When should you choose AirMDR?

You need human analysts around the clock as well as an AI one. A free plan of 100 investigations lets you test it with no sales call. Every alert should come back as an audit ready case write up. Graded by Agentic Index against the same capability axes from each vendor's own published materials. No vendor pays for placement.

When should you choose Dropzone AI?

You run your own SOC and want to make it faster. Your own SOC team will run the analyst over the tools it already has. A threat hunting agent should sit beside the analyst. Graded by Agentic Index against the same capability axes from each vendor's own published materials. No vendor pays for placement.

How much do AirMDR and Dropzone AI cost?

AirMDR: Free FAST plan with 100 investigations; additional investigations $4 each. Full Service AI MDR and AI SOC Platform are quote only.. Dropzone AI: Not published. Plans are priced by investigation volume through sales.. Graded by Agentic Index against the same capability axes from each vendor's own published materials. No vendor pays for placement.

Agentic Index

AirMDR vs Dropzone AI (2026)

AirMDR last verified September 28, 2026·Dropzone AI last verified October 22, 2026

AirMDR and Dropzone AI both put an AI analyst on every alert and differ in what else comes with it. That verdict is the Agentic Index coverage score, graded from each vendor's own published materials.

AirMDR is a managed detection and response provider built around that analyst: every alert gets an audit ready case write up, human analysts review critical alerts, a free plan covers 100 investigations with further ones at $4 each, and the full managed service is quoted. Dropzone is software for a team that runs its own SOC, overlaying more than 90 tools, read only by default, priced by investigation volume. Dropzone adds a threat hunting agent beside its analyst. Choose AirMDR if you need people as well as software, or want to try the analyst free, and Dropzone to equip a team you already have.

On the Agentic Index AI SOC ranking, Dropzone AI clears the bar and AirMDR does not. Dropzone AI documents all five investigation loop capabilities in full; AirMDR does not document workflow orchestration in full, nor observability and auditability. 25 of the 86 vendors in the lane clear it. See the AI SOC ranking

This comparison is published by Agentic Index, an independent agentic AI vendor research platform. AirMDR and Dropzone AI are each graded against the same 14 capability Agentic Index taxonomy, from the vendor's own public materials under the Agentic Index verification standard, alongside 1,084 researched vendors. No vendor pays for placement and no vendor has reviewed this page. How this evidence is graded

At a glance

AirMDR

Category: Security / SOC agent
Entry price: Free FAST plan with 100 investigations; additional investigations $4 each. Full Service AI MDR and AI SOC Platform are quote only.
Free or trial: FAST free plan: 100 investigations, no credit card or sales call, 40+ starter integrations, no response actions.
Pricing confidence: public partial

Dropzone AI

Category: Security / SOC agent
Entry price: Not published. Plans are priced by investigation volume through sales.
Free or trial: A structured proof of concept through sales and a self guided demo with no sales call, and no free tier. COACH, a separate Chrome extension for analysts, is free.
Pricing confidence: contact only

Keep exploring

Choose AirMDR if

You need human analysts around the clock as well as an AI one.
A free plan of 100 investigations lets you test it with no sales call.
Every alert should come back as an audit ready case write up.

Choose Dropzone AI if

You run your own SOC and want to make it faster.
Your own SOC team will run the analyst over the tools it already has.
A threat hunting agent should sit beside the analyst.

