CyberfuturistsBy the CyberfuturistsAunoomade using AunooAI in the SOC
Cyberfuturists · 28 September–28 October 2026

AI in the SOC

Market News and Trends for AI in the SOC

Generated 28 October 2026, 12:36 UTC

Agentic SOC Top 40 Movers

Week of 19–25 Oct · ranked by momentum on the Market Maturity Map: headcount change, hiring, launches and partnerships, earned mentions and the vendor's own posts over 90 days.

  1. 1▲ 2Exaforce2nd week at #1 · Executing · Accelerating14 launches and partnerships, 31 earned mentionsLast week 3 · Peak 1 · Momentum 9031Momentum 64 → 90 over 8 weeks90
  2. 2▲ 4Daylight SecurityExecuting · Accelerating5 launches and partnerships, headcount +10%Last week 6 · Peak 2 · Momentum 8462Momentum 77 → 84 over 8 weeks84
  3. 3▲ 6Artemis SecurityExecuting · Accelerating37 open roles per 100 staff, 12 earned mentionsLast week 9 · Peak 3 · Momentum 8393Momentum 80 → 83 over 8 weeks83
  4. 4▼ 37AIExecuting · Accelerating27 earned mentions, headcount +19%, raised Series A, Aug 2026Last week 1 · Peak 1 · Momentum 8211Momentum 88 → 82 over 8 weeks82
  5. 5▼ 3Detections AI (was System Two Security)Building · AcceleratingHeadcount +30%, 20 earned mentionsLast week 2 · Peak 2 · Momentum 8022Momentum 80 → 80 over 8 weeks80
  6. 6▲ 5Bricklayer AIBuilding · Accelerating13 launches and partnerships, headcount +8%Last week 11 · Peak 6 · Momentum 80116Momentum 67 → 80 over 8 weeks80
  7. 7▼ 3Prophet SecurityExecuting · Accelerating5 launches and partnerships, 8 earned mentionsLast week 4 · Peak 4 · Momentum 7844Momentum 63 → 78 over 8 weeks78
  8. 8▼ 1NebulockScaling · AcceleratingHeadcount +25%, 11 launches and partnershipsLast week 7 · Peak 4 · Momentum 7874Momentum 71 → 78 over 8 weeks78
  9. 9▲ 1Kai SecurityExecuting · AcceleratingHeadcount +23%, 21 open roles per 100 staffLast week 10 · Peak 3 · Momentum 77103Momentum 76 → 77 over 8 weeks77
  10. 10▲ 4Method SecurityScaling · AcceleratingHeadcount +19%, 29 open roles per 100 staffLast week 14 · Peak 10 · Momentum 751410Momentum 33 → 75 over 8 weeks75
Show 11–40
  1. 11▼ 3Dropzone AIExecuting · Accelerating12 earned mentions, headcount +15%Last week 8 · Peak 8 · Momentum 7488Momentum 75 → 74 over 8 weeks74
  2. 12▲ 1Mate SecurityScaling · Accelerating42 earned mentions, headcount +10%, raised Series A, Oct 2026Last week 13 · Peak 3 · Momentum 71133Momentum 75 → 71 over 8 weeks71
  3. 13▼ 1CognnaScaling · AcceleratingHeadcount +10%Last week 12 · Peak 12 · Momentum 711212Momentum 52 → 71 over 8 weeks71
  4. 14▲ 1SpharakaBuilding · Accelerating10 earned mentions, 4 launches and partnershipsLast week 15 · Peak 14 · Momentum 701514Momentum 52 → 70 over 8 weeks70
  5. 15▲ 3CroglScaling · Accelerating7 earned mentions, 10 open roles per 100 staffLast week 18 · Peak 2 · Momentum 68182Momentum 86 → 68 over 8 weeks68
  6. 16▲ 3QevlarExecuting · AcceleratingHeadcount +11%, 24 open roles per 100 staffLast week 19 · Peak 16 · Momentum 681916Momentum 60 → 68 over 8 weeks68
  7. 17▼ 1Stellar CyberExecuting · Accelerating · 3rd week on chart14 earned mentions, 4 launches and partnershipsLast week 16 · Peak 15 · Momentum 671615Momentum 51 → 67 over 8 weeks67
  8. 18▲ 8VigilBaseEmerging · Growing200 open roles per 100 staffLast week 26 · Peak 12 · Momentum 662612Momentum 64 → 66 over 8 weeks66
