Agentic Index
ContraForce vs Prophet Security (2026)
ContraForce last verified ·Prophet Security last verified
ContraForce and Prophet Security both investigate and respond to alerts, for different buyers. That verdict is the Agentic Index coverage score, graded from each vendor's own published materials.
ContraForce serves MSPs and MSSPs on Microsoft Defender XDR and Sentinel, running triage, investigation, response and customer reporting across tenants under each workspace's own procedures, with Starter from $249 a month for four client workspaces and a flat rate per incident quoted by ContraForce. Prophet serves enterprise SOCs over their existing tools with an analyst, a threat hunter and a detection engineer, through sales with no public price. ContraForce runs inside Microsoft's security stack across customer tenants, and Prophet ships named agents for hunting and detection engineering and checks guidance on old alerts first. Choose ContraForce for multi tenant Microsoft delivery, and Prophet for an enterprise SOC that wants tested guidance.
On the Agentic Index AI SOC ranking, ContraForce clears the bar and Prophet Security does not. ContraForce documents all five investigation loop capabilities in full; Prophet Security does not document workflow orchestration in full. 25 of the 86 vendors in the lane clear it. See the AI SOC ranking
This comparison is published by Agentic Index, an independent agentic AI vendor research platform. ContraForce and Prophet Security are each graded against the same 14 capability Agentic Index taxonomy, from the vendor's own public materials under the Agentic Index verification standard, alongside 1,084 researched vendors. No vendor pays for placement and no vendor has reviewed this page. How this evidence is graded
Choose ContraForce if
- You deliver security to many customers on Defender XDR and Sentinel.
- Work spans many customer tenants on Microsoft Defender XDR and Sentinel.
- Published prices matter to how you package your own service.
Choose Prophet Security if
- You run one enterprise SOC across tools from several vendors.
- Guidance changes should be tried on past alerts before they go live.
- Detection engineering belongs in the same platform.
| Feature | C ContraForce |
P Prophet Security |
|---|---|---|
| Action & orchestration | ||
|
Integrations & Tool Calling Ability to connect agents to real systems through native integrations, OAuth-authenticated actions, custom tools, APIs, webhooks, or MCP-compatible tools. |
||
|
ContraForceIntegrations & Tool Calling Named integrations cover Microsoft Defender XDR, Microsoft Sentinel, SentinelOne, CrowdStrike, Autotask, ServiceNow, Jira and Azure Lighthouse, and the agent takes response actions in them such as Isolate Endpoint, Reset User Password, Lockout User, Quarantine File, Block Cloud IP and Delete Email. Sourcecontraforce.com/platformread 2026-09-28 |
||
|
Prophet SecurityIntegrations & Tool Calling More than 200 integrations come out of the box, and the AI SOC Analyst responds through scoped, permissioned Agent Actions in the customer's systems, from notifications to quarantining a machine. Results are delivered to Slack, Teams or the customer's own webhook. Investigations query SIEM, EDR, identity, cloud and email tools, and delivery can be set separately for each channel. SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05 |
||
|
Workflow Orchestration Ability to sequence, branch, retry, route, and combine deterministic workflow nodes with autonomous agent steps. |
||
|
ContraForceWorkflow Orchestration Security Delivery Agents run the delivery loop from triage and investigation through response, ticketing and customer reporting. Customers shape the flow, with uploaded response operating procedures setting the containment and remediation steps, settings per severity and classification deciding what runs automatically, and ordered Gamebook run policies blocking, allowing or routing each action. Sourcedocs.contraforce.com/guides/getting-started/configuring-security-delivery-agentsread 2026-09-28 |
||
|
Prophet SecurityWorkflow Orchestration Each alert runs through a fixed investigation, determination and response sequence, and customers can add guidance to a single step. There is no branching, conditions, handoff between agents or workflow that customers build. Related investigations are grouped into incidents automatically. SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05 |
||
|
