Mate Security review: an AI SOC platform built to replace SOAR playbooks

Mate Security sells an AI SOC platform that triages and investigates alerts, runs supervised response, and supports threat hunting and detection engineering. Its central idea is the Security Context Graph: memories about your environment with a source, confidence and freshness, decision traces recording why analysts decided what they did, guardrails from regulation and internal controls, and a map of your architecture and security stack. Mate cites onboarding in under 24 hours (as Mate states). The company was founded by Asaf Wiener (CEO), Oren Saban (CPO) and Guy Pergal (CTO); its newsroom lists a $15.5M seed round in November 2025 and a $35M Series A in July 2026, and its investors include Canaan, Team8, Insight Partners and M12.

Each alert is investigated against the context graph through a Gamebook: an investigation process in which the intent and boundaries are fixed and the agent decides how to execute each step. Mate publishes domain logic for cloud, insider risk, business email, endpoint, identity and phishing alerts. Verdicts come back with an evidence trail. Response runs in one of three modes: Recommend only (the team decides what runs), Supervised (low-risk steps run, risky changes need approval) and Auto-run (trusted categories run end to end under guardrails and audit). Mate says the controls sit outside the agent's reasoning loop, and a category drops back to Supervised when verdicts conflict with analyst reviews. Mate reports 99% agreement with analysts (as Mate states).

• Investigation depth per alert · 20%

  9 / 10

  Investigates each alert against its Security Context Graph of memories, decision traces, guardrails and architecture, with domain logic for cloud, insider, email, endpoint, identity and phishing alerts.

• Explainability of verdicts · 15%

  9 / 10

  Verdicts come with an evidence trail the team can audit and tune, and decision traces record why analysts decided what they did.

• Coverage of alert sources · 15%

  7 / 10

  Names integrations such as Microsoft, Google Workspace, CrowdStrike, SentinelOne, Proofpoint and Slack and says it is stack agnostic, but publishes no integration count or full catalogue.

• Human-in-the-loop controls · 15%

  9 / 10

  Three modes (Recommend only, Supervised, Auto-run), graduated autonomy with guardrails enforced outside the agent's reasoning loop, and rollback to Supervised when verdicts conflict with analyst reviews.

• Transition effort from an existing SOAR · 15%

  9 / 10

  States it translates existing SOAR playbooks into Gamebooks, replacing brittle API calls while keeping custom logic; the Gamebooks page is built around the SOAR comparison.

• Deployment model options · 10%

  5 / 10

  SaaS. Mate says it is built on AWS infrastructure and sells through AWS Marketplace; its trust center lists Amazon Web Services and Google Cloud as cloud subprocessors. Self-hosted, customer-tenant and data residency options: not described.

• Pricing transparency · 10%

  4 / 10

  No price page on Mate's own site; its AWS Marketplace listing shows $150,000 per 12-month contract for the "Mate Enterprise Tier", a usage tier the listing does not define.

Weighted score: 7.80 / 10 (computed from the weights on /method#how-we-score)

• No price page; the marketplace list price covers a tier the listing does not define.
• No published integration count; confirm your SIEM, EDR and ticketing tools are supported.
• Performance figures on its site are Mate's own claims.

Mate's pitch to SOAR owners is translation rather than rebuild: 'Mate translates your SOAR playbooks into Gamebooks. Brittle API calls get replaced. Your custom logic stays.' Its launch post reports migrating one customer's 711 playbooks into 10 Gamebooks with higher coverage; that figure is Mate's own. Gamebooks are written in plain language, which answers the common question of whether teams can adjust workflows themselves. Plan a parallel run in Recommend only mode, confirm that each tool your playbooks call is supported (Mate does not publish a full integration list), and re-validate every response action before moving a category to Supervised or Auto-run.

Source: mate.security · mate.security/platform · mate.security/platform/gamebooks · mate.security/blog/introducing-gamebooks-can-you-script-the-whole-game · mate.security/blog/mate-security-now-available-on-aws-marketplace · mate.security/about · mate.security/newsroom · AWS Marketplace: Mate Security · Reviewed Sep 2026

• The only platform in this guide whose public material describes translating SOAR playbooks into its own workflow format rather than rebuilding them.
• Graduated autonomy in three explicit modes, with guardrails enforced outside the model and fallback to Supervised mode.
• Investigation grounded in a context graph that records how your team has decided past cases.

SOC teams with a large, ageing SOAR estate who want to carry their logic over, teams whose playbooks break every time a tool changes, and teams that want a documented, staged path from recommendations to graduated autonomy with guardrails. Teams that need on-premises deployment, a customer-tenant option or list prices before engaging sales should look at the alternatives first.