Mate Security
Mate Security sells a security operations platform that describes itself as agentic and announced a Series A on 2026-07-28. It places eleventh of 14 at 4.87, tied with Prophet Security, because its public pages document none of the 25 containment actions. It publishes no time-to-contain figure, and is ahead of most platforms on approval design and the explanation trail.
11=of 14
Where Mate Security stands on this scorecard
Mate Security is 11th of 14, level with Prophet Security, at a total of 4.87. Its public pages document 0 of 25 containment actions, so its coverage score is 2.0 of 10. mate.security, read
On the seven criteria other than coverage, Mate Security scores 5.83. It is ahead of most platforms on approval design and the explanation trail, both read from its own platform page and both vendor claims. It is behind on time-to-contain evidence, integration depth, detection coupling and deployment detail. Coverage carries 25 percent of the total. With a coverage score of 2.0 the total is 4.87.
This is a finding about public material. Mate Security names no supported containment action for any tool on the pages read, so no cell counts. It is not a claim that Mate Security cannot take these actions, and a documented action list would move the score.
What Mate Security is
Mate describes its platform as AI agents that investigate alerts, hunt, tune detections and take response actions, using a graph of organisational context and structured procedures it calls Gamebooks (mate.security/about, read 2026-11-03, vendor claim). It calls the category Agentic Cyber Defense. That is the vendor's wording, not this site's judgement.
On customers, the home page (read 2026-11-03) lists Lead Bank and OCBC with named CISO testimonials. They are vendor claims about SOC investigation. The Lead Bank quote speaks of the agents maintaining exceptional accuracy, and the page says Mate automates the metadata and reporting regulators require. The OCBC quote speaks of automating investigations. Neither quote mentions containment, response time or an audit trail format. This site found no case study, press release or statement from either bank, and does not know scope, dates or contract terms. It does not say either bank uses Mate for containment, or that any regulator has accepted Mate's records.
vendor claim Agentic security operations platform. AI agents investigate alerts, hunt, write and tune detections and take response actions, using a graph of organisational context (the Security Context Graph) and structured investigation procedures (Gamebooks). Mate calls the category Agentic Cyber Defense. mate.security, read
Products named: Mate platform, Gamebooks, Agentic Threat Hunting, SOAR replacement.
Ownership. Series A announced 2026-07-28 with Insight Partners, Team8, Canaan Partners and M12. No acquisition, merger or rebrand found on the Mate newsroom or blog. vendor claim mate.security, read
Funding. A Series A of USD 35 million was announced on 2026-07-28, as headlined by Axios on Mate Security's newsroom (a press report; Mate's own pages state no amount). The earlier seed was USD 15.5 million, announced 2025-11-17. mate.security, read insightpartners.com, read
no figureon the pages read
Published time to contain
| Figure | Metric | Sample and who measured | Grade | Source |
|---|---|---|---|---|
| Merlin Entertainments reduced MTTR by 93 percent | time to respond or remediate | one customer, period and baseline not stated. Measured by vendor. Date: not stated. | C | vendor claim mate.security, read |
None of these is a time to contain, so the home table shows an open bar. Grades run A (independent, method published) to D (unverifiable). The evidence register explains each grade.
