Exaforce review: an agentic SOC you run yourself or have managed

Exaforce sells an "Agentic SOC and MDR": a unified data layer and real-time knowledge graph, with Multi-Model AI that separates data relationships, anomaly detection and expert reasoning. It stores raw data and normalises it, and lists SIEM replacement and replacing legacy MDR or MSSP among its use cases. Exaforce's newsroom lists a $75M Series A in April 2025 and a $125M Series B in May 2026.

Exabots handle detection, triage, investigation and response. Exabot Respond can isolate cloud instances, quarantine or delete emails, block IPs, disable endpoints, reset MFA or passwords, suspend users and revoke sessions across Okta, Entra ID, AWS and email. Actions sit behind approval gates with full audit trails, and confirmations can come from users or managers in Slack. Exaforce cites more than $600K average savings versus traditional SOC stacks, 90% fewer false positives and 95% lower mean time to investigate; those are Exaforce's figures.

• Investigation depth per alert · 20%

  8 / 10

  Exabots handle detection, triage, investigation and response on a unified data layer and knowledge graph, with separate models for data relationships, anomaly detection and reasoning.

• Explainability of verdicts · 15%

  6 / 10

  Response actions carry full audit trails, but how verdict reasoning is shown to analysts is less documented on the pages reviewed.

• Coverage of alert sources · 15%

  8 / 10

  130+ integrations across IaaS, SaaS, identity, endpoint, SIEM, SOAR, email, ticketing and threat intelligence; Exaforce says it ingests from over 100 sources.

• Human-in-the-loop controls · 15%

  8 / 10

  Approval gates, full audit trails and Slack confirmations from users or managers; Exaforce describes actions as approved and reversible.

• Transition effort from an existing SOAR · 15%

  8 / 10

  Out-of-the-box playbooks plus new ones built in natural language, in a visual editor mixing deterministic and agentic steps; existing SOAR playbooks are rebuilt rather than translated.

• Deployment model options · 10%

  4 / 10

  Self-managed or Exaforce-managed operating models, but tenancy, on-premises or data residency options are not described on the pages reviewed.

• Pricing transparency · 10%

  4 / 10

  No pricing page; AWS Marketplace lists an Agentic SOC Starter Pack at $75,000 per 12-month contract, without a defined unit.

Weighted score: 6.90 / 10 (computed from the weights on /method#how-we-score)

• Deployment and residency options not published.
• Verdict reasoning is less documented than at the leaders.
• The marketplace price covers a starter pack whose unit is not defined.
• Savings and accuracy figures are Exaforce's own claims.

Exaforce says to "go beyond rigid SOAR playbooks". It ships out-of-the-box playbooks and lets teams build new ones in natural language, in a visual editor that mixes deterministic and agentic steps. Existing SOAR playbooks are rebuilt rather than translated. If you choose the managed model, Exaforce's analysts and Exabots run the platform 24/7, which changes who owns the rebuild.

Source: exaforce.com · exaforce.com/platform/integrations · exaforce.com/platform/exabot-respond · exaforce.com/newsroom · AWS Marketplace listing · Reviewed Sep 2026

• Native response across endpoint, identity, cloud, SaaS and email, behind approval gates.
• Choice of running it yourself or having Exaforce run it as a managed service.
• 130+ integrations, including SIEM and SOAR categories.

Teams that want native response across endpoint, identity, cloud, SaaS and email, teams weighing a managed service against running the platform themselves, and teams also reviewing their SIEM or MDR. Teams that need described deployment or residency options, step-level verdict reasoning or a defined pricing unit should ask for them early.