Feature	A AirMDR	D Dropzone AI
Action & orchestration
Integrations & Tool Calling Ability to connect agents to real systems through native integrations, OAuth-authenticated actions, custom tools, APIs, webhooks, or MCP-compatible tools.
AirMDRIntegrations & Tool Calling Over 240 out of the box integrations span endpoint, email, identity, cloud and SaaS, with new tools added in under two weeks on average and custom integrations delivered in two to four weeks. AirMDR takes response actions in them, such as closing benign alerts and blocking at the firewall. SourceAirMDR, airmdr.com/servicesread 2026-10-06
Dropzone AIIntegrations & Tool Calling Dropzone has more than 90 integrations across SIEM, EDR, cloud, identity and email, read only by default. Response Actions run Python that the customer writes in an isolated container with stored secrets injected, to notify external systems, trigger remediation and apply policy actions. Sourcedocs.dropzone.ai/platform/settings/response-actionsread 2026-10-22
Workflow Orchestration Ability to sequence, branch, retry, route, and combine deterministic workflow nodes with autonomous agent steps.
AirMDRWorkflow Orchestration One AI analyst runs a fixed product pipeline, from an ingested alert through investigation across data sources, evidence collected and correlated into a timeline, and reasoning, to a verdict with rationale and confidence and then automated or analyst approved actions. AirMDR pitches the service as "No SOAR. No playbooks" for the customer, and it adjusts natural language playbooks itself from customer feedback. There is no flow for the customer to build, and no second agent is named. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06
Dropzone AIWorkflow Orchestration Beyond the agent's own multi step investigation, customers configure what follows it. Response Automations fire on more than 50 triggers, among them an investigation completing with a given status, and run the customer's own code, and versioned custom strategies set priority rules and investigation questions. Sourcedocs.dropzone.ai/platform/settings/response-actionsread 2026-09-28
Triggers & Channel Coverage How agents wake up and where they work: schedules, webhooks, message events, CRM events, inbox events, chat, email, voice, and collaboration tools.
AirMDRTriggers & Channel Coverage "Alert Triggered, Alert ingested from integrated security tools" starts each AI investigation, and the product "triages every alert, every time", so the arrival of an alert starts the work with no one asking. AirMDR reports 95% of alerts triaged in under five minutes. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06
Dropzone AITriggers & Channel Coverage Every alert the connected tools raise starts an investigation, hunts run on a schedule and on new CVEs and campaigns, and response automations fire on more than 50 system triggers. Sourcedropzone.airead 2026-10-22
Knowledge & context
Knowledge Grounding & RAG Ability to ground agent behavior in company data through document ingestion, retrieval, external knowledge APIs, semantic search, or RAG layers.
AirMDRKnowledge Grounding & RAG Each investigation enriches, contextualizes and standardizes data from the connected tools and correlates the artifacts into a timeline, and results are tailored per client. AirMDR names no maintained knowledge base or retrieval structure over the customer's estate. SourceAirMDR, airmdr.com/virtual-analyst and /airmdr-ai-soc-agent-and-platformread 2026-10-06
Dropzone AIKnowledge Grounding & RAG Investigations query the customer's own tools live through the integrations, and analysts set custom strategies and define normal behavior. Context Memory serves as the persistent store, and no separate maintained index over the customer's documents is described. Sourcedocs.dropzone.ai/platform/settings/custom-strategiesread 2026-09-28
Memory & State Persistence Ability to persist context across a run, conversation, workflow, user, team, or longer-term memory layer.
AirMDRMemory & State Persistence Customer feedback is incorporated by AirMDR's team, and the free plan keeps alert data and outputs for 30 days. AirMDR names no agent memory. SourceAirMDR, airmdr.com/free-planread 2026-10-06
Dropzone AIMemory & State Persistence Context Memory holds institutional facts across investigations. The agent writes to it when analysts change a conclusion, users add notes directly, and it can be reached through the API. Its scope and lifetime are not stated, and Dropzone only advises cleaning it up from time to time. Sourcedocs.dropzone.ai/platform/context-memoryread 2026-09-28