  9. 19▼ 2TuskiraScaling · Growing8 launches and partnerships, 6 earned mentionsLast week 17 · Peak 11 · Momentum 651711Momentum 46 → 65 over 8 weeks65
  10. 20▲ 1Legion SecurityExecuting · Growing5 earned mentions, headcount +8%Last week 21 · Peak 14 · Momentum 652114Momentum 66 → 65 over 8 weeks65
  11. 21▼ 1Twine SecurityScaling · GrowingHeadcount +18%Last week 20 · Peak 20 · Momentum 642020Momentum 56 → 64 over 8 weeks64
  12. 22▲ 7Mars SecurityScaling · Growing5 launches and partnerships, 12 open roles per 100 staffLast week 29 · Peak 22 · Momentum 642922Momentum 52 → 64 over 8 weeks64
  13. 23▲ 5CantinaScaling · Growing · 4th week on chart4 launches and partnershipsLast week 28 · Peak 23 · Momentum 642823Momentum 41 → 64 over 8 weeks64
  14. 24▼ 1BinalyzeScaling · Growing · 3rd week on chart9 launches and partnershipsLast week 23 · Peak 23 · Momentum 642323Momentum 50 → 64 over 8 weeks64
  15. 25Re-entryBlinkOpsExecuting · Growing · 4th week on chartLast week – · Peak 18 · Momentum 63–18Momentum 65 → 63 over 8 weeks63
  16. 26▼ 21Secure.comBuilding · GrowingHeadcount +46%, 4 earned mentionsLast week 5 · Peak 3 · Momentum 6253Momentum 70 → 62 over 8 weeks62
  17. 27▲ 11AquilaIScaling · Growing · 3rd week on chartLast week 38 · Peak 27 · Momentum 603827Momentum 30 → 60 over 8 weeks60
  18. 28▼ 6AnvilogicExecuting · Growing11 launches and partnershipsLast week 22 · Peak 10 · Momentum 602210Momentum 72 → 60 over 8 weeks60
  19. 29▲ 8Spectrum SecurityScaling · Growing · 4th week on chart16 open roles per 100 staffLast week 37 · Peak 29 · Momentum 603729Momentum 43 → 60 over 8 weeks60
  20. 30▲ 3IntezerExecuting · Growing16 earned mentions, 4 launches and partnershipsLast week 33 · Peak 26 · Momentum 583326Momentum 52 → 58 over 8 weeks58
  21. 31▲ 9Eventus SecurityScaling · Growing · 2nd week on chart5 earned mentionsLast week 40 · Peak 31 · Momentum 584031Momentum 34 → 58 over 8 weeks58
  22. 32▼ 1CylerianScaling · Growing4 launches and partnershipsLast week 31 · Peak 20 · Momentum 583120Momentum 53 → 58 over 8 weeks58
  23. 33▼ 3RilianBuilding · Growing4 launches and partnershipsLast week 30 · Peak 13 · Momentum 583013Momentum 53 → 58 over 8 weeks58
  24. 34NewAiStrikeBuilding · Growing22 open roles per 100 staffLast week – · Peak 34 · Momentum 57–34Momentum 32 → 57 over 8 weeks57
  25. 35▼ 8Fig SecurityScaling · GrowingLast week 27 · Peak 12 · Momentum 572712Momentum 70 → 57 over 8 weeks57
  26. 36▼ 12HuntbaseEmerging · Growing6 launches and partnerships, headcount +8%Last week 24 · Peak 24 · Momentum 572424Momentum 34 → 57 over 8 weeks57
  27. 37▼ 2SeviiBuilding · GrowingHeadcount +6%Last week 35 · Peak 31 · Momentum 563531Momentum 47 → 56 over 8 weeks56
  28. 38▼ 2UnderDefenseScaling · Growing · 2nd week on chartLast week 36 · Peak 36 · Momentum 553636Momentum 53 → 55 over 8 weeks55
  29. 39▼ 7CotoolBuilding · Growing · 4th week on chart8 launches and partnershipsLast week 32 · Peak 32 · Momentum 553232Momentum 51 → 55 over 8 weeks55
  30. 40NewCipherDataEmerging · Growing36 open roles per 100 staff, headcount +10%Last week – · Peak 40 · Momentum 55–40Momentum 27 → 55 over 8 weeks55
Featured development · Partnership