0 of 250 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Mate Security documents 0 as native or partner on the pages read: 0 native, 0 partner, 0 custom step only, 25 not documented. Coverage share is 0 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Mate Security0 of 25 documented | Mate Security: Isolate host, not documented | Mate Security: Release isolation, not documented | Mate Security: Kill process, not documented | Mate Security: Quarantine file, not documented | Mate Security: Run script or live response, not documented | Mate Security: Block hash, not documented | Mate Security: Disable user, not documented | Mate Security: Force password reset, not documented | Mate Security: Revoke sessions or tokens, not documented | Mate Security: Require MFA re-enrolment, not documented | Mate Security: Remove from group or role, not documented | Mate Security: Delete a delivered message, not documented | Mate Security: Quarantine a delivered message, not documented | Mate Security: Block sender or domain, not documented | Mate Security: Remove a URL rewrite exemption, not documented | Mate Security: Pull from quarantine, not documented | Mate Security: Disable IAM user or access key, not documented | Mate Security: Revoke cloud session, not documented | Mate Security: Isolate or stop an instance, not documented | Mate Security: Change a security group or firewall rule, not documented | Mate Security: Revoke OAuth app consent, not documented | Mate Security: Block IP or domain at the firewall, not documented | Mate Security: Block at the proxy or DNS filter, not documented | Mate Security: Disable a switch port or NAC quarantine, not documented | Mate Security: Add to a threat list on the NDR, not documented |
Basis: mate.security platform, gamebooks, replace-soar-with-ai pages, llms.txt and the blog posts on cloud incident response, incident response checklist and Gamebooks. The public site describes response with human approval, three autonomy tiers and CPR scoring, and names CrowdStrike, Microsoft Defender and Device42 only as collection sources. No integration documentation or action list is public. Read 2026-11-04.
Limits: No public action documentation, so every cell is not documented. This is a statement about public docs, not about the product.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
4.87rank 11 of 14
Rubric scores
Mate Security is in a band with Microsoft Sentinel (5.14), Dropzone AI (5.00), Prophet Security (4.87). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 2.0 | 0.500 | not documented. 0 of 25 containment actions documented as native or partner (0 percent) across 0 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 4.0 | 0.600 | not documented. No containment time published; the FAQ says simple cases resolve "in seconds, complex ones in minutes" with no method, and the 97 percent false-positive auto-closure figure has no denominator or period. vendor claim mate.security, read |
| Approval, rollback and blast-radius controls documented | 15 | 7.6 | 1.140 | partial. Platform page names Recommend only, Supervised ("Risky changes still ask") and Auto-run, scores each action on confidence, precision and reversibility, and returns a category to Supervised on drift; there is no per-action doc, rollback mechanics or scope term on the pages read. vendor claim mate.security, read |
| Explanation and audit trail | 15 | 7.0 | 1.050 | partial. Platform page says verdicts come with "the evidence trail your team can audit and tune", Decision Traces record why an analyst decided, and facts carry source, confidence and freshness; log format, export and retention are not described. vendor claim mate.security, read mate.security, read |
| Integration depth documented | 10 | 5.5 | 0.550 | partial. No integration count; pages name EDR, Microsoft and Google identity and mail, Slack, ticketing, cloud risk and email security as categories, and say connectors can be swapped without rebuilding a Gamebook. vendor claim mate.security, read |
| Detection-to-response coupling | 8 | 5.0 | 0.400 | partial. Pages say Mate starts in shadow mode on real alerts; which detection sources it takes directly, and whether a SIEM is needed, is not stated. mate.security, read |
| Pricing transparency | 6 | 5.5 | 0.330 | partial. No price on mate.security; a secondary read of an AWS Marketplace listing (not opened here) shows an Enterprise Tier at USD 150,000 per 12-month contract, read by that source on 2026-10-11. secondary source mate.security, read |