Control & trust
Human Oversight & Guardrails Approval steps, consent checkpoints, escalation rules, structured guardrails, policy constraints, and pause/resume controls.
AirMDRHuman Oversight & Guardrails Remediation gives the customer a choice between one click approvals and full automation, so a customer can require approval before an action runs, and actions execute either automatically or once an analyst approves them. In the managed service AirMDR analysts review critical alerts manually and escalate when needed. The free FAST plan takes no response actions. SourceAirMDR, airmdr.com/services and /airmdr-ai-soc-agent-and-platformread 2026-10-06
Dropzone AIHuman Oversight & Guardrails Analysts approve or reopen each investigation in the product and from Slack (/dzapprove, /dzreopen), access to the customer's tools is read only by default, and response actions run only where the customer has configured them. Sourcedocs.dropzone.ai/integrations/tools/slack-chatopsread 2026-09-28
Security, Identity & Governance RBAC, SSO, auditability, encryption, least-privilege tool access, compliance posture, and data handling policy.
AirMDRSecurity, Identity & Governance AirMDR states it is SOC 2 certified, without giving the type, and its MSSP platform offers "true tenant segregation with role-based access controls". Sourceairmdr.com/airmdr-for-msspread 2026-09-28
Dropzone AISecurity, Identity & Governance Users sign in locally or through Microsoft, Google or a SAML provider such as Okta or Microsoft Entra, under three roles, Administrator, Member and Restricted Read Only. Dropzone holds SOC 2 Type 2, following a Type 1 audit by Sensiba, runs an annual third party penetration test and a trust center at trustcenter.dropzone.ai, and uses no customer data to train models. Sourcedropzone.ai/security-privacy-trustread 2026-10-22
Observability & Auditability Traces, logs, execution histories, metrics, audit events, and debugging detail for production agent behavior.
AirMDRObservability & Auditability Each alert gets an audit ready case write up covering the investigation process, the evidence and artifacts collected, enriched context, a timeline, the verdict rationale with a confidence level and next steps. AirMDR describes no trace of the analyst agent's own tool calls, and it reports an average case quality of 8.8 out of 10. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06
Dropzone AIObservability & Auditability Each investigation produces an evidence backed report that shows the agent's reasoning, and every response action's output, errors and execution status are logged for auditing. Sourcedocs.dropzone.ai/platform/settings/response-actionsread 2026-09-28
Deployment & Data Residency Deployment modes and options, including SaaS, dedicated cloud, VPC, on-prem, hybrid, local runtime, and self-hosting.
AirMDRDeployment & Data Residency Customers get AirMDR as a platform or a managed MDR service, with 2 to 4 week onboarding and no onboarding fees, and AirMDR cites live deployment of the platform in an hour. No hosting region is published, and AirMDR names no customer environment or data residency option. SourceAirMDR, airmdr.com/pricing, /services and /airmdr-ai-soc-agent-and-platformread 2026-10-06
Dropzone AIDeployment & Data Residency Each customer gets a dedicated tenant in its own AWS subnet, normally in us-west-2, with optional regional deployments and in-region EU deployment on request for GDPR. An optional connector reaches security tools the customer runs on premises, and the Enterprise plan includes a dedicated single tenant environment. Sourcedropzone.ai/security-privacy-trustread 2026-10-22
Solution readiness
Prebuilt Agents, Templates & Packs Ready-made workflows, packaged employees, templates, blueprints, industry solutions, and role-specific agents that reduce time-to-value.
AirMDRPrebuilt Agents, Templates & Packs The one named AI analyst is Darryl, and AirMDR maintains playbooks "built with industry standards in mind". AirMDR names no catalog of agents or templates for the customer to choose from. Managed detections map to the MITRE ATT&CK framework, and threat hunting runs on automated playbooks. SourceAirMDR, airmdr.com/virtual-analyst and /servicesread 2026-10-06