Palo Alto Networks partners with NVIDIA on agentic AI security

The companies will jointly develop security solutions for autonomous AI systems that perform tasks across enterprise systems.

To move safely from AI agent pilots to full-scale enterprise production, executive leaders need a unified control plane across every layer of the AI…

Palo Alto Networks · 21 Oct 2026 · 3 sources · Also reported independently
Sponsored · Webinar

An Architectural Foundation for Agentic SecOps

Live on 4 November 2026 at 9:00 PST. Karthik Kannan and Oliver Rochford discuss the decoupled SIEM and why it matters as AI agents take on more security operations work. They cover how to give agents governed, auditable access to data and tools spread across SIEMs, data lakes and cloud platforms, while analysts keep control of the decisions that matter.

Karthik Kannan, Anvilogic, and Oliver Rochford, Cyberfuturists · Sponsored by Anvilogic · Register for the webinar →
Sponsored · Article

Is Forensic-grade Investigation Becoming The New Killer Service Deliverable

MDR providers want to take investigations further before handing them off, and incident response providers want recurring work between major incidents. Both are moving towards the same service: continuous investigation built on evidence from the affected systems. The piece looks at what that means for service providers, and where the formal incident response boundary still matters.

Oliver Rochford, Cyberfuturists · Sponsored by Binalyze · Read the article →
Sponsored · Whitepaper

The Decoupled SIEM: An Architectural Foundation for Agentic SecOps

Security data is spread across platforms, and consolidating it all into one SIEM is slow and expensive. A decoupled architecture gives AI agents governed, auditable access to the data and tools a SOC already runs, so they can take on recurring workflows across them. The paper sets out the decoupling models and what each means for cost, governance and portability.

Oliver Rochford, Cyberfuturists · Sponsored by Anvilogic · Read the whitepaper →

Highlights

1 acquisition among the vendors we track.

Leidos acquired Analogic on 5 October.

New funding for Mave, Prophet Security.

Mave raised a $34M round led by Raziel Oren and Guy Eshel, with an incredible team making it all happen on 22 October. Prophet Security raised a strategic round; the amount is not stated on 8 October.

Customer announcements from CrowdStrike, Wirespeed, LimaCharlie, Swimlane and 8 more.

13 customer or deployment announcements, 12 of them naming the customer.

57 of 119 vendors had a development.

118 developments in 30 days, plus 21 hiring or headcount signals. The 7 vendors with 4 or more developments account for 25% of them (Arctic Wolf 5, CrowdStrike 4, Elastic 4, IBM 4, Palo Alto Networks 4, and 2 more). 52 vendors were watched and had none. 10 are not fully collected yet.

  • Arctic Wolf: 5 developments
  • CrowdStrike: 4 developments
  • Elastic: 4 developments
  • IBM: 4 developments
  • Palo Alto Networks: 4 developments

Analysis

Analysis and notes written by the Cyberfuturists team.

Market moves

All 29 →

Deals, funding, partnerships, leadership changes, contract awards, and incidents such as breaches or lawsuits.

Partnership

Sevii partners with Carahsoft for government cyber defense

Level 6 Autonomous Defense & Remediation platform available to Federal, State and Local agencies via Carahsoft's reseller network.

Sevii · 27 Oct 2026 · 1 source · Vendor sources only
Executive appointment

Bricklayer AI hires Steven Schattenberg as Platform Engineering Leader

Schattenberg joins from Itential where he was Director of Platform Engineering for nine years.

Bricklayer AI · 27 Oct 2026 · 1 source · Vendor sources only
Partnership

Threatlens partners with ALCON for MEA distribution

Threatlens announced a strategic distribution partnership with ALCON to expand presence across the Middle East and Africa.