| Deployment and data handling | 6 | 5.0 | 0.300 | partial. Pages show HIPAA, SOC 2 and ISO badges and a Trust Center link; deployment model, data residency and retention are not described. vendor claim mate.security, read |
| Total | 100 | 4.87 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Mate Security is strong
- Vendor claim: the platform page names three modes, Recommend only, Supervised (risky changes still ask) and Auto-run. It scores each action on confidence, precision and reversibility, and returns a category to Supervised if accuracy drifts. mate.security, read
- Vendor claim: verdicts come with an evidence trail the team can audit and tune, Decision Traces record why an analyst decided, and stored facts carry source, confidence and freshness. Log format, export and retention are not described. mate.security, read
- Vendor claim: Mate starts in shadow mode on real alerts, and a custom Gamebook needs sign-off before it goes live. That is a rollout control a lead can test in a pilot. mate.security, read
Where Mate Security is behind
- Time-to-contain evidence: none. There is no figure and no method. The FAQ says simple cases resolve in seconds and complex ones in minutes. The 97 percent false-positive auto-closure figure has no denominator or period. A Mate llms.txt summary read on 2026-11-04 states a 93 percent MTTR reduction at Merlin Entertainments, one customer with no period or baseline, and the home page quote gives no number. mate.security, read
- No list of supported containment actions per tool and no integration count are published. The platform page and blog name revoking a session, isolating a host and blocking a URL or domain in prose only, so the scorecard has little to count. mate.security, read
- Deployment detail is thin. SOC 2, ISO and HIPAA badges are shown, but the Trust Center did not render without JavaScript, and data residency, retention and agent permissions are not described. mate.security, read
What only Mate Security has
Mate announced a Series A on 2026-07-28 with Insight Partners, Team8, Canaan Partners and M12; press headlines put it at 35M USD, after a 15.5M USD seed announced 2025-11-17. mate.security, read
1prices listed
Pricing as published
vendor claim No pricing page on mate.security. The only public price is an AWS Marketplace 12-month contract line of USD 150,000 for the Mate Enterprise Tier, with the usage unit undefined and private offers available. aws.amazon.com, read
| Item | Price | Source |
|---|---|---|
| Mate Enterprise Tier, 12-month contract on AWS Marketplace (one usage tier; the unit a tier measures is not defined on the listing; private offers via sales@mate.security) | USD 150,000 per 12 months | aws.amazon.com, read |
Integrations. No count published; named: CrowdStrike, Microsoft Defender, Device42, STACKIT (hosting), AWS Marketplace (procurement). vendor claim mate.security, read
17names on its pages
Named customers
Customers below are names on Mate Security's own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- Bridgewater Associates, Lead Bank, Fitch Group, AlphaSense, OCBC, Merlin Entertainments, monday.com, Freshworks, Demandbase, Applied Systems, Anaplan, Bright Data, Koan, Playtika, Water-IT, Unidentified logo (image alt text reads 'disount logo'; page does not name the company). mate.security, read
- Unnamed Fortune 500 enterprise (711 SOAR playbooks migrated to 10 Gamebooks). mate.security, read
Lead Bank and OCBC are listed on Mate Security's home page with named CISO testimonials, read 2026-11-03, and these are vendor claims. The quotes concern SOC investigation. Neither mentions containment, response time or an audit trail format. No case study, press release or statement from either bank was found, so scope, dates and contract terms are unknown. vendor claim mate.security, read
8dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2026-11-03 | Blue City benchmark published on Mate Labs. Simulated-enterprise benchmark for AI defenders; five out-of-the-box agents compared; Mate system not attached. | vendor claim mate.security, read |
| 2026-10 | CPR framework (Confidence, Precision, Reversibility) described as the gate for autonomous actions. Blog post 2026-10-18 and platform page; webinar 2026-11-17. | vendor claim mate.security, read |
| 2026-08-26 | Gamebooks launched. Structured investigation procedures; SOAR playbook migration into Gamebooks. SiliconANGLE coverage 2026-08-26 per newsroom; Mate blog post 2026-08-27. | vendor claim mate.security, read |
| 2026-07-28 | Series A. See facts funding_series_a. | vendor claim mate.security, read |
