Dropzone AI review: an AI SOC analyst that works alongside your SOAR

Dropzone sells an AI SOC Analyst that investigates alerts around the clock, an AI Threat Hunter, and an AI Threat Intel Analyst that it lists as coming in Fall 2026. It queries tools by API, so no data normalisation or data lift is needed.

The AI SOC Analyst investigates phishing, endpoint, network, cloud, identity and insider alerts end to end and writes an investigation report with evidence and reasoning. An AI Action Graph shows the stages and actions taken. Response is executed through the SOAR you connect: Dropzone lists Cortex XSOAR, Splunk SOAR, Tines, Torq, D3 Security, IBM QRadar SOAR and Swimlane.

• Investigation depth per alert · 20%

  8 / 10

  The AI SOC Analyst investigates alerts end to end across the stack without data normalisation, covering phishing, endpoint, network, cloud, identity and insider alerts.

• Explainability of verdicts · 15%

  8 / 10

  Investigation reports show evidence and reasoning, and an AI Action Graph shows the stages and actions taken.

• Coverage of alert sources · 15%

  8 / 10

  90+ integrations across 14 categories, including SIEM, EDR, identity, email and cloud.

• Human-in-the-loop controls · 15%

  6 / 10

  Response is executed through a connected SOAR rather than native scoped actions, so approval control sits largely in the SOAR.

• Transition effort from an existing SOAR · 15%

  6 / 10

  Adds AI investigation without touching playbooks, but keeps the SOAR for response, so it does not move a team off SOAR by itself.

• Deployment model options · 10%

  7 / 10

  Standard multi-tenant service, a dedicated single-tenant Enterprise environment and an EU data residency option.

• Pricing transparency · 10%

  5 / 10

  Publishes tiers and the unit (up to 4,000 full investigations per year per AI analyst on Standard) but no prices.

Weighted score: 7.00 / 10 (computed from the weights on /method#how-we-score)

• You keep paying for, and maintaining, a SOAR for response.
• Prices require a sales conversation.

Little, because you do not move off SOAR. Connect alert sources and your SOAR, let Dropzone investigate, and keep response playbooks where they are. If the long-term aim is to retire the SOAR, Dropzone alone does not get you there.

Source: dropzone.ai · dropzone.ai/pricing · dropzone.ai/integrations · Reviewed Sep 2026

• Adds AI investigation without asking a team to retire playbooks on day one.
• Clear pricing unit and tier structure, even without list prices.
• Single-tenant and EU residency options.

Teams whose SOAR handles response well and whose bottleneck is investigation, teams mid-way through a SOAR contract, MSSPs (a dedicated multi-tenant plan exists) and teams needing EU data residency.