Triggers & Channel Coverage How agents wake up and where they work: schedules, webhooks, message events, CRM events, inbox events, chat, email, voice, and collaboration tools. |
||
|
ContraForceTriggers & Channel Coverage The On Queue setting runs the agent automatically on every incident of a configured severity, and Agent Shifts set the weekly hours in which it investigates on its own. Manual runs remain available. Sourcedocs.contraforce.com/guides/agent-center/agent-shiftsread 2026-09-28 |
||
|
Prophet SecurityTriggers & Channel Coverage Alerts are investigated the moment they arrive, 100 percent of them at every severity, with no analyst starting the work. Each investigation begins by summarizing the alert, pulling out its artifacts and planning the questions an expert analyst would ask. SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05 |
||
| Knowledge & context | ||
|
Knowledge Grounding & RAG Ability to ground agent behavior in company data through document ingestion, retrieval, external knowledge APIs, semantic search, or RAG layers. |
||
|
ContraForceKnowledge Grounding & RAG ContraForce grounds the agent in an SOP Knowledge Base, where customers upload classification and response operating procedures as Markdown or text, versioned by re-upload and scoped per workspace, for the agent to draw on in each incident. An Entity Context Graph of the incident's users, devices and IPs sits alongside it. Sourcedocs.contraforce.com/guides/agent-center/operating-proceduresread 2026-09-28 |
||
|
Prophet SecurityKnowledge Grounding & RAG Investigations gather evidence live across the customer's connected tools and apply the guidance the customer writes. There is no index, graph or embeddings layer over the customer's own knowledge. The AI Detection Engineer maps the customer's MITRE ATT&CK coverage from its own investigations. SourceProphet Security, prophetsecurity.ai/ai-soc-analyst and prophetsecurity.airead 2026-10-05 |
||
|
Memory & State Persistence Ability to persist context across a run, conversation, workflow, user, team, or longer-term memory layer. |
||
|
ContraForceMemory & State Persistence The agent has no memory with a set scope and lifetime, and no context engine or remediation snapshots are described. The SOP Knowledge Base grounds the agent but is not memory. Sourcedocs.contraforce.com/guides/agent-center/operating-proceduresread 2026-09-28 |
||
|
Prophet SecurityMemory & State Persistence Customers teach the agent playbooks, policies and preferences in plain language, organization wide, per investigation or per step. Nothing is learned silently, and every entry's source is visible and correctable. What the agent learns carries into every later investigation and stays when an analyst leaves. Most entries are guidance the product applies, and Prophet does not say how long they are kept. SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05 |
||
| Control & trust | ||
|
Human Oversight & Guardrails Approval steps, consent checkpoints, escalation rules, structured guardrails, policy constraints, and pause/resume controls. |
||
|
ContraForceHuman Oversight & Guardrails Gamebook run policies are ordered rules that block an action, allow it or send it to an approver first, and high-impact actions such as Isolate Endpoint and Reset User Password sit behind a named approver. Below a confidence threshold, the agent leaves actions to an analyst. Sourcedocs.contraforce.com/guides/getting-started/what-are-gamebooksread 2026-09-28 |
||
|
Prophet SecurityHuman Oversight & Guardrails Agent Actions run autonomously or only with the customer's sign-off, each remediation is previewed before it runs, and actions are scoped and permissioned. Autonomy covers only the actions a customer has approved, and the customer widens that scope when the agent's track record justifies it. With the optional Watchtower service, an expert engages within 30 minutes on every malicious or inconclusive determination, around the clock, guiding the response by default and running containment, with a rollback plan, only when the customer asks. SourceProphet Security, prophetsecurity.ai/ai-soc-analyst and prophetsecurity.ai/watchtowerread 2026-10-22 |
||
|
Security, Identity & Governance RBAC, SSO, auditability, encryption, least-privilege tool access, compliance posture, and data handling policy. |
||
|
