Lean team: the rubric reweighted
A security team of one to five people with no engineer to build and maintain playbooks, who needs the platform to work from published pricing and direct detection sources.
6.73D3 Security leads
The ranking
| Rank | Platform | Total | Actions of 25 | Base rank |
|---|---|---|---|---|
| 1 | D3 Security | 6.73 | 19 | 1 |
| 2 | Google Security Operations | 5.97 | 19 | 3 |
| 3 | Cyware | 5.94 | 17 | 2 |
| 4 | Splunk SOAR (Cisco) | 5.84 | 19 | 6 |
| 5 | Palo Alto Cortex XSOAR | 5.72 | 20 | 4 |
| 6 | Swimlane (Turbine) | 5.69 | 18 | 5 |
| 7 | Tines | 5.69 | 22 | 8 |
| 8 | Torq | 5.43 | 13 | 7 |
| 9 | Microsoft Sentinel | 5.05 | 9 | 9 |
| 10 | Dropzone AI | 4.77 | 2 | 10 |
| 11 | Mate Security | 4.76 | 0 | 11 |
| 12 | Prophet Security | 4.73 | 0 | 11 |
| 13 | ServiceNow Security Operations | 4.00 | 7 | 13 |
| 14 | CrowdStrike Falcon Fusion SOAR | 3.52 | 0 | 14 |
A band is a run of neighbouring totals, not a ladder. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order. Band groups under these weights: Google Security Operations, Cyware, Splunk SOAR (Cisco), Palo Alto Cortex XSOAR, Swimlane (Turbine), Tines; Dropzone AI, Mate Security, Prophet Security.
Why these weights
Coverage stays at 25 and time-to-contain evidence at 15. Pricing transparency doubles to 12 because a small team cannot spend weeks on sales calls, and detection-to-response coupling rises to 10 because a lean team often has no SIEM to put in front. The audit weight falls to 8. These are the reweights proposed in rubric.json, recomputed in code, with a band wherever neighbouring totals are no more than 0.25 apart. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
100points in total
Weights against the base rubric
| Criterion | Base weight | Lean team weight |
|---|---|---|
| Native containment coverage | 25 | 25 |
| Published time-to-contain evidence with method | 15 | 15 |
| Approval, rollback and blast-radius controls documented | 15 | 15 |
| Explanation and audit trail | 15 | 8 |
| Integration depth documented | 10 | 10 |
| Detection-to-response coupling | 8 | 10 |
| Pricing transparency | 6 | 12 |
| Deployment and data handling | 6 | 5 |
| Total | 100 | 100 |
The scores are the same as on the home table. Only the weights move. How scores are set.