BlinkOps vs D3 Security (Morpheus) (2026)

Agents invoke 30,000+ out-of-the-box integration actions as Abilities, across AWS, Azure, CrowdStrike, Cloudflare, Datadog, Slack, GitHub and others, alongside deterministic Blink workflows executed by runners, and custom actions are supported, so agents take authenticated action in outside systems.

Sourceblinkops.com/agenticstudioread 2026-09-28

There are 800+ self-healing integrations across SIEM, EDR, IAM, cloud, email, NDR and DLP, with response actions run through playbooks and integration commands that sign in to outside systems and act there. Named connections include Microsoft, CrowdStrike, SentinelOne, Splunk, LogRhythm, Elastic, Fortinet, Okta, Zscaler and Recorded Future. When a connector drifts it repairs itself, with an 18 minute mean time to recover that D3 sets against weeks for manual fixes, and a command details panel shows each integration's commands and sample data.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Customers can chain multiple specialized agents together to collaborate on complex investigations or embed them into deterministic workflows, with Peer Agents that delegate subtasks to one another and a Workflow Studio where customers build their own flows.

Sourceblinkops.com/agenticstudioread 2026-09-28

Response playbooks are generated at runtime for each incident, and adaptive playbooks are built from the chat interface with Approval blocks. Customers also build their own playbooks in the platform's SOAR engine, set to start when a case escalates or when data is ingested. Adaptive playbooks combine Morpheus Agent, Router, Parallel, Send Email and Approval blocks, and an investigation playbook can be run from the incident chat. An Agentic Task capability puts bounded LLM reasoning inside a playbook step, and legacy SOAR playbooks keep working during a migration.

SourceD3 Security, docs.d3security.com Morpheus releases and d3security.com/morpheusread 2026-10-05

Every alert is normalized, enriched and triaged the moment it arrives, and case management triggers, such as a case field update, an activity comment or a new table record, start workflows and agents without a prompt.

Sourceblinkops.com/ai-socread 2026-09-28

The moment an alert lands, the investigation engine assembles the attack-path story, and playbooks run on ingestion or escalation, so work starts with no one asking. Every alert is triaged, so none is closed silently, and analysts can also launch an investigation playbook from the incident chat.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Agent Knowledge consists of uploaded files and documents the agent can reference. Customers upload their own SOPs, playbooks and reference documentation for each agent, a maintained store of their material that the agents draw on.

Sourcedocs.blinkops.com/docs/agent-builder/terminologyread 2026-09-28

The Cybersecurity Triage Reasoning Graph encodes senior analyst reasoning built by D3's specialists. It holds D3's own security knowledge, not a map of the customer's systems.

Attack Path Discovery assembles evidence across the customer's EDR, identity, email, cloud and network sources for each alert, and D3 publishes no way for a customer to load its own material for Morpheus to search. D3 says the graph took 24 months and 60 specialists to build.

Linked incident search finds related cases by severity, status, type, owner, tags, tactic, technique or creation date, and global lists can be edited in bulk as JSON.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Tables are workspace scoped structured storage that workflows, and so agent Abilities, read and write to keep state across runs. Agents have no memory of their own with a stated scope and lifetime. The uploaded documents that the Agentic Studio calls memory are reference files for the agent.

Sourcedocs.blinkops.com/docs/blink-platform/tables/tablesread 2026-09-28

Since release 18.4, Morpheus reviews how an incident was handled and converts the workflow into a reusable SOP skill, a stored artifact carried forward. D3 does not say who can use an SOP skill or how long one is kept. Case files hold the record of each incident. Analysts or Morpheus itself can then run an SOP skill on later incidents that look alike.

SourceD3 Security, docs.d3security.com Morpheus releasesread 2026-10-05

Customers decide which actions run on their own and which wait for human approval, so a person can sign off before an action commits. Agents also work within roles and constraints, act only through Abilities vetted in advance and never hold credentials directly, and playbooks need approval before they are published.

Sourceblinkops.comread 2026-09-28

There are four autonomy modes (Deterministic, AI-Assisted, AI-Led, Autonomous), command-risk tagging sets the approval gate for response actions, and adaptive playbooks start from a plan for analyst approval with an Approval block type, so approval comes before the action commits. In AI-Assisted mode an analyst approves every action, in AI-Led mode the analyst oversees command risk tiers, and Autonomous mode keeps approval gates that can be set per workflow, per tenant or per regulator. Attack Path Discovery is read only and takes no action on its own.

SourceD3 Security, d3security.com/morpheusread 2026-10-05

Access runs through SAML SSO with Okta, Azure AD, Google and Cloudflare, RBAC user roles and per agent RBAC permissions, two factor authentication and platform audit logs, backed by a SOC 2 Type II attestation covering Security, Availability and Confidentiality.

