Microsoft estate: the rubric reweighted

A team whose endpoints, identity, email and cloud sit mostly in Microsoft Defender, Entra ID, Exchange Online and Azure, and whose containment actions run against those products.

6.91D3 Security leads

The ranking

Totals recomputed in code from the weights below. Rank on the base rubric in the last column.
Rank	Platform	Total	Actions of 25	Base rank
1	D3 Security	6.91	19	1
2	Google Security Operations	6.29	19	3
3	Cyware	6.09	17	2
4	Swimlane (Turbine)	5.86	18	5
5	Tines	5.83	22	8
6	Splunk SOAR (Cisco)	5.81	19	6
7	Palo Alto Cortex XSOAR	5.64	20	4
8	Torq	5.52	13	7
9	Microsoft Sentinel	5.31	9	9
10	Dropzone AI	4.95	2	10
11	Prophet Security	4.85	0	11
12	Mate Security	4.83	0	11
13	ServiceNow Security Operations	4.04	7	13
14	CrowdStrike Falcon Fusion SOAR	3.70	0	14

A band is a run of neighbouring totals, not a ladder. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order. Band groups under these weights: Google Security Operations, Cyware, Swimlane (Turbine), Tines, Splunk SOAR (Cisco), Palo Alto Cortex XSOAR, Torq, Microsoft Sentinel; Dropzone AI, Prophet Security, Mate Security.

Why these weights

This weighting is this site's own proposal, since rubric.json proposes reweights for three buyer types only. Detection-to-response coupling rises to 16, because a platform that takes Defender incidents directly saves a hop, and pricing transparency rises to 10 because Microsoft prices are public and a buyer should compare against them. Audit falls to 10 and integration count to 8, because the estate is narrow and deep, not wide. Coverage stays at 25, as in the published rubric.

100points in total

Weights against the base rubric

Criterion	Base weight	Microsoft estate weight
Native containment coverage	25	25
Published time-to-contain evidence with method	15	10
Approval, rollback and blast-radius controls documented	15	15
Explanation and audit trail	15	10
Integration depth documented	10	8
Detection-to-response coupling	8	16
Pricing transparency	6	10
Deployment and data handling	6	6
Total	100	100

The scores are the same as on the home table. Only the weights move. How scores are set.