Agentic Index
Astelia vs Dux (2026)
Both vendors last verified
Astelia and Dux both do agentic exposure management and both come from Israeli offensive security veterans. That verdict is the Agentic Index coverage score, graded from each vendor's own published materials.
Astelia maps the enterprise's real network, isolates the vulnerabilities an attacker can actually reach, and runs Astelia Agents workflows that draft tickets, propose firewall rules and drive patches across more than 100 MCP integrations. Dux's AI workers analyze exploitability, check whether existing controls already block a path, suggest light mitigations and route targeted fixes to owners. Neither has a public price. Choose Astelia for remediation grounded in your real network. Choose Dux if checking existing controls before fixing is the priority.
On the Agentic Index AI SOC ranking, Astelia clears the bar and Dux does not. Astelia documents all five investigation loop capabilities in full; Dux documents none of the five in full. 25 of the 86 vendors in the lane clear it. See the AI SOC ranking
This comparison is published by Agentic Index, an independent agentic AI vendor research platform. Astelia and Dux are each graded against the same 14 capability Agentic Index taxonomy, from the vendor's own public materials under the Agentic Index verification standard, alongside 1,083 researched vendors. No vendor pays for placement and no vendor has reviewed this page. How this evidence is graded
Choose Astelia if
- Remediation should rest on a map of what an attacker can actually reach.
- Fixes should flow into tickets, firewall rules and patches through MCP integrations.
- Tickets, firewall rules and patches should flow through MCP integrations.
Choose Dux if
- You want to know whether existing controls already block a path before fixing it.
- Light mitigations beat large remediation projects for your team.
- Fixes should route to specific owners.
| Feature | A Astelia |
D Dux |
|---|---|---|
| Action & orchestration | ||
|
Integrations & Tool Calling Ability to connect agents to real systems through native integrations, OAuth-authenticated actions, custom tools, APIs, webhooks, or MCP-compatible tools. |
||
|
AsteliaIntegrations & Tool Calling More than 100 MCP integrations connect Astelia to the enterprise tech stack. Agent workflows open a ticket for the asset owner, propose firewall and IPS rules at the right choke point, and drive patches through the customer's patch management tool. Read only integrations with infrastructure and network tools feed its network map. SourceAstelia, astelia.io/post/closing-the-exposure-loop and astelia.ioread 2026-10-05 |
||
|
DuxIntegrations & Tool Calling The agents tie data sources together, auto tag every asset and look for mitigations that can be deployed within the security stack a customer already runs, such as a missing control or a configuration change, then route targeted remediation to the owners they identify. No integration, connector, scanner or other system the agents read from or act in is named. SourceDux, dux.io and businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
|
Workflow Orchestration Ability to sequence, branch, retry, route, and combine deterministic workflow nodes with autonomous agent steps. |
||
|
AsteliaWorkflow Orchestration Teams write a workflow spec in natural language, and the planner agent turns it into a step by step workflow. Teams can create agents from scratch or adjust marketplace templates to their own processes. Workflows run in several steps, carrying a vulnerability from triage through remediation to validation. SourceAstelia, astelia.io/post/closing-the-exposure-loopread 2026-10-05 |
||
|
DuxWorkflow Orchestration Dux works in stages, with AI workers that analyze exploitability across the whole environment, check whether existing controls already block a potential attack path, surface lightweight mitigations that remove risk faster than a full patch, and route targeted remediation to identified owners only when necessary. The workers are designed to reason like expert analysts at scale and follow Gartner's Continuous Threat Exposure Management framework. The customer does not configure the flow, add branches or coordinate several agents. SourceDux, dux.io and businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
|
Triggers & Channel Coverage How agents wake up and where they work: schedules, webhooks, message events, CRM events, inbox events, chat, email, voice, and collaboration tools. |
||
|
AsteliaTriggers & Channel Coverage A workflow can run as a routine triggered by every new advisory, so a newly published vulnerability starts work without a person, and the agents run continuously through the vulnerability lifecycle, from triage through remediation to validation. SourceAstelia, astelia.io/post/closing-the-exposure-loop and astelia.ioread 2026-10-05 |
||
|
DuxTriggers & Channel Coverage AI workers continuously analyze exploitability across the entire environment. When a zero day drops or a critical vulnerability hits the news, customers spin up AI workers themselves to investigate it across their environment within minutes. Dux names no event, feed or schedule that starts a worker on its own. SourceDux, businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
| Knowledge & context | ||
|