Threatlens · 26 Oct 2026 · 1 source · Vendor sources only

Wider market

All 3 →

Deals and launches by companies outside the vendor list, from news coverage or reported by two or more accounts.

Product launch

Patriot Consulting launches free ISOC cost evaluation and MXDR365 operations for Microsoft customers

Microsoft 365 E5 and E7 customers receive free tenant-specific cost evaluations for Microsoft's ISOC plus seven AI-powered MXDR365 agents and playbooks for 24/7 operations.

Patriot Consulting · 30 Sep 2026 · 2 sources · Reported by multiple independent sources
Product expansion

Dashlane expands SIEM integrations with browser telemetry

The move aims to close a browser visibility gap, giving security teams earlier warning of risky logins and phishing without another console.

Dashlane · 6 Oct 2026 · 1 source · Also reported independently
Product expansion

Sumo Logic adds AI tools to cut telemetry costs upstream

Sumo Logic has introduced AI-powered tools designed to reduce telemetry data ingestion costs by filtering information upstream before it reaches analytics platforms.

Sumo Logic · 2 Oct 2026 · 1 source · Also reported independently

Product launches

All 76 →

New products, and expansions of existing ones.

Product expansion

Rapid7 Command Platform adds SCIM support

Enables automated user provisioning and deprovisioning through identity providers like Okta.

Rapid7 · 27 Oct 2026 · 1 source · Vendor sources only
Product launch

Sekoia launches Self-Hosted version of its platform

Full platform with detection, investigation, threat intelligence, response and agentic AI now runs on-premises or air-gapped.

Sekoia · 27 Oct 2026 · 1 source · Vendor sources only
Product launch

TENEX.AI launches TENEXSignal

TENEX.AI · 27 Oct 2026 · 1 source · Vendor sources only
Product launch

Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture

Stellar Cyber launched an integrated security operations center (ISOC) platform that unifies telemetry collection, threat detection, evidence correlation, case building, investigation, triage, and response within a single AI-powered architecture, designed to give analysts and AI systems access to underlying evidence…

Stellar Cyber · 26 Oct 2026 · 1 source · Also reported independently

Hiring

All 21 →

Vendors with 5 or more open roles, and LinkedIn headcount changes of 10% or more.

271 open roles; 30 of 119 vendors have public job listings.

Hiring

Top 5 by open roles

Job listings · open now
7AI
TENEX.AI
Artemis Security
Qevlar
Stellar Cyber

Case studies

All 13 →

Customer stories and deployments, whether or not the vendor names the customer.

Customer

Cyber Ready Clinic uses Wirespeed for incident investigation

Wirespeed helped Cyber Ready Clinic's CEO assemble incident stories via unified triage and automated verification.

Wirespeed · 26 Oct 2026 · 1 source · Vendor sources only
Customer

Recon InfoSec migrates security operations onto LimaCharlie platform

CTO Andrew Cook describes writing customer setups as code and converting detections to roll out across all tenants.

LimaCharlie · 26 Oct 2026 · 1 source · Vendor sources only
Case study

Telecom security team uses Backline AI for autonomous remediation

Agents ship 95% of fixes autonomously with zero manual code changes; team handed off 90% of remediation workload.

Backline AI · 26 Oct 2026 · 1 source · Vendor sources only

Thought leadership

All 239 →

Opinion and research from vendors and researchers that is not about a specific announcement.

Elastic on LinkedIn · 27 Oct 2026

U.S. federal agencies have until November 18 to submit an Agency Logging Plan, and the Cybersecurity and Infrastructure Security Agency 's new Logging Reference Architecture provides a clear direction for how agencies can put those requirements into practice.

Kai Security on LinkedIn · 27 Oct 2026

The chair of the Financial Stability Board has written to G20 finance ministers and central bank governors warning that frontier AI could change the speed, scale and economics of cyber risk.

Swimlane on LinkedIn · 27 Oct 2026

The hardest part of an AI SOC isn’t the AI. It’s deciding when to let it act. Swimlane CISO Michael Lyborg and Kevin Mata , Director of Cloud & AI Security Operations, put Swimlane Turbine and Hero AI to work on our own security team.

