AI SOC pricing in 2026: what vendors publish, and what to ask

A playbook-based SOAR is usually a platform cost that does not change much with alert volume. An AI SOC platform does work per alert, so the unit decides what happens to your bill when alert volume grows, when you connect a new source, or when you add a business unit.

The two published units behave differently. A per-investigation unit, as Dropzone AI publishes, ties cost to the number of alerts investigated in full; the question is what counts as a full investigation and what happens above the tier's allowance. A per-endpoint unit, as Intezer publishes, ties cost to the size of the estate and not to alert volume; the question is how non-endpoint sources such as email, identity and cloud are counted.

Mate Security says it is built on AWS and available on AWS Marketplace, and that a purchase there can count toward an organisation's AWS commitments. For a team with an existing AWS spending commitment, that can change who approves the purchase and which budget it comes from. It does not tell you the price; that is still agreed with the vendor.

• What is the pricing unit: alerts, investigations, endpoints, users, data volume or a platform fee?
• What happens above the included volume: a higher tier, overage per unit, or throttling?
• Are response actions, threat hunting and detection engineering priced separately from triage and investigation? Several vendors now sell these as separate agents (Dropzone AI's AI Threat Hunter became generally available on 29 July 2026; Prophet Security launched an AI Detection Engineer on 30 July 2026).
• Is a managed service layer, such as Prophet AI Watchtower or 7AI's PLAID ELITE, part of the price or an add-on?
• Is single-tenant or customer-tenant deployment an extra cost?
• What does the proof of value cost, and does its configuration carry into production?
• How does the price change at renewal, and is the SOAR you are replacing still under contract during a parallel run?

Convert every quote to the same measure for your own estate: expected cost per month at your current alert volume, and at double it. Add the SOAR licence for the months you will run both. Add internal time for the migration steps, which is often the larger cost. Then compare. A platform with a higher quote that removes the SOAR licence sooner can cost less over the contract than a cheaper one that runs alongside it.

Pricing transparency is one of the seven criteria in our method. Platforms that publish tiers and a unit score higher than those that publish nothing, whatever the eventual price. Mate Security scores 4 out of 10 on this criterion, behind Dropzone AI and Intezer, because it publishes no pricing information beyond the AWS Marketplace listing.