ContraForceSecurity, Identity & Governance SSO and audit logs come on every plan, alongside SOC 2 Type II certification, alignment to ISO 27001:2022, SCIM provisioning on Scale, user roles and permissions and federated least-privilege access. Sourcecontraforce.com/pricingread 2026-09-28 |
||
|
Prophet SecuritySecurity, Identity & Governance Prophet states SOC 2 Type II, ISO/IEC 27001:2022 and ISO/IEC 42001:2023, and the homepage carries a SOC 2 Type 2 badge. There is no SSO, SCIM or user role model, and scoped Agent Actions limit what the agent can do, not what users can reach. The trust center sits at trust.prophetsecurity.ai, and Prophet does not train AI models on personal data. SourceProphet Security, trust.prophetsecurity.ai and prophetsecurity.airead 2026-10-05 |
||
|
Observability & Auditability Traces, logs, execution histories, metrics, audit events, and debugging detail for production agent behavior. |
||
|
ContraForceObservability & Auditability Every decision the agent makes, every action it takes and every approval gate is logged with full attribution. Agent Execution History records each run's trigger, incident, source, outcome and prompt, along with cached and completion token counts and USD cost, so each run has its own record. Sourcedocs.contraforce.com/guides/agent-center/agent-execution-historyread 2026-09-28 |
||
|
Prophet SecurityObservability & Auditability Every question asked, every query run and every reasoning step in an investigation is documented, so the team can verify exactly how a determination was reached. Watchtower sends validated escalations in under 30 minutes, and results can go to Slack, Teams or a webhook for each channel. SourceProphet Security, prophetsecurity.ai/ai-soc-analyst and prophetsecurity.airead 2026-10-05 |
||
|
Deployment & Data Residency Deployment modes and options, including SaaS, dedicated cloud, VPC, on-prem, hybrid, local runtime, and self-hosting. |
||
|
ContraForceDeployment & Data Residency Deployments run in the US and the UK, with customer data processed and stored only within the assigned regional deployment, a UK-resident stack and Data Zone Standard model deployments offered by region. An EU deployment is planned, and no self-hosted or customer-hosted deployment is offered. Sourcecontraforce.com/platformread 2026-09-28 |
||
|
Prophet SecurityDeployment & Data Residency Each customer gets a dedicated single tenant with a bring your own key option. Prophet does not say where that tenant is hosted, and offers no region choice or customer environment option such as VPC or on premises. Sourceprophetsecurity.airead 2026-10-22 |
||
| Solution readiness | ||
|
Prebuilt Agents, Templates & Packs Ready-made workflows, packaged employees, templates, blueprints, industry solutions, and role-specific agents that reduce time-to-value. |
||
|
ContraForcePrebuilt Agents, Templates & Packs ContraForce ships one prebuilt agent type, the Security Delivery Agent, deployed per workspace, plus a fixed catalog of response actions. Gamebooks are assembled per incident from those actions, with no named template library, and the procedures are the customer's own uploads. Sourcedocs.contraforce.com/guides/getting-started/what-are-gamebooksread 2026-09-28 |
||
|
Prophet SecurityPrebuilt Agents, Templates & Packs Prophet ships three agents that each do their own job. The AI SOC Analyst investigates alerts, the AI Threat Hunter runs natural language and ready to run hunts, and the AI Detection Engineer maps ATT&CK coverage and ships backtested detections. Watchtower is a human review service, not an agent. Use cases span endpoint, email, identity, cloud, DLP and network alerts, and named customers include Redis, Udemy, Instacart, Penske and Moveworks. SourceProphet Security, prophetsecurity.airead 2026-10-05 |
||
| Platform extensibility | ||
|
Model Flexibility & Routing Ability to work across multiple foundation models, route tasks to different models, or let buyers bring their own providers and keys. |
||
|
ContraForceModel Flexibility & Routing When creating a Security Delivery Agent, the customer chooses the AI model and deployment type (Global Standard or Data Zone Standard) from the models available in the Agent Center's region, with upgrades to GPT-5.5 and GPT-5.6 depending on runtime support. Sourcedocs.contraforce.com/release-notesread 2026-09-28 |
||
|
Prophet SecurityModel Flexibility & Routing Prophet names no models or providers behind Prophet AI and offers no model choice. Sourceprophetsecurity.airead 2026-09-28 |
||
|
APIs, SDKs & MCP Extensibility Composability layer: stable APIs, SDKs, MCP tool consumption/serving, custom tools, and integration into internal systems. |
