Pricing
A SOC works as a whole.
We price it as one.
Four AI agents investigate your alerts, hunt across your environment, and track the threats aimed at your industry. Enterprise is sized on employees; federal and MSSP are priced to how you run.
All-inclusive
Enterprise
The complete agentic SOC in one package, sized to your organization. Investigation, hunting, intel, and detection engineering all covered, so nothing waits on next year’s budget line. Nothing to assemble and nothing to scope agent by agent.
Build your package
MSSP
Assemble the agents, the capacity, and the tenancy model your client base needs. Choose per agent and per capacity level, scaled to your size. Client environments stay separated, with investigation capacity that can pool across the book.
Built for federal
Federal
The complete Agentic SOC, procured the federal way. Built per agent and per capacity level, scaled to size, on federal terms. FedRAMP Class D (High) authorized, and every agent action is recorded in a full audit trail your assessors can read.
AI SOC Analyst
Know what happened.
Investigates alerts end to end across your full tool stack, around the clock, and shows the full evidence trail behind each verdict. Every tool it queried and every piece of evidence it weighed is there to read. Your analysts own every verdict.
AI Threat Hunter
Know what you are missing.
Runs hypothesis-driven hunts across your environment, using prebuilt hunt packs or the hypothesis your team brings. Indiana Farm Bureau reported that hunting work which used to take up to 40 hours came down to about one.
In Beta
AI Threat Intel Analyst
Know what threats matter.
Tracks hundreds of threat sources and turns a new CVE or a live campaign into a hunt pack your AI Threat Hunter runs against your environment. The intel stops being a reading list and becomes work that gets done.
Arriving 2027
AI Detection Engineer
Know where coverage is thin.
Will refine your existing detections and draft new ones tuned to your environment, keeping coverage current as things change. Each detection goes to your analysts for review before it is deployed.
Evidence-backed answers
Every verdict ships with the full reasoning trail. Every tool queried, every piece of evidence weighed, fully auditable months later when somebody asks what ran and why.
Coachable in natural language
Guide the agents the way you would guide a new analyst. No code and no playbooks. You give direction in natural language, and the correction persists and shapes how the next pass runs.
Unlimited programmatic actions
Automated containment runs at machine speed at no extra cost, scoped to blocking malicious IPs and disabling compromised accounts, and firing only on threats the AI agents have confirmed.
100+ integrations
Deploys in about an hour against the SIEM, EDR, cloud and identity tooling you already run. No data migration and no new agent on the endpoint.
Threat intel already in motion
GreyNoise, ReversingLabs and other premium feeds are included at no additional cost, already wired into how the agents investigate and hunt.
Access and control
Role-based access decides what your team can reach. Consent profiles decide what Dropzone AI can do in your tenant. Change either whenever, and our actions land in System Events next to yours.



