COACH (Cyber Operations Alert & Context Helper) is a free Chrome extension built by Dropzone AI. It acts as an AI-powered mentor for SOC analysts, guiding them through alert investigations with plain-language explanations and step-by-step coaching using the OSCAR methodology. Available for Chrome and Microsoft Edge.

COACH is designed for SOC analysts at all levels. Junior analysts use it to build investigation skills faster. Senior analysts use it to get instant context on unfamiliar alert types. SOC managers and team leads use it as a scalable supplement to one-on-one mentorship, especially across shifts and time zones.

COACH teaches by doing. When an analyst pastes an alert, COACH reads the alert data, explains what triggered it, identifies the key indicators, and walks the analyst through a structured investigation. Unlike static training modules, COACH works on real alerts the analyst is actually investigating, so learning happens in context.

No, COACH is a supplement and not a replacement for existing mentoring relationships. It is always available, infinitely patient, and highly scalable.

Yes. COACH retains zero data. No alert data is stored, logged, or transmitted beyond the active browser session. The extension does not persist any information after the session ends. 

COACH uses Dropzone AI technology to understand security alerts, create hypotheses about why they fired, and generate investigative questions according to standard methodology. The Dropzone AI commercial product autonomously investigates alerts using your security tools and produces full reports with detailed findings and evidence.

Dropzone AI builds AI agents that investigate security alerts, hunt threats, and respond to attacks autonomously. With 300+ deployments and 90+ security tool integrations, Dropzone AI's agents work alongside human defenders to expand SOC coverage without scaling headcount. Recognized as a Gartner Cool Vendor for the Modern SOC.

No AI system is perfect, and COACH can produce imperfect guidance. However, it is grounded in security domain knowledge and the OSCAR investigation methodology, generating guidance from the specific alert data provided rather than generic responses. COACH is a coaching tool, not an autonomous decision-maker. Analysts should always validate its guidance against their own procedures.

COACH addresses a talent pipeline challenge created by AI automation. As AI takes on more Tier 1 alert investigation, junior analysts have fewer opportunities to build investigation skills through hands-on triage. Dropzone AI released COACH as a free resource to solve this, building goodwill in the security community and introducing teams to how Dropzone approaches security operations.