load more control, so the list is partial. dropzone.ai, read
- Vendor claim: humans set scope, system access and authorization for the three agents, which is a written statement of who controls what the agents can touch. dropzone.ai, read
Where Dropzone AI is behind
- Time-to-contain evidence: customer testimonials only. Indiana Farm Bureau Insurance reports 5x faster response, but the response metric is not defined, and no containment time or method is given. dropzone.ai, read
- Containment itself is not described on the home page, and no approval tiers, rollback or scope limits for actions are stated. The page speaks of verdicts, not actions, and the scorecard's read of its documentation finds only a few actions, in identity. dropzone.ai, read
- No price is published and no free trial is stated. Enterprise is sized on employees, and MSSP and Federal plans are built per agent and per capacity level, each behind a Request pricing call to action. dropzone.ai, read
What only Dropzone AI has
Dropzone's integrations page lists D3 Security and Palo Alto Cortex XSOAR among its tools and marks ExtraHop as coming soon, so it can sit in front of an existing SOAR. dropzone.ai, read
nonelisted
Pricing as published
vendor claim Not published. Enterprise is sized on employees. MSSP and Federal are built per agent and per capacity level. Every plan uses a Request pricing call to action. dropzone.ai, read
Trial or free tier. No free trial stated. The page offers a self-guided demo and a demo request. A proof-of-concept FAQ exists but its answer was not in the fetched text. dropzone.ai, read
Integrations. 90 published as a count; named: Splunk, CrowdStrike Falcon, Microsoft Defender Endpoint, SentinelOne, Palo Alto Networks Cortex XSOAR, Google Security Operations, Okta, Wiz, Amazon GuardDuty, Microsoft Azure, Azure Data Explorer, Cribl, Databricks, Datadog. vendor claim dropzone.ai, read
6names on its pages
Named customers
Customers below are names on Dropzone AI's own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- ECS, Assala Energy. dropzone.ai, read
- Zapier, Indiana Farm Bureau Insurance, CBTS, UiPath. dropzone.ai, read
1dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2026-01-15 | Dropzone AI Closes 2025 with 11x ARR Growth, Fortune Cyber 60 Recognition, and $37M Series B. Series B announcement. The Business Wire page returned HTTP 403, so the date comes from the release URL and the title from a search result. | vendor claim businesswire.com, read |
7graded
Claims Dropzone AI makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| ECS automates 70 percent of alerts without adding headcount | not stated. Measured by customer. | C | vendor claim dropzone.ai, read |
| Zapier reports 85 percent less manual investigation | not stated. Measured by customer. | C | vendor claim dropzone.ai, read |
| Indiana Farm Bureau Insurance reports 5x faster response | not stated. Measured by customer. | C | vendor claim dropzone.ai, read |
| Assala Energy: 100 percent of alerts investigated, 70 percent fewer false positives | not stated. Measured by customer. | C | vendor claim dropzone.ai, read |
| AI Threat Hunter compresses up to 40 hours of analyst hunt work into about one hour | not stated. Measured by vendor. | C | vendor claim dropzone.ai, read |
| Net Promoter Score of 66 against an industry average of 33 to 40 | not stated. Measured by vendor. | C | vendor claim dropzone.ai, read |
| 4x more investigations per analyst | not stated. Measured by vendor. | C | vendor claim dropzone.ai, read |
Who should shortlist Dropzone AI
- Your analysts already work in a SOAR or case tool and you want investigation quality first, with response left in your existing stack.
- You want hunting and threat-intelligence agents sold beside the alert investigator.
- You can accept analyst sign-off on every verdict as the control model.
Dropzone AI places 10th of 14 at a total of 5.00, with 2 of 25 containment actions documented. Shortlist it for investigation, not for documented containment: the scorecard counts 2 of 25 actions, and the pages describe analyst-owned verdicts rather than response steps. It is in a band with Microsoft Sentinel, Prophet Security and Mate Security on the total, and the order inside a band is not settled by the evidence.
The same platform under other weights
- Regulated financial: 10th of 14, total 5.30.
- Lean team: 10th of 14, total 4.77.
- MSSP: 11th of 14, total 4.89.
- Microsoft estate: 10th of 14, total 4.95.
- CrowdStrike estate: 10th of 14, total 4.89.
Compare Dropzone AI
- Dropzone AI alternatives: 3 gaps and 5 platforms that answer them.
- Dropzone AI against Prophet Security, totals 5.00 and 4.87.
- Dropzone AI against Mate Security, totals 5.00 and 4.87.
- Dropzone AI against Microsoft Sentinel, totals 5.00 and 5.14.
- Dropzone AI against Tines, totals 5.00 and 5.62.
Facts on this page were read 2026-11-04 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.