Agentic Index
AirMDR vs UnderDefense (2026)
Both vendors last verified
AirMDR and UnderDefense both sell managed detection and response with AI doing the investigation. That verdict is the Agentic Index coverage score, graded from each vendor's own published materials.
AirMDR is built around one AI analyst that writes an audit ready case for every alert, with human analysts on critical ones. A free plan covers 100 investigations, then $4 each, and the full service is quoted. UnderDefense runs MAXI, six AI teammates with a growing knowledge map of the environment, beside a human led MDR service from $11 per device a month, and MAXI can run on premises and air gapped with the customer's own models. Choose AirMDR for a low cost start and approval in one click. Choose UnderDefense for deployment control and your own models.
On the Agentic Index AI SOC ranking, neither AirMDR nor UnderDefense clears the bar, which asks for all five investigation loop capabilities documented in full. AirMDR does not document workflow orchestration in full, nor observability and auditability; UnderDefense does not document human oversight and guardrails in full. 25 of the 86 vendors in the lane clear it. See the AI SOC ranking
This comparison is published by Agentic Index, an independent agentic AI vendor research platform. AirMDR and UnderDefense are each graded against the same 14 capability Agentic Index taxonomy, from the vendor's own public materials under the Agentic Index verification standard, alongside 1,084 researched vendors. No vendor pays for placement and no vendor has reviewed this page. How this evidence is graded
Choose AirMDR if
- You want to start free and pay per investigation.
- Remediation should wait for approval in one click.
- An MSSP needs true segregation between its client tenants.
Choose UnderDefense if
- The platform must run on premises or air gapped with your own models.
- The AI SOC must run on premises or air gapped, on your own models.
- A public floor of $11 per device a month for managed detection suits your budget.
| Feature | A AirMDR |
U UnderDefense |
|---|---|---|
| Action & orchestration | ||
|
Integrations & Tool Calling Ability to connect agents to real systems through native integrations, OAuth-authenticated actions, custom tools, APIs, webhooks, or MCP-compatible tools. |
||
|
AirMDRIntegrations & Tool Calling Over 240 out of the box integrations span endpoint, email, identity, cloud and SaaS, with new tools added in under two weeks on average and custom integrations delivered in two to four weeks. AirMDR takes response actions in them, such as closing benign alerts and blocking at the firewall. SourceAirMDR, airmdr.com/servicesread 2026-10-06 |
||
|
UnderDefenseIntegrations & Tool Calling More than 100 integrations come ready to use. Queries run against the customer's SIEM, Splunk or Elastic, containment is automated, and results go to Microsoft Teams, Jira or Slack, or by email, so UnderDefense acts in those outside systems itself. Named integrations also include Microsoft Sentinel, Google Chronicle, IBM QRadar, CrowdStrike, SentinelOne, Palo Alto Networks, AWS, Azure, GCP and Okta. Containment isolates infected devices from the network with ready to use playbooks. SourceUnderDefense, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05 |
||
|
Workflow Orchestration Ability to sequence, branch, retry, route, and combine deterministic workflow nodes with autonomous agent steps. |
||
|
AirMDRWorkflow Orchestration One AI analyst runs a fixed product pipeline, from an ingested alert through investigation across data sources, evidence collected and correlated into a timeline, and reasoning, to a verdict with rationale and confidence and then automated or analyst approved actions. AirMDR pitches the service as "No SOAR. No playbooks" for the customer, and it adjusts natural language playbooks itself from customer feedback. There is no flow for the customer to build, and no second agent is named. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06 |
||
|
UnderDefenseWorkflow Orchestration Six specialized AI Teammates pass an investigation along, from MITRE classification and SIEM index selection, through querying and validating evidence, to writing the verdict and routing it to workflows. They draw on 200+ agent skills and 400+ AI tools. Evidence gathering turns the investigation plan in a workbook into precise SIEM queries, and validation scores each piece of evidence as benign, suspicious or malicious before the verdict is written. SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05 |
||
|