||
|
ContraForceAPIs, SDKs & MCP Extensibility Every plan includes a v2 REST API at portal.contraforce.com/api/v2, with service account Basic auth and workspace, cross-workspace and organization scoped endpoints for incidents, gamebooks, tickets, data sources and analytics rules, plus a webhook event reference that includes an agent investigation completed webhook. There is no MCP server. Sourcedocs.contraforce.com/api-reference/endpointsread 2026-09-28 |
||
|
Prophet SecurityAPIs, SDKs & MCP Extensibility Developers have no way in. There is no API, SDK or MCP server for the Prophet platform, and there are no developer or docs pages. Outbound delivery to the customer's own webhook is the platform calling out, not an interface for calling it. Sourceprophetsecurity.ai/sitemap.xmlread 2026-10-22 |
||
|
Testing, Debugging & Optimization Testing, debugging, scoring, retries, fallbacks, quality gates, and optimization loops for improving agent workflows before and after deployment. |
||
|
ContraForceTesting, Debugging & Optimization Rollout starts with investigation-only runs before response actions are enabled, and autonomy then expands one Gamebook at a time as verdicts hold up, which works as a dry-run style check on the agent's own output. There is no scored test harness. Sourcedocs.contraforce.com/guides/getting-started/configuring-security-delivery-agentsread 2026-09-28 |
||
|
Prophet SecurityTesting, Debugging & Optimization Changes to the agent's guidance are previewed and backtested against the customer's own alert history before they apply, so a change has to hold up on past alerts first. Remediations and new detections are backtested the same way. One customer reports 95% less manual review, and Prophet cites a 10 times faster MTTR. SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05 |
||
| Specialist automation | ||
|
Browser & Computer Use Browser, desktop, or remote/local computer control for workflows that cannot be handled through stable APIs alone. |
||
|
ContraForceBrowser & Computer Use The agent acts through API integrations, and browser or computer use is not described. Sourcecontraforce.com/platformread 2026-09-28 |
||
|
Prophet SecurityBrowser & Computer Use The agents do not drive a browser, desktop or remote computer. They act through integrations. Sourceprophetsecurity.airead 2026-09-28 |
||
Pricing snapshot
Sourced from the Index pricing dataset · open each vendor's profile for full detail.
| Pricing | C ContraForce |
P Prophet Security |
|---|---|---|
|
Entry price Lowest public entry point |
Starter from $249 per month (4 client workspaces), plus a flat rate per incident for each agent run, quoted by ContraForce. | Contact sales. Priced per investigation, with no data ingest fees, and no public rates. |
|
Pricing confidence How public the numbers are |
Public, partial | Contact only |
|
Billing Primary billing axis |
Monthly tier by client workspace allowance, plus a flat rate per Security Delivery Agent run. | Per investigation, with no data ingest fees, on an enterprise contract. |
|
Variable cost Workload / overage exposure |
Medium variable cost | Low variable cost |
|
Free tier / trial Try before you buy |
No free tierTrial
|
No free tierTrial
|
|
Buying motion Self-serve vs sales call |
Mixed | Sales call |
|
Pricing verified When this pricing was last checked |
Product updates
Newest first, each linked to its source.
ContraForce
-
· Human approval / guardrails
Owners and Incident Responders can now stop a gamebook while it runs: the action in progress finishes, nothing further starts, and the gamebook ends with a canceled status and the reason given.
Source -
· Human approval / guardrails
Gamebook approvers must now be people from the workspace or the managing organization, and AI agents and service accounts can no longer approve.
Source -
· Observability / auditability
ContraForce added email alerts when an agent investigation assigns an incident a malicious score at or above a configured threshold.
Source
Prophet Security
-
· Agent capability
Prophet Security announced the general availability of Prophet AI Threat Researcher and Emerging Threats within the Prophet AI Threat Hunter.
Source
More comparisons with ContraForce or Prophet Security
Other matchups in security and SOC agents
Not the pairing you were after? These compare a different set of security and SOC agents on the same 14 capabilities.