Cyber AI Comparison

UNIVERSITY · LESSON · PUBLISHED 23 SEPTEMBER 2026

How to read AI SOC vendor claims

Cyber AI Comparison team · Last checked September 2026 · Editorial assessment

Published 23 September 2026

3 min read

What to know

Treat vendor performance figures as claims to test, stances on SOAR as positioning, and a missing fact as a question to ask. This lesson shows how this site handles each, with examples from the vendors we score, so you can read any vendor page the same way.

Why are performance figures the vendor's own?

Vendor pages quote results such as time saved or cases closed. They come from the vendor's customers, measured the vendor's way, and cannot be checked from public material. Examples from this guide: Torq says it can "Close Over 90% of Security Cases. Autonomously." and calls Hyperautomation "10x faster than legacy SOAR"; Mate's blog reports one customer moving 711 playbooks into 10 Gamebooks.

We quote such figures only with attribution ("Mate says", "Torq's claim") and never use them in scores. Your own figures from a proof of value are the ones to decide on.

How should you read a vendor's stance on SOAR?

Stances are positioning, and they tell you what the vendor expects you to keep. Torq's blog says "SOAR is officially obsolete." 7AI calls its platform "a force multiplier, not a replacement". Palo Alto calls Cortex AgentiX "the next generation of Cortex XSOAR". Our SOAR Stance Index records each vendor's stance, where response actions run and whether existing playbooks are translated, so you can see which products assume a SOAR stays.

What does "Not published" tell you?

Where a vendor does not publish a fact, this site says "Not published" or "Contact sales" rather than guessing. That gap is information. No vendor we score publishes a full price list on its own site; several publish no deployment options beyond a hosted service; some publish no integration count. Each gap becomes a question for the sales call, and our pricing transparency and deployment criteria score what is published, not what may exist.

Why check the date and the original source?

Secondary coverage can get details wrong. When we compiled our news page, a press roundup dated Torq's acquisition of Jit to June 2026, while Torq's own release is dated 18 May 2026; we use the vendor's release. When a fact matters to your decision, open the original page and check the date.

What about analyst-firm badges?

Several vendor sites cite recognition from analyst firms. We do not use these in scoring, because the underlying reports cannot be checked from public material and the labels are not comparable between vendors.

What is a quick checklist for any vendor page?

  • Who measured this figure, on whose alerts, over what period?
  • Is this a product that exists today or an announcement? Dropzone AI's AI Threat Intel Analyst, for example, was announced for Fall 2026.
  • What does the vendor expect me to keep running alongside it?
  • Which facts I need are missing, and who at the vendor can answer them?
  • When was this page last updated?

Next: back to University

Related on this site

Sources