Knowledge Grounding & RAG Ability to ground agent behavior in company data through document ingestion, retrieval, external knowledge APIs, semantic search, or RAG layers. |
||
|
AsteliaKnowledge Grounding & RAG Astelia maps each customer's network topology, segmentation, existing controls and internet facing systems down to the port level, and correlates exploitability with reachability over that model. Its agents and Astelia MCP, which exposes every Astelia data point, draw on this maintained map of the customer's own estate. The map also covers third party connections and infrastructure reachable over VPN, and attack paths are analyzed as graphs. SourceAstelia, astelia.io and the Closing the exposure loop postread 2026-10-05 |
||
|
DuxKnowledge Grounding & RAG Dux maps how every vulnerability, asset and control connects across the customer's environment and tags every asset, so the analysis works from real context rather than raw scanner findings, most of which the founders say are not exploitable once that context is counted. Dux does not say how the map is stored, kept current or searched by the agents. SourceDux, dux.io and businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
|
Memory & State Persistence Ability to persist context across a run, conversation, workflow, user, team, or longer-term memory layer. |
||
|
AsteliaMemory & State Persistence The agents have no memory of their own. Astelia keeps a persistent model of the environment and its attack paths, which the agents draw on. Routines run again on every new advisory, but Astelia does not say what carries from one run to the next. SourceAstelia, astelia.io/post/closing-the-exposure-loopread 2026-10-05 |
||
|
DuxMemory & State Persistence The vulnerability, asset and control map grounds each analysis. Dux names no memory the AI workers keep from one investigation to the next, and no lifetime for such a memory. SourceDux, dux.ioread 2026-10-06 |
||
| Control & trust | ||
|
Human Oversight & Guardrails Approval steps, consent checkpoints, escalation rules, structured guardrails, policy constraints, and pause/resume controls. |
||
|
AsteliaHuman Oversight & Guardrails The drafted ticket and the proposed firewall rule wait in an approval queue until a person clicks to approve them. Workflows run with fine grained tool scopes and human in the loop checkpoints, and people approve the key decisions. SourceAstelia, astelia.io/post/closing-the-exposure-loop and astelia.ioread 2026-10-05 |
||
|
DuxHuman Oversight & Guardrails Remediation goes to identified owners only when necessary, which leaves patching with the people who own each asset, and the team decides when to spin up AI workers on a new vulnerability. Dux names no approval step before a worker applies a mitigation or changes a configuration. SourceDux, businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
|
Security, Identity & Governance RBAC, SSO, auditability, encryption, least-privilege tool access, compliance posture, and data handling policy. |
||
|
AsteliaSecurity, Identity & Governance Certifications include SOC 2 Type 2 and ISO/IEC 27001:2022, alongside SSO, role based access control, MFA and audit logging, all in Astelia's SafeBase trust center. The trust center also covers GDPR and HIPAA, encryption at rest and application penetration testing, with the reports available on request. SourceAstelia, trust.astelia.ioread 2026-10-05 |
||
|
DuxSecurity, Identity & Governance Security is what Dux sells. It was built by security veterans who say they know how attackers think, with three founders from the IDF's Talpiot program. Dux names no attestation, single sign on or role model for the product itself, and it has no trust page. SourceDux, dux.io and businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
|
Observability & Auditability Traces, logs, execution histories, metrics, audit events, and debugging detail for production agent behavior. |
||
|
AsteliaObservability & Auditability Every step lands in the execution log and every decision in the audit log, on infrastructure built for full human control and auditing during execution and after it. Every action is logged and auditable. SourceAstelia, astelia.io/post/closing-the-exposure-loop and astelia.ioread 2026-10-05 |
||
|
DuxObservability & Auditability No log, trace or record of what the AI workers did is published for the customer to review. The continuous exploitability analysis and asset tagging report on the customer's estate, separating the merely reachable from the truly breachable, not on the workers' own steps. SourceDux, dux.io and businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
|
Deployment & Data Residency Deployment modes and options, including SaaS, dedicated cloud, VPC, on-prem, hybrid, local runtime, and self-hosting. |
||
|
AsteliaDeployment & Data Residency Hosting is SaaS on AWS with no region named. Customers cannot choose a region, and there is no customer VPC or on premises option. Customers can buy Astelia through AWS Marketplace, and its integrations read the network without write access. SourceAstelia, trust.astelia.io and astelia.ioread 2026-10-05 |
||
|
DuxDeployment & Data Residency Dux runs from Tel Aviv, where its research and development team sits, and New York, and already supports major U.S. enterprises. No hosting region, choice of region, deployment inside the customer's own environment or on premises option is published. SourceDux, dux.io and businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
