D3 Security (Morpheus) vs Prophet Security (2026)

There are 800+ self-healing integrations across SIEM, EDR, IAM, cloud, email, NDR and DLP, with response actions run through playbooks and integration commands that sign in to outside systems and act there. Named connections include Microsoft, CrowdStrike, SentinelOne, Splunk, LogRhythm, Elastic, Fortinet, Okta, Zscaler and Recorded Future. When a connector drifts it repairs itself, with an 18 minute mean time to recover that D3 sets against weeks for manual fixes, and a command details panel shows each integration's commands and sample data.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

More than 200 integrations come out of the box, and the AI SOC Analyst responds through scoped, permissioned Agent Actions in the customer's systems, from notifications to quarantining a machine. Results are delivered to Slack, Teams or the customer's own webhook. Investigations query SIEM, EDR, identity, cloud and email tools, and delivery can be set separately for each channel.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

Response playbooks are generated at runtime for each incident, and adaptive playbooks are built from the chat interface with Approval blocks. Customers also build their own playbooks in the platform's SOAR engine, set to start when a case escalates or when data is ingested. Adaptive playbooks combine Morpheus Agent, Router, Parallel, Send Email and Approval blocks, and an investigation playbook can be run from the incident chat. An Agentic Task capability puts bounded LLM reasoning inside a playbook step, and legacy SOAR playbooks keep working during a migration.

SourceD3 Security, docs.d3security.com Morpheus releases and d3security.com/morpheusread 2026-10-05

Each alert runs through a fixed investigation, determination and response sequence, and customers can add guidance to a single step. There is no branching, conditions, handoff between agents or workflow that customers build. Related investigations are grouped into incidents automatically.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

The moment an alert lands, the investigation engine assembles the attack-path story, and playbooks run on ingestion or escalation, so work starts with no one asking. Every alert is triaged, so none is closed silently, and analysts can also launch an investigation playbook from the incident chat.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Alerts are investigated the moment they arrive, 100 percent of them at every severity, with no analyst starting the work. Each investigation begins by summarizing the alert, pulling out its artifacts and planning the questions an expert analyst would ask.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

The Cybersecurity Triage Reasoning Graph encodes senior analyst reasoning built by D3's specialists. It holds D3's own security knowledge, not a map of the customer's systems.

Attack Path Discovery assembles evidence across the customer's EDR, identity, email, cloud and network sources for each alert, and D3 publishes no way for a customer to load its own material for Morpheus to search. D3 says the graph took 24 months and 60 specialists to build.

Linked incident search finds related cases by severity, status, type, owner, tags, tactic, technique or creation date, and global lists can be edited in bulk as JSON.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Investigations gather evidence live across the customer's connected tools and apply the guidance the customer writes. There is no index, graph or embeddings layer over the customer's own knowledge. The AI Detection Engineer maps the customer's MITRE ATT&CK coverage from its own investigations.

SourceProphet Security, prophetsecurity.ai/ai-soc-analyst and prophetsecurity.airead 2026-10-05

Since release 18.4, Morpheus reviews how an incident was handled and converts the workflow into a reusable SOP skill, a stored artifact carried forward. D3 does not say who can use an SOP skill or how long one is kept. Case files hold the record of each incident. Analysts or Morpheus itself can then run an SOP skill on later incidents that look alike.

SourceD3 Security, docs.d3security.com Morpheus releasesread 2026-10-05

Customers teach the agent playbooks, policies and preferences in plain language, organization wide, per investigation or per step. Nothing is learned silently, and every entry's source is visible and correctable. What the agent learns carries into every later investigation and stays when an analyst leaves. Most entries are guidance the product applies, and Prophet does not say how long they are kept.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

There are four autonomy modes (Deterministic, AI-Assisted, AI-Led, Autonomous), command-risk tagging sets the approval gate for response actions, and adaptive playbooks start from a plan for analyst approval with an Approval block type, so approval comes before the action commits. In AI-Assisted mode an analyst approves every action, in AI-Led mode the analyst oversees command risk tiers, and Autonomous mode keeps approval gates that can be set per workflow, per tenant or per regulator. Attack Path Discovery is read only and takes no action on its own.

SourceD3 Security, d3security.com/morpheusread 2026-10-05

Agent Actions run autonomously or only with the customer's sign-off, each remediation is previewed before it runs, and actions are scoped and permissioned. Autonomy covers only the actions a customer has approved, and the customer widens that scope when the agent's track record justifies it. With the optional Watchtower service, an expert engages within 30 minutes on every malicious or inconclusive determination, around the clock, guiding the response by default and running containment, with a rollback plan, only when the customer asks.