Triggers & Channel Coverage How agents wake up and where they work: schedules, webhooks, message events, CRM events, inbox events, chat, email, voice, and collaboration tools. |
||
|
AirMDRTriggers & Channel Coverage "Alert Triggered, Alert ingested from integrated security tools" starts each AI investigation, and the product "triages every alert, every time", so the arrival of an alert starts the work with no one asking. AirMDR reports 95% of alerts triaged in under five minutes. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06 |
||
|
UnderDefenseTriggers & Channel Coverage A Teammate classifies each incoming alert against MITRE ATT&CK and investigates it around the clock, with automated containment within 5 minutes of detection, so each arriving alert starts the work. Classification works even when the detection rule carries no ATT&CK metadata, a full investigation takes about 2 minutes, and critical alerts carry a 20 minute response SLA. SourceUnderDefense, underdefense.com/maxi-ai, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05 |
||
| Knowledge & context | ||
|
Knowledge Grounding & RAG Ability to ground agent behavior in company data through document ingestion, retrieval, external knowledge APIs, semantic search, or RAG layers. |
||
|
AirMDRKnowledge Grounding & RAG Each investigation enriches, contextualizes and standardizes data from the connected tools and correlates the artifacts into a timeline, and results are tailored per client. AirMDR names no maintained knowledge base or retrieval structure over the customer's estate. SourceAirMDR, airmdr.com/virtual-analyst and /airmdr-ai-soc-agent-and-platformread 2026-10-06 |
||
|
UnderDefenseKnowledge Grounding & RAG MAXI builds a persistent knowledge map of the customer's environment that gets smarter with every investigation, and RAG is named in the MAXI stack. The Teammates draw on that map. It starts with the SIEM, where one Teammate picks the most relevant log indices from environments with hundreds of them. Detection logic is kept as code, and UnderDefense says agents, workflows, MCP and RAG together raise performance by more than 70%. SourceUnderDefense, underdefense.com/maxi-ai, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05 |
||
|
Memory & State Persistence Ability to persist context across a run, conversation, workflow, user, team, or longer-term memory layer. |
||
|
AirMDRMemory & State Persistence Customer feedback is incorporated by AirMDR's team, and the free plan keeps alert data and outputs for 30 days. AirMDR names no agent memory. SourceAirMDR, airmdr.com/free-planread 2026-10-06 |
||
|
UnderDefenseMemory & State Persistence Apart from the persistent knowledge map the Teammates draw on, the agents have no memory, and nothing says what they keep or for how long. That map is built from the customer's SIEM indices and improves with every investigation. SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05 |
||
| Control & trust | ||
|
Human Oversight & Guardrails Approval steps, consent checkpoints, escalation rules, structured guardrails, policy constraints, and pause/resume controls. |
||
|
AirMDRHuman Oversight & Guardrails Remediation gives the customer a choice between one click approvals and full automation, so a customer can require approval before an action runs, and actions execute either automatically or once an analyst approves them. In the managed service AirMDR analysts review critical alerts manually and escalate when needed. The free FAST plan takes no response actions. SourceAirMDR, airmdr.com/services and /airmdr-ai-soc-agent-and-platformread 2026-10-06 |
||
|
UnderDefenseHuman Oversight & Guardrails Analysts validate and tune, verdicts come with a confidence level and a narrative meant for human review, and ChatOps asks affected employees through Slack or Teams to confirm suspicious activity such as a login attempt. Containment is automated within minutes through predefined playbooks, and no approval step comes before a response action goes through. UnderDefense says people are still needed to tune, verify and trust the system, while the AI handles 80% of Tier 1 and Tier 2 work. SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05 |
||
|
Security, Identity & Governance RBAC, SSO, auditability, encryption, least-privilege tool access, compliance posture, and data handling policy. |
||
|
AirMDRSecurity, Identity & Governance AirMDR states it is SOC 2 certified, without giving the type, and its MSSP platform offers "true tenant segregation with role-based access controls". Sourceairmdr.com/airmdr-for-msspread 2026-09-28 |
||
|