Dropzone AIPrebuilt Agents, Templates & Packs Two agents ship, each doing its own job, the AI SOC Analyst for alert investigation and the AI Threat Hunter for hypothesis driven hunts, with prebuilt hunt packs such as APT29. An AI Threat Intel Analyst is planned that turns each new CVE or campaign into a hunt pack for the Threat Hunter, and COACH, a free Chrome extension, walks analysts through an alert step by step. Sourcedropzone.airead 2026-10-22
Platform extensibility
Model Flexibility & Routing Ability to work across multiple foundation models, route tasks to different models, or let buyers bring their own providers and keys.
AirMDRModel Flexibility & Routing The model behind the AI analyst is not named, and AirMDR describes no model choice or routing for customers. SourceAirMDR, airmdr.com/virtual-analystread 2026-10-06
Dropzone AIModel Flexibility & Routing Dropzone runs on several named LLM services, including Anthropic, Azure OpenAI and Perplexity, and chooses among them itself. Customers cannot choose the model. Sourcedropzone.ai/security-privacy-trustread 2026-10-22
APIs, SDKs & MCP Extensibility Composability layer: stable APIs, SDKs, MCP tool consumption/serving, custom tools, and integration into internal systems.
AirMDRAPIs, SDKs & MCP Extensibility AirMDR collects data from connected tools through their APIs, but publishes no public API, SDK or MCP server for building on the platform, and custom integrations are added by AirMDR. SourceAirMDR, airmdr.com/virtual-analyst and /servicesread 2026-10-06
Dropzone AIAPIs, SDKs & MCP Extensibility Developers get a REST API under /app/api/v1 with Api-Key authorization that covers investigations, bulk feedback, user notes, context memory, custom strategies, response actions and system events, with an OpenAPI 3.0.3 spec and a Swagger UI in the product. Sourcedocs.dropzone.ai/apiread 2026-09-28
Testing, Debugging & Optimization Testing, debugging, scoring, retries, fallbacks, quality gates, and optimization loops for improving agent workflows before and after deployment.
AirMDRTesting, Debugging & Optimization Analyst supervision and tuning from feedback are part of AirMDR's own service, which comes with SLAs on mean time to investigate and mean time to resolve. AirMDR names no testing or evaluation of the AI analyst that customers run themselves. SourceAirMDR, airmdr.com/servicesread 2026-10-06
Dropzone AITesting, Debugging & Optimization Analysts record feedback on investigations singly or in bulk and can reopen a conclusion, reviewing the agent's output after the fact. There is no evaluation harness, scored test set or gate before a strategy change goes live. Sourcedocs.dropzone.ai/apiread 2026-09-28
Specialist automation
Browser & Computer Use Browser, desktop, or remote/local computer control for workflows that cannot be handled through stable APIs alone.
AirMDRBrowser & Computer Use The AI analyst works through integrations, and AirMDR names no browser or computer use by it. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06
Dropzone AIBrowser & Computer Use The agent queries the customer's tools through their APIs, and driving a browser, desktop or remote computer is not described. Sourcedropzone.airead 2026-09-28

Pricing snapshot

Sourced from the Index pricing dataset · open each vendor's profile for full detail.

Pricing	A AirMDR	D Dropzone AI
Entry price Lowest public entry point	Free FAST plan with 100 investigations; additional investigations $4 each. Full Service AI MDR and AI SOC Platform are quote only.	Not published. Plans are priced by investigation volume through sales.
Pricing confidence How public the numbers are	Public, partial	Contact only
Billing Primary billing axis	Per investigation on FAST; paid MDR and platform tiers are quoted on annual contracts.	Investigations per year, per AI analyst, sold as an annual subscription.
Variable cost Workload / overage exposure	Medium variable cost	Medium variable cost
Free tier / trial Try before you buy	Free tier	No free tierTrial
Buying motion Self-serve vs sales call	Mixed	Sales call
Pricing verified When this pricing was last checked	Sep 28, 2026	Oct 22, 2026

Product updates

Newest first, each linked to its source.

AirMDR

October 19, 2026 · Agent capability

Release M29 adds Agentic One Click Remediation, where the agent picks a predefined remediation playbook from a case recommendation and fills its inputs from the case and source alert for an analyst to launch with one click.
Source

All AirMDR updates →