AI SOC buyer's checklist: what to ask for each of the seven criteria

Ask every vendor the same questions in the same order, record the answers in writing, and mark each one as shown in a demo, shown on your data, or stated only. Our scores rest on public material; your answers rest on your environment, which is why the two can differ. The criteria and weights are on our method page. If your priorities differ, set your own weights in the calculator.

• Which of our alert categories does the platform investigate end to end, and which does it only triage?
• Which lookups does it run for a phishing report, a suspicious sign-in and an endpoint alert, and can we see them?
• What context about our environment does it use, and how is that context built and kept current?
• What happens when a lookup fails or a tool is unavailable?

Published reference points: Dropzone AI lists phishing, endpoint, network, cloud, identity and insider alerts; Mate Security describes domain logic for cloud, insider, email, endpoint, identity and phishing alerts; Intezer describes memory scanning and reverse engineering on alerts.

• Can an analyst see every step, tool request and response behind a verdict?
• How do we challenge or correct a verdict, and where is the correction recorded?
• Does a correction change how similar alerts are handled later?

Published reference points: 7AI says you can read each agent's mission, the tools it ran, the exact request and response, and its conclusion; Intezer says customers can challenge any verdict; Dropzone AI shows an AI Action Graph with each investigation.

• Which of our alert sources and investigation sources are supported today, and for each one, can the platform read, act, or both?
• How are new integrations added, and who maintains them?
• Is there a published list we can check, and when was it last updated?

Published reference points: Cortex XSOAR lists 900+ prebuilt integrations and automation packs, Torq 300, Prophet Security 200+, Intezer 100+, and Dropzone AI and Conifers 90+; Mate Security and 7AI publish no count. See the integrations lesson.

• Can autonomy be set per alert category and per action?
• Which actions can require approval, and who can approve them?
• Where are guardrails enforced, and what happens when behaviour drifts?
• What does the audit trail record for every action?

Published reference points: Mate Security's Recommend only, Supervised and Auto-run modes, with rollback to Supervised; Prophet Security's scoped Agent Actions with sign-off; approval for high-impact actions in Palo Alto's Cortex AgentiX. See the guardrails lesson.

• What happens to our existing playbooks: translated, rebuilt or kept alongside?
• Which playbooks would you move first, and which would you leave where they are?
• How long would a parallel run take, and what does it cost across both licences?
• Which response actions that run in our SOAR today can the platform run natively?

Published reference points: Mate Security says it translates SOAR playbooks into Gamebooks; Torq rebuilds them with natural-language workflow creation; Dropzone AI executes response through connected SOAR platforms. Our migration guide sets out the costs in the order they arrive.

• Which deployment models are available: multi-tenant, single-tenant, our own cloud tenant or on-premises?
• Where are data and model inference processed, and can we choose the region?
• Is any of our data used to train models shared with other customers?

Published reference points: Conifers runs in the customer's own Azure tenant and offers regional processing, including a Singapore region added in July 2026; Dropzone AI offers a single-tenant environment and EU data residency; Prophet Security is single-tenant with a bring-your-own-key option. See the deployment lesson.

• What is the pricing unit, and what happens above the included volume?
• Are threat hunting, detection engineering and managed services priced separately?
• What does the proof of value cost, and does its setup carry into production?

Published reference points: none of the nine vendors we scored in September 2026 published a list price; Dropzone AI publishes a per-investigation unit and Intezer an endpoint-based one. See AI SOC pricing in 2026.

• The autonomy level agreed per alert category at go-live, and who may change it.
• Data location, retention and deletion on exit, including anything the platform has learned about your environment.
• Support commitments for the integrations you named.
• The right to export case records and audit trails.
• Renewal terms, and how the price changes if alert volume grows.