| 2026-05-18 | Continuous Detection / Continuous Response (CD/CR) framework published. Detection, investigation and response on one reasoning plane; investigations compress into detections. | vendor claim mate.security, read |
| 2026-02-19 | Security Context Graph introduced. Graph of 'memories' that agents traverse during investigations. | vendor claim mate.security, read |
| 2026-01-15 | Listed on AWS Marketplace. Subscribe through existing AWS accounts; counts toward AWS commitments. | vendor claim mate.security, read |
| 2026-01-05 | Selected for CrowdStrike, AWS and NVIDIA startup accelerator. Eight-week program ending 2026-03-03. | vendor claim mate.security, read |
13graded
Claims Mate Security makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| 98.7 percent accuracy with Mate on 7,200 alerts | 7,200 alerts (stated in chart caption). Measured by vendor. | C | vendor claim mate.security, read |
| 97 percent false-positive auto-closure | not stated. Measured by vendor. | C | vendor claim mate.security, read |
| 6.1x investigation coverage | not stated. Measured by vendor. | C | vendor claim mate.security, read |
| Frontier models alone reach 69 percent (Gemini 3.8 Flash), 51 percent (GPT-6.1 Sol, subset), 72 percent (Claude Opus 5.5) and 71 percent (Claude Sonnet 5.5) on 7,200 alerts; Mate reaches 98.7 percent | 7,200 alerts; GPT-6.1 Sol on a subset (size not stated). Measured by vendor. | C | vendor claim mate.security, read |
| In testing on real customer cases, generic AI was right about 60 percent of the time; with Mate's context about 97 percent | not stated ('real customer cases'). Measured by vendor. | C | vendor claim mate.security, read |
| 6x more alerts investigated at a Fortune 500 customer | one unnamed Fortune 500 customer. Measured by vendor. | C | vendor claim mate.security, read |
| 80 percent of false positives closed automatically at a Fortune 500 customer | one unnamed Fortune 500 customer. Measured by vendor. | C | vendor claim mate.security, read |
| Mate agents close up to 85 percent of false positives | not stated. Measured by vendor. | C | vendor claim mate.security, read |
| Investigations that took 45 minutes take 45 seconds | not stated. Measured by vendor. | C | vendor claim mate.security, read |
| 711 SOAR playbooks migrated to 10 Gamebooks at a Fortune 500 company; migration expected to take 9 months, took 3 weeks | one unnamed Fortune 500 company. Measured by customer. | C | vendor claim mate.security, read |
| Blue City benchmark: five out-of-the-box defenders (three Codex, two Claude Code setups) over 32 scored incidents each; effectiveness 40.2 to 80.1 percent, cost about 0.45 to 4.05 USD per incident | 32 scored incidents per defender, 8 scenario families run as twin pairs, synthetic enterprise. Measured by vendor. | B | vendor claim mate.security, read |
| Nearly 100 percent of investigations moved into Mate at AlphaSense, with a measurable drop in TTA and TTR | one customer, as quoted. Measured by customer. | C | vendor claim mate.security, read |
| Winning nearly 100 percent of the POVs and bake-offs entered; growing ARR by triple digits | not stated. Measured by vendor. | C | vendor claim mate.security, read |
Who should shortlist Mate Security
- Your first need is investigation quality and an approval design you can read, and you will test containment in a pilot rather than from public pages.
- You want a shadow-mode start on live alerts before any action runs.
- You run an MSSP and want a platform that its operator, Water-IT, says lets analysts serve any customer stack (vendor claim).
Mate Security places 11th of 14, level with Prophet Security at a total of 4.87, with 0 of 25 containment actions documented. Mate is ahead of most platforms on approval design and the explanation trail, both read from its own platform page and both vendor claims. It publishes no per-tool action list, so the scorecard counts none of the 25 actions, which sets the ceiling on what it can score. A published action list would move its place.
The same platform under other weights
- Regulated financial: 7th of 14, total 5.38.
- Lean team: 11th of 14, total 4.76.
- MSSP: 12th of 14, total 4.84.
- Microsoft estate: 12th of 14, total 4.83.
- CrowdStrike estate: 12th of 14, total 4.73.
Compare Mate Security
- Mate Security alternatives: 3 gaps and 5 platforms that answer them.
- Mate Security against Prophet Security, totals 4.87 and 4.87.
- Mate Security against Dropzone AI, totals 4.87 and 5.00.
- Mate Security against Microsoft Sentinel, totals 4.87 and 5.14.
- Mate Security against ServiceNow Security Operations, totals 4.87 and 4.16.
Facts on this page were read 2026-11-04 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.