UnderDefenseSecurity, Identity & Governance UnderDefense holds SOC 2 Type I, audited by Prescient Assurance. It now also holds ISO/IEC 27001:2022 certification covering MAXI MDR and MAXI Compliance AI, and says its SOC 2 Type II examination is in its final stage. MAXI Compliance AI has a view only Auditor role under role based access control, but UnderDefense names no SSO, roles or user access controls for the MAXI AI SOC itself. SourceUnderDefense, underdefense.com/company-news SOC 2 post and underdefense.com/blog ISO 27001 postread 2026-10-05 |
||
|
Observability & Auditability Traces, logs, execution histories, metrics, audit events, and debugging detail for production agent behavior. |
||
|
AirMDRObservability & Auditability Each alert gets an audit ready case write up covering the investigation process, the evidence and artifacts collected, enriched context, a timeline, the verdict rationale with a confidence level and next steps. AirMDR describes no trace of the analyst agent's own tool calls, and it reports an average case quality of 8.8 out of 10. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06 |
||
|
UnderDefenseObservability & Auditability Every step of the AI SOC layer is auditable, and each investigation ends in a verdict, a confidence level and a narrative for review or regulatory documentation, the agents' own record of their steps. Validation scores each piece of evidence as benign, suspicious or malicious, and the full investigation output goes to Microsoft Teams, Jira, Slack or email. SourceUnderDefense, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05 |
||
|
Deployment & Data Residency Deployment modes and options, including SaaS, dedicated cloud, VPC, on-prem, hybrid, local runtime, and self-hosting. |
||
|
AirMDRDeployment & Data Residency Customers get AirMDR as a platform or a managed MDR service, with 2 to 4 week onboarding and no onboarding fees, and AirMDR cites live deployment of the platform in an hour. No hosting region is published, and AirMDR names no customer environment or data residency option. SourceAirMDR, airmdr.com/pricing, /services and /airmdr-ai-soc-agent-and-platformread 2026-10-06 |
||
|
UnderDefenseDeployment & Data Residency The on premises edition, sold as MAXI Agentic AI SOC On-Premise, runs entirely within the customer's own closed infrastructure, on any Kubernetes, data center or private cloud in any jurisdiction, including air gapped sites, with zero data leaving the perimeter. It is available now for enterprise customers worldwide. On prepared infrastructure, a full deployment finishes in under five minutes. SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05 |
||
| Solution readiness | ||
|
Prebuilt Agents, Templates & Packs Ready-made workflows, packaged employees, templates, blueprints, industry solutions, and role-specific agents that reduce time-to-value. |
||
|
AirMDRPrebuilt Agents, Templates & Packs The one named AI analyst is Darryl, and AirMDR maintains playbooks "built with industry standards in mind". AirMDR names no catalog of agents or templates for the customer to choose from. Managed detections map to the MITRE ATT&CK framework, and threat hunting runs on automated playbooks. SourceAirMDR, airmdr.com/virtual-analyst and /servicesread 2026-10-06 |
||
|
UnderDefensePrebuilt Agents, Templates & Packs Six AI Teammates are described by role but not named, with 200+ agent skills and 400+ AI tools behind them. They work inside UnderDefense's own investigation pipeline, not as agents a customer picks up one at a time. The platform ships with more than 700 investigation workbooks mapped to MITRE ATT&CK, and containment uses ready to use playbooks. UnderDefense's site gives no figure of 1,500+ correlation rules. MAXI Compliance AI, a separate product, automates evidence collection and security questionnaires for SOC 2, ISO 27001, HIPAA and PCI DSS. SourceUnderDefense, underdefense.com/company-news agentic AI SOC launch and underdefense.comread 2026-10-05 |
||
| Platform extensibility | ||
|
Model Flexibility & Routing Ability to work across multiple foundation models, route tasks to different models, or let buyers bring their own providers and keys. |
||
|
AirMDRModel Flexibility & Routing The model behind the AI analyst is not named, and AirMDR describes no model choice or routing for customers. SourceAirMDR, airmdr.com/virtual-analystread 2026-10-06 |
||
|
UnderDefenseModel Flexibility & Routing Customers can bring their own AI model through Azure AI Foundry or AWS Bedrock, or run sovereign open source models hosted entirely inside their own perimeter, so the customer chooses the model. That choice comes with the on premises edition, which keeps all data inside the customer's network. SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05 |
