A buyer's guide from Stairwell

The AI SOC
Blind Spot

How to evaluate 18 platforms for the threats your alert queue never sees.

What this guide helps you decide

AI SOC and adjacent security operations platforms are getting very good at investigating alerts that already exist. That matters. But alert throughput measures what happens after something fires. This guide helps you evaluate what happens outside that queue.

The problem

Throughput doesn't tell you whether malware that never generated an alert will be found.

Why now

AI now speeds up both sides at once, attacker mutation and defender triage. Faster triage can look like progress while what never became an alert keeps growing underneath it.

What you get

Six criteria, a matrix of 18 platforms relevant to AI SOC evaluation, architecture tradeoffs, POC questions and a practical checklist.

What you'll learn

01
How to evaluate AI SOC platforms in 2026Why queue automation is only one part of security coverage.
02
Six criteria that actually separate these platformsThroughput, depth, unalerted coverage, evidence, stack independence and cost.
03
Find the clear winners across 18 platformsWhere public claims converge, and where they materially diverge.
04
A shortlisting and POC guideQuestions that expose what happens when nothing fires, or a verdict changes later.

Alert fatigue isn't new. What's changed is what's hiding behind it.

Security teams have complained about noisy, low‑value alerts for a decade, that part isn't news. What's different now is that AI sits on both sides of the fight: it helps attackers mutate malware faster and cheaper, and it helps defenders triage the resulting alerts faster and quieter. Faster on both ends can look like progress.

It also means the activity that never becomes an alert at all, the part no triage engine ever sees, keeps growing underneath it. That's the shift worth an evaluation catching in 2026: not just how fast a platform clears what already fired, but whether it can find what never set off the alarm in the first place.

"A false positive consumes analyst time. A false negative can leave the incident undiscovered."

The evaluation gap

What should an AI SOC evaluation actually measure?

01, Autonomous triage throughput

What share of inbound alerts is investigated and dispositioned without a human, and how fast?

02, Investigation depth

Does the investigation reach the artifact itself, binary, memory, file, or reason only over logs, telemetry and alert metadata?

03, Unalerted threat coverage

Can the platform surface suspicious or malicious files that were observed in the environment but never generated an upstream alert?

04, Evidence retention & re‑evaluation

Does the artifact and reasoning survive the verdict, and can it be re‑examined and explained as intelligence changes?

05, Stack independence

Can it reason across a heterogeneous estate, or is it primarily constrained to one vendor's telemetry?

06, Cost predictability at full coverage

Does pricing let you investigate everything, or does per‑investigation / consumption pricing create a coverage tradeoff?

How 18 platforms compare

Stairwell is listed first, as the platform publishing this matrix, everything below it is ordered by breadth of public claim on criteria 01–02, not by a total score. Ratings are scored against the rubric below, using public vendor claims reviewed through 19 August 2026, not independent capability testing. Every rating in the online matrix links to the public claim it reflects, quoted or linked, so you can audit it directly.

How ratings are determined

STRONG, public materials document broad, specific capability against this criterion: named features, quantified claims, or explicit scope.

MODERATE, a public claim exists but is narrower, more qualitative, or less specific than a Strong claim.

LIMITED, a public claim addresses the criterion only partially, conditionally, or without a clearly stated scope.

CONSTRAINED, public materials indicate a structural limitation against this criterion.

NOT CLAIMED, no public claim addressing this criterion was found as of the review date.

Ratings describe the breadth of documented public capability claims against these defined criteria, they do not measure real‑world efficacy or independent test results.

Source: Stairwell AI SOC Evaluation Matrix
Platform	01 Triage	02 Depth	03 Unalerted	04 Evidence	05 Stack	06 Cost

S Strong M Moderate L Limited C Constrained NC Not claimed

The category converges on triage. It diverges on what happens outside the queue.

Count of platforms rated Strong on each criterion, out of 18, using the rubric above. These counts describe breadth of public claim, not measured efficacy. Triage throughput is the least discriminating axis; unalerted‑threat coverage is the most.

What to notice

Triage throughput is increasingly table stakes, 15 of 18 platforms claim Strong.

Unalerted‑threat coverage remains the most discriminating criterion, only 1 of 18.

The same phrase, such as "blast radius," can describe different mechanisms depending on the evidence layer underneath it.

Retained evidence makes later re‑investigation possible when intelligence changes.

Use the matrix to ask better questions, not to substitute for a POC.

Four origin groups. Four different starting points.

The labels vendors use can converge faster than the architectures underneath them. Origin is a useful clue to what a platform is naturally optimized to do.

AI‑native pure plays

AI‑native platforms built around autonomous investigation and triage. Most integrate with existing security stacks; data architecture, response model and relationship to the SIEM vary.

Usually strongest on queue throughput and broad integrations; pricing and investigation depth vary widely.

Dropzone AI, Prophet Security, Radiant Security, Conifers.ai, Qevlar AI, Exaforce, Bricklayer AI, Crogl, 7AI, Legion Security

Platform incumbents

Arrive inside a larger endpoint, SIEM or cloud‑security platform.