| Solution readiness | ||
|
Prebuilt Agents, Templates & Packs Ready-made workflows, packaged employees, templates, blueprints, industry solutions, and role-specific agents that reduce time-to-value. |
||
|
AsteliaPrebuilt Agents, Templates & Packs A marketplace offers ready made agents and skills built on the same infrastructure, plus templates to adjust. Beyond the new advisory workflow example, no template or its job is named, and the marketplace list is not public. That example finds every affected asset, checks whether each is reachable, opens a ticket for the asset owner and proposes a firewall rule. SourceAstelia, astelia.io/post/closing-the-exposure-loopread 2026-10-05 |
||
|
DuxPrebuilt Agents, Templates & Packs Three kinds of work are offered. Exploitability analysis skips risks attackers cannot use, lightweight mitigations cover a missing control or a configuration change, and remediation acceleration applies when a patch is required. Customers spin up AI workers for each. No worker is named or packaged as a template a team can pick from a catalog. SourceDux, dux.io and businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
| Platform extensibility | ||
|
Model Flexibility & Routing Ability to work across multiple foundation models, route tasks to different models, or let buyers bring their own providers and keys. |
||
|
AsteliaModel Flexibility & Routing The model behind Astelia's agents is not named, and customers cannot choose a provider. Astelia MCP serves customers' own assistants and offers no model choice. Agentic AI extracts the technical requirements of each vulnerability for the reachability analysis. SourceAstelia, astelia.io and the Closing the exposure loop postread 2026-10-05 |
||
|
DuxModel Flexibility & Routing The AI workers are designed to reason like expert analysts at scale. Dux names no model behind them and offers customers no choice of provider. SourceDux, businesswire.com/news/home/20251216193951/en and dux.ioread 2026-10-06 |
||
|
APIs, SDKs & MCP Extensibility Composability layer: stable APIs, SDKs, MCP tool consumption/serving, custom tools, and integration into internal systems. |
||
|
AsteliaAPIs, SDKs & MCP Extensibility The Astelia MCP server exposes every Astelia data point to organizations that already run their own AI assistants. Its endpoint, auth scheme and tool list are not public yet, since Astelia says it deserves a post of its own. There is no REST API or SDK. Astelia's agents reach other tools through more than 100 MCP integrations. SourceAstelia, astelia.io/post/closing-the-exposure-loopread 2026-10-05 |
||
|
DuxAPIs, SDKs & MCP Extensibility No API, SDK, MCP server or developer documentation is published. Dux's site is a single page that ends in a contact form to see the product in action. SourceDux, dux.ioread 2026-10-06 |
||
|
Testing, Debugging & Optimization Testing, debugging, scoring, retries, fallbacks, quality gates, and optimization loops for improving agent workflows before and after deployment. |
||
|
AsteliaTesting, Debugging & Optimization Exploitability and reachability validation tests the customer's estate, and agent workflows end by validating that the fix worked. Customers get no harness, scored test cases, dry run or quality gate for the agents or for the workflows the planner builds. SourceAstelia, astelia.io/post/closing-the-exposure-loop and astelia.ioread 2026-10-05 |
||
|
DuxTesting, Debugging & Optimization Exploitability analysis tests the customer's estate, separating what attackers can actually use from the rest. Dux names no test cases, scoring or review of how accurate the AI workers' own conclusions are. SourceDux, dux.io and businesswire.com/news/home/20251216193951/enread 2026-10-06 |
||
| Specialist automation | ||
|
Browser & Computer Use Browser, desktop, or remote/local computer control for workflows that cannot be handled through stable APIs alone. |
||
|
AsteliaBrowser & Computer Use Work runs through read only infrastructure integrations and MCP connections, and no agent operates a browser or desktop. Its network map comes from integrations with infrastructure and network tools. SourceAstelia, astelia.ioread 2026-10-05 |
||
|
DuxBrowser & Computer Use The AI workers' jobs are analysis, mitigation and routing remediation to owners, and none of them operates a browser or desktop. SourceDux, dux.ioread 2026-10-06 |
||
Pricing snapshot
Sourced from the Index pricing dataset · open each vendor's profile for full detail.
| Pricing | A Astelia |
D Dux |
|---|---|---|
|
Entry price Lowest public entry point |
No public pricing; enterprise contracts are quoted through sales | No public pricing; enterprise contracts are quoted through sales |
|
Pricing confidence How public the numbers are |
Contact only | Contact only |
|
Billing Primary billing axis |
enterprise contract; basis not disclosed | not published |
|
Variable cost Workload / overage exposure |
Medium variable cost | Medium variable cost |
|
Free tier / trial Try before you buy |
No free tier
|
No free tier
|
|
Buying motion Self-serve vs sales call |
Sales call | Sales call |
|
Pricing verified When this pricing was last checked |
Product updates
Newest first, each linked to its source.
Other matchups in security and SOC agents
Not the pairing you were after? These compare a different set of security and SOC agents on the same 14 capabilities.