Sourceblinkops.com/security-privacy-highlights-for-customersread 2026-09-28

D3 Security is SOC 2 Type II certified, and the platform has access controls with roles and groups carrying permissions, sites for business-unit separation and multi-tenancy. D3 is a member of the Microsoft Intelligent Security Association, and the platform aligns with MITRE ATT&CK and D3FEND. Named user licenses come with every subscription, and multi tenant deployments keep each client's data, configuration and views apart.

SourceD3 Security, docs.d3security.com user docs and d3security.com/resources/faqread 2026-10-05

Every step is logged with the agent's reasoning and the evidence behind it. Agent run logs trace each run from input ingestion to output, with timestamps, duration, data processed and each Ability's execution step, and agent usage is tracked.

Sourcedocs.blinkops.com/docs/agent-builder/agent-run-logsread 2026-09-28

Each incident has one unified audit trail of every action, decision and task across all six capabilities, with a complete evidence chain for every investigation, so each investigation keeps its own run record. The trail uses the same format across every capability and autonomy mode, and every element of an attack path comes from a real tool query that is timestamped and attributed. D3 positions the trail for review under SEC, NYDFS, HIPAA, NERC CIP, NIS2, DORA and the EU AI Act, and a utility command retrieves attack path results with their AI summaries.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Self-hosted runners deploy within the customer's own environment and execute workflow actions against internal systems, private networks and on-prem services, giving a customer environment for execution. The control plane is SaaS, with eu1 and us2 endpoints listed and table data in Amazon RDS or Azure Database for PostgreSQL.

Sourcedocs.blinkops.com/docs/blink-platform/runners/runnersread 2026-09-28

The platform is hosted on Microsoft Azure across named geographies (US, Canada, EU, UK, APAC, Gulf, Nordics) with data residency configurations, and cloud, on-premise, hybrid and air-gapped deployments are supported. Azure regions include the United States, Canada, Ireland for the EU and Japan, and the residency configurations address GDPR, EU data sovereignty and regional government mandates. MSSPs get a native multi tenant architecture with isolated client data, per tenant configuration and segregated client views.

SourceD3 Security, d3security.com/resources/faq and /morpheusread 2026-10-05

There are 500+ prebuilt agent templates, specialized micro-agents with stated jobs such as malware analysis, threat hunting, forensic analysis, insider threats, incident coordination and threat intel correlation, and an automation library of prebuilt workflows.

Sourceblinkops.com/ai-socread 2026-09-28

Morpheus ships one reasoning engine with six named capabilities and generates playbooks at runtime, and SOP skills are derived from the customer's own incidents. There is no catalog of named prebuilt agents or templates. The six capabilities are triage, investigation, response and orchestration, self healing integrations, agentic tasks and autonomy modes, all in one subscription priced as a fixed annual fee by daily alert volume, from 500 to 10,000 alerts a day with custom tiers above, plus named user licenses.

SourceD3 Security, d3security.com/morpheus and /resources/faqread 2026-10-05

Agents run on enterprise-tier AI endpoints whose providers are not named, and there is no customer model choice or bring-your-own model.

Sourceblinkops.com/security-privacy-highlights-for-customersread 2026-09-28

Morpheus also supports customer-preferred LLMs for organizations that require it, without changing the pricing structure, so a customer can bring its own model, and the default models are not named. The Agentic Task capability is provider agnostic and runs through D3's built in connector or the customer's existing AI vendor contract. D3 absorbs all token and inference costs within the subscription, and the Triage Reasoning Graph is included at no extra cost.

SourceD3 Security, d3security.com/resources/faq and /morpheusread 2026-10-05

A Blink REST API has endpoints to create, list, version and execute playbooks and list executions, and custom actions and MCP connections to external tools are available for agents.

Sourcedocs.blinkops.com/docs/api/blink-rest-apiread 2026-09-28

The D3 Command API (API key or JWT auth, POST endpoints for Incidents, Events, Playbooks, Artifacts, Files, Users, Sites and GlobalLists) comes with utility command docs, and there is no MCP server. Release 18.4 lets teams organize custom utility commands in nested folders and filter command search by connection, and it added a command that returns attack path results.

SourceD3 Security, docs.d3security.com API docs and Morpheus releasesread 2026-10-05

There is no test harness, scored cases or evaluation surface for agents. Blink keeps workflow versions and requires approval before a playbook is published, and run logs record what happened.

Sourcedocs.blinkops.com/docs/agent-builder/agent-builderread 2026-09-28

D3 tests Morpheus against simulated attacks and adversarial inputs as part of its own release work and publishes revelation and closure rates. Customers get no published way to test Morpheus on their own deployment. D3's own figure is that up to 95 percent of alerts are triaged and investigated to L2 depth in under two minutes.

SourceD3 Security, d3security.com/morpheusread 2026-10-05

Agents act through Abilities and integration actions, with no browser or computer use.

Sourcedocs.blinkops.com/docs/agent-builder/terminologyread 2026-09-28

There is no browser or computer use by Morpheus, which acts through integrations and commands. Attack Path Discovery queries the connected tools through their APIs and stays read only.

SourceD3 Security, d3security.com/morpheusread 2026-10-05