WiseBee on LinkedIn · 27 Oct 2026

Most security teams don’t struggle to find risk. They struggle to fix it. Detection gets all the attention: alerts firing and dashboards turning red. But spotting a vulnerability is now the easy, automated part.

AiStrike on LinkedIn · 27 Oct 2026

Have you been buying half of SecOps? Most SOC tooling starts when an alert fires. That's the reactive half: investigate, respond, close the ticket. AI has made it much faster.

Spectrum Security on LinkedIn · 27 Oct 2026

Today the Delta research team published DefendBench: a benchmark measuring the performance of frontier models for SecOps work. Two key takeaways: - The highest score was 31%: models alone aren't equipped to do SecOps work in a vacuum - More expensive models are not always better…

Social

All 131 →

What practitioners are saying on X, Bluesky, Reddit and LinkedIn, newest first, and the most shared posts.

@drweb2.bsky.social on Bluesky · 27 Oct 2026

JB Financial Invests in AI Security Startup CipherData – Seoul Economic Daily JB Financial Invests in AI Security Startup CipherData - Seoul Economic Daily Read MoreCipherData develops an AI-based detection and response platform, known as AIDR, that uses generative AI to…

@srcbuild on X · 27 Oct 2026

high-volume first passes like alert triage or log summaries, where cost per task matters, then hand the few real ones to sol or a human

@francescofaenzi on X · 27 Oct 2026

1️⃣ The Pragmatic CISO Evaluation Scorecard for AI SOC platforms and SIEM copilots. And the Jevons paradox. When evaluating AI SOC platforms and SIEM copilots, traditional RFPs fail because vendors optimize their demos around pre-canned attack scenarios and polished…

@undercodenews.bsky.social on Bluesky · 27 Oct 2026

ReliaQuest Claims SIEM-Less Security Investigations Can Take Under Five Minutes as SOC Automation Accelerates + Video Introduction: The Race to Make Security Investigations Faster Security operations teams face a persistent challenge: detecting suspicious activity is only the…

@prompt48 on X · 27 Oct 2026

I gave a free AI SOC 15 fake alerts on a $0.59/hr rented GPU. It found the break-in, and also said \"inconclusive\" once. Full install + scorecard 👇 https://t.co/j51wsdvJl6

@SecWeekly on X · 26 Oct 2026

AI agents never clock out. Can security teams keep up? As AI agents operate around the clock, traditional access management and human-led alert triage face new challenges.

Most shared posts

@nakajimeeee on X · 55 reactions

[SOC use/in-house decision on AI use] "AI SOC can be built in-house" is simplistic, and once built, the obligations of a "security vendor" are incurred according to SentinelOne's warning. In August…

@MaxRogers5 on X · 28 reactions

Google’s Gemini 4 Argon absolutely cooked in this Agentic SOC benchmark 🍳🔥 We saw a significant leap with Astra in accurately linking evidence to the final verdict. Gemini blew right past that.…

Research firms

All 20 →

Reports in which analyst firms have named vendors, and the firms' own public posts. The reports are behind paywalls; every item links to its source.

Gartner · Hype Cycle · cited 26 Oct 2026

Gartner Hype Cycle for AI-Driven Cybersecurity, 2026

Cited by Conifers AI, Imperum

Gartner · Magic Quadrant · cited 26 Oct 2026

Gartner Magic Quadrant for Privileged Access Management, 2026

Named Palo Alto Networks (Leader)

CyberfuturistsBy the CyberfuturistsAunoomade using AunooAI in the SOC · 28 September–28 October 2026 · About · Privacy · Consensus · Three horizons

Get in touch

Send us a story about AI in the SOC that is not here, tell us your company belongs on the list. We read everything; what goes on the page is our call.

Everything here is open to read. If you want the data in your own tools, the intelligence feed starts at $139 a month, or ask about data access below.

Choosing a product in this market? Advisory helps buyers build a shortlist, test vendor claims and plan a proof of concept.

🤖 Contains AI-generated content produced by AunooAI. Verify against cited sources before external use.