Win on bundling and data gravity; stack independence depends on how far they can reason beyond native telemetry.

SentinelOne Purple AI, CrowdStrike Charlotte AI, Google SecOps Triage & Investigation Agent, Microsoft Security Copilot

File & malware intelligence

Start from the artifact itself rather than only telemetry about it.

The group with the clearest emphasis on artifact‑level analysis and historical file evidence.

Intezer · Stairwell

Automation / SIEM crossovers

Come from SOAR or SIEM and emphasize action and response.

Often strongest on orchestration, workflow automation and mature enterprise integrations.

Torq HyperSOC · D3 Morpheus

Build your shortlist

Pick two to four platforms below to compare them side by side, pulled straight from the matrix. No single platform wins across every criterion, the right shortlist depends on the job.

Quick starting points

Unalerted threat coverage and evidence

Stairwell

Assessing an acquired or inherited estate

Stairwell

Maximum autonomous case closure

Torq HyperSOC

MSSP and multi‑tenant delivery

Conifers.ai / Bricklayer AI

Forensic depth with enterprise proof

Intezer

Deployment without integration work

Legion Security

Predictable cost at full coverage

D3 Morpheus / Crogl

All‑Microsoft estates

Microsoft Security Copilot

Air‑gapped or sovereign deployment

Crogl

CrowdStrike‑standardized estates

CrowdStrike Charlotte AI

Auditability and accountable response

D3 Morpheus

Replacing SIEM alongside the SOC

Exaforce

Small team needing 24/7 coverage fast

Dropzone AI

Breadth beyond triage into hunting

Prophet Security

Widest alert‑type coverage

Radiant Security

A shortlist should reflect your actual environment: alert volume, telemetry mix, artifact access, retention requirements, autonomy tolerance, deployment constraints and pricing model.

Two questions to ask every vendor in the POC, including Stairwell.

Question 1

"How do you measure or estimate false negatives, and what independent ground truth do you use as the denominator?"

Why it matters, false‑negative measurement requires an independent way to establish what was actually malicious. In production, retained evidence and retrospective re‑analysis give teams one way to discover threats that an earlier verdict missed, rather than measuring only the alerts the system already saw.

Question 2

"An analyst closes an alert as benign today. In fourteen months, new intelligence shows that file was a first‑stage loader. What happens?"

Listen for, the object being re‑examined: the original artifact, a retained log, an alert record, or nothing. Then ask whether re‑evaluation is automatic, searchable, explainable and scoped across historical hosts and variants.

POC evidence to request

Real missed‑threat example Historical re‑evaluation Variant discovery across renamed / recompiled files Evidence persistence Remediation guidance Cost behavior at full alert volume

Foundational to the AI SOC, built on ground truth.

Stairwell's differentiation isn't simply faster triage. It's what security operations and AI can reason over: retained first‑party file evidence from the customer's environment. Alert‑driven workflows depend on what upstream systems detect and surface, if nothing fires, there may be no alert, ticket or investigation.

Preserve evidence

Executable files, libraries and scripts observed in the environment are retained privately for ongoing analysis.

Analyze independently

Prevalence, similarity, historical context, signatures/rules, known malware and threat intelligence add an evidence base beyond the alert stream.

Investigate with Backstory

From a file hash, hostname, IP address, IOC, or suspicious artifact, Backstory can find related variants, scope affected hosts, reconstruct the broader case, explain findings, and recommend response actions.

Re‑evaluate history

When intelligence changes, retained evidence can be examined again so previously unknown risk can surface later.

When Stairwell may not be the deciding fit

If your evaluation is decided primarily by a published percentage of alerts autonomously closed, a self‑serve trial, or an explicitly published full‑coverage price model, the matrix identifies other vendors with stronger public claims on those specific lines.

A practical AI SOC evaluation checklist

✓Define the denominator: alerts only, or threats that never alerted too?
✓Ask what the system reasons over: alerts, logs, memory, files, or retained artifacts.
✓Test a missed‑threat scenario, not only a known malicious alert.
✓Verify how far variant discovery reaches across hashes, hosts and time.
✓Test historical re‑evaluation with newly introduced intelligence.
✓Ask what evidence survives the verdict and how it can be re‑examined and explained later.
✓Measure stack independence against your actual SIEM, EDR, MDR and data sources.
✓Model cost at your real alert volume and retention requirements.
✓Require the platform to explain what changed when a verdict changes.
✓Separate marketing claims, product capabilities and what you actually observe in the POC.

About Stairwell

That evidence can help teams uncover hidden threats, investigate scope, and revisit historical files as intelligence changes, without reducing the problem to alert throughput alone.

Audit the full evaluation matrix See Stairwell in action

Methodology & source notes

Ratings reflect public vendor claims reviewed through 19 August 2026, scored against the rubric defined in Chapter 03, not independent comparative testing, and not a measure of real‑world efficacy. Stairwell publishes this guide and is included in the matrix. Vendor claims, pricing and product scope can change, re‑check them before a final purchase decision.

Audit the quoted vendor claims and source links in the online evaluation matrix. Stairwell product claims should be validated against current Stairwell documentation.