||
|
APIs, SDKs & MCP Extensibility Composability layer: stable APIs, SDKs, MCP tool consumption/serving, custom tools, and integration into internal systems. |
||
|
AirMDRAPIs, SDKs & MCP Extensibility AirMDR collects data from connected tools through their APIs, but publishes no public API, SDK or MCP server for building on the platform, and custom integrations are added by AirMDR. SourceAirMDR, airmdr.com/virtual-analyst and /servicesread 2026-10-06 |
||
|
UnderDefenseAPIs, SDKs & MCP Extensibility UnderDefense publishes no public API, SDK or MCP server for building on MAXI. The MAXI page names MCP among its technologies without an endpoint or tools. Detection logic is managed as code, and results reach outside tools through the built in integrations. SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05 |
||
|
Testing, Debugging & Optimization Testing, debugging, scoring, retries, fallbacks, quality gates, and optimization loops for improving agent workflows before and after deployment. |
||
|
AirMDRTesting, Debugging & Optimization Analyst supervision and tuning from feedback are part of AirMDR's own service, which comes with SLAs on mean time to investigate and mean time to resolve. AirMDR names no testing or evaluation of the AI analyst that customers run themselves. SourceAirMDR, airmdr.com/servicesread 2026-10-06 |
||
|
UnderDefenseTesting, Debugging & Optimization Customers get no way to test or evaluate the Teammates themselves. Analyst tuning is part of the service. UnderDefense reports investigations 153 times faster, 99% less noise and 99%+ MITRE ATT&CK coverage, and a 15 minute mean time to contain for its MDR service. SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05 |
||
| Specialist automation | ||
|
Browser & Computer Use Browser, desktop, or remote/local computer control for workflows that cannot be handled through stable APIs alone. |
||
|
AirMDRBrowser & Computer Use The AI analyst works through integrations, and AirMDR names no browser or computer use by it. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06 |
||
|
UnderDefenseBrowser & Computer Use The Teammates work through SIEM queries and integrations, and there is no browser or computer use. Endpoint containment, such as isolating an infected device, runs as an automated playbook action. SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05 |
||
Pricing snapshot
Sourced from the Index pricing dataset · open each vendor's profile for full detail.
| Pricing | A AirMDR |
U UnderDefense |
|---|---|---|
|
Entry price Lowest public entry point |
Free FAST plan with 100 investigations; additional investigations $4 each. Full Service AI MDR and AI SOC Platform are quote only. | MDR from $11 per device per month (most customers $10 to $30 per asset), annual contracts; Free plan with a 14-day trial. |
|
Pricing confidence How public the numbers are |
Public, partial | Public, partial |
|
Billing Primary billing axis |
Per investigation on FAST; paid MDR and platform tiers are quoted on annual contracts. | Per device or asset per month, annual contract; the same rate across asset types. |
|
Variable cost Workload / overage exposure |
Medium variable cost | Medium variable cost |
|
Free tier / trial Try before you buy |
Free tier
|
Free tierTrial
|
|
Buying motion Self-serve vs sales call |
Mixed | Sales call |
|
Pricing verified When this pricing was last checked |
Product updates
Newest first, each linked to its source.
AirMDR
-
· Agent capability
Release M29 adds Agentic One Click Remediation, where the agent picks a predefined remediation playbook from a case recommendation and fills its inputs from the case and source alert for an analyst to launch with one click.
Source
UnderDefense
-
· MCP / tool calling / API
UnderDefense launched MAXI MCP, a gateway that connects SIEM, EDR and SOC data to assistants and IDEs such as Claude, ChatGPT and Cursor, using OAuth 2.1 with read only access.
Source -
· Deployment / data residency
UnderDefense launched an on-premise version of its MAXI Agentic AI SOC platform, designed specifically for closed, sovereign, and air-gapped environments.
Source -
· Security / enterprise
UnderDefense launched the Unified MAXI Workspace, a single platform combining Agentic AI SOC, Compliance AI, and CISO Intelligence.
Source
More comparisons with AirMDR or UnderDefense
Other matchups in security and SOC agents
Not the pairing you were after? These compare a different set of security and SOC agents on the same 14 capabilities.