CrowdStrike estate: the rubric reweighted

A team that runs CrowdStrike Falcon for endpoint and identity, and wants containment actions to run against Falcon, with other tools as secondary.

7.01D3 Security leads

The ranking

Totals recomputed in code from the weights below. Rank on the base rubric in the last column.
Rank	Platform	Total	Actions of 25	Base rank
1	D3 Security	7.01	19	1
2	Google Security Operations	6.37	19	3
3	Cyware	6.18	17	2
4	Swimlane (Turbine)	5.95	18	5
5	Tines	5.91	22	8
6	Splunk SOAR (Cisco)	5.89	19	6
7	Palo Alto Cortex XSOAR	5.78	20	4
8	Torq	5.59	13	7
9	Microsoft Sentinel	5.30	9	9
10	Dropzone AI	4.89	2	10
11	Prophet Security	4.78	0	11
12	Mate Security	4.73	0	11
13	ServiceNow Security Operations	4.06	7	13
14	CrowdStrike Falcon Fusion SOAR	3.64	0	14

A band is a run of neighbouring totals, not a ladder. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order. Band groups under these weights: Google Security Operations, Cyware, Swimlane (Turbine), Tines, Splunk SOAR (Cisco), Palo Alto Cortex XSOAR, Torq; Dropzone AI, Prophet Security, Mate Security.

Why these weights

This weighting is this site's own proposal, as rubric.json proposes reweights for three buyer types only. Coverage rises to 28, because the pages read for CrowdStrike's own SOAR name no host containment action and a buyer in this estate must see which platforms document Falcon actions. Detection coupling is 15, and integration count falls to 8. Time-to-contain evidence is 10, since almost no vendor publishes a method, so it separates few platforms. The totals are recomputed in code, with a band wherever neighbouring totals are no more than 0.25 apart. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.

100points in total

Weights against the base rubric

Criterion	Base weight	CrowdStrike estate weight
Native containment coverage	25	28
Published time-to-contain evidence with method	15	10
Approval, rollback and blast-radius controls documented	15	15
Explanation and audit trail	15	10
Integration depth documented	10	8
Detection-to-response coupling	8	15
Pricing transparency	6	8
Deployment and data handling	6	6
Total	100	100

The scores are the same as on the home table. Only the weights move. How scores are set.