SourceProphet Security, prophetsecurity.ai/ai-soc-analyst and prophetsecurity.ai/watchtowerread 2026-10-22

D3 Security is SOC 2 Type II certified, and the platform has access controls with roles and groups carrying permissions, sites for business-unit separation and multi-tenancy. D3 is a member of the Microsoft Intelligent Security Association, and the platform aligns with MITRE ATT&CK and D3FEND. Named user licenses come with every subscription, and multi tenant deployments keep each client's data, configuration and views apart.

SourceD3 Security, docs.d3security.com user docs and d3security.com/resources/faqread 2026-10-05

Prophet states SOC 2 Type II, ISO/IEC 27001:2022 and ISO/IEC 42001:2023, and the homepage carries a SOC 2 Type 2 badge. There is no SSO, SCIM or user role model, and scoped Agent Actions limit what the agent can do, not what users can reach. The trust center sits at trust.prophetsecurity.ai, and Prophet does not train AI models on personal data.

SourceProphet Security, trust.prophetsecurity.ai and prophetsecurity.airead 2026-10-05

Each incident has one unified audit trail of every action, decision and task across all six capabilities, with a complete evidence chain for every investigation, so each investigation keeps its own run record. The trail uses the same format across every capability and autonomy mode, and every element of an attack path comes from a real tool query that is timestamped and attributed. D3 positions the trail for review under SEC, NYDFS, HIPAA, NERC CIP, NIS2, DORA and the EU AI Act, and a utility command retrieves attack path results with their AI summaries.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Every question asked, every query run and every reasoning step in an investigation is documented, so the team can verify exactly how a determination was reached. Watchtower sends validated escalations in under 30 minutes, and results can go to Slack, Teams or a webhook for each channel.

SourceProphet Security, prophetsecurity.ai/ai-soc-analyst and prophetsecurity.airead 2026-10-05

The platform is hosted on Microsoft Azure across named geographies (US, Canada, EU, UK, APAC, Gulf, Nordics) with data residency configurations, and cloud, on-premise, hybrid and air-gapped deployments are supported. Azure regions include the United States, Canada, Ireland for the EU and Japan, and the residency configurations address GDPR, EU data sovereignty and regional government mandates. MSSPs get a native multi tenant architecture with isolated client data, per tenant configuration and segregated client views.

SourceD3 Security, d3security.com/resources/faq and /morpheusread 2026-10-05

Each customer gets a dedicated single tenant with a bring your own key option. Prophet does not say where that tenant is hosted, and offers no region choice or customer environment option such as VPC or on premises.

Sourceprophetsecurity.airead 2026-10-22

Morpheus ships one reasoning engine with six named capabilities and generates playbooks at runtime, and SOP skills are derived from the customer's own incidents. There is no catalog of named prebuilt agents or templates. The six capabilities are triage, investigation, response and orchestration, self healing integrations, agentic tasks and autonomy modes, all in one subscription priced as a fixed annual fee by daily alert volume, from 500 to 10,000 alerts a day with custom tiers above, plus named user licenses.

SourceD3 Security, d3security.com/morpheus and /resources/faqread 2026-10-05

Prophet ships three agents that each do their own job. The AI SOC Analyst investigates alerts, the AI Threat Hunter runs natural language and ready to run hunts, and the AI Detection Engineer maps ATT&CK coverage and ships backtested detections. Watchtower is a human review service, not an agent. Use cases span endpoint, email, identity, cloud, DLP and network alerts, and named customers include Redis, Udemy, Instacart, Penske and Moveworks.

SourceProphet Security, prophetsecurity.airead 2026-10-05

Morpheus also supports customer-preferred LLMs for organizations that require it, without changing the pricing structure, so a customer can bring its own model, and the default models are not named. The Agentic Task capability is provider agnostic and runs through D3's built in connector or the customer's existing AI vendor contract. D3 absorbs all token and inference costs within the subscription, and the Triage Reasoning Graph is included at no extra cost.

SourceD3 Security, d3security.com/resources/faq and /morpheusread 2026-10-05

Prophet names no models or providers behind Prophet AI and offers no model choice.

Sourceprophetsecurity.airead 2026-09-28

The D3 Command API (API key or JWT auth, POST endpoints for Incidents, Events, Playbooks, Artifacts, Files, Users, Sites and GlobalLists) comes with utility command docs, and there is no MCP server. Release 18.4 lets teams organize custom utility commands in nested folders and filter command search by connection, and it added a command that returns attack path results.

SourceD3 Security, docs.d3security.com API docs and Morpheus releasesread 2026-10-05

Developers have no way in. There is no API, SDK or MCP server for the Prophet platform, and there are no developer or docs pages. Outbound delivery to the customer's own webhook is the platform calling out, not an interface for calling it.

Sourceprophetsecurity.ai/sitemap.xmlread 2026-10-22

D3 tests Morpheus against simulated attacks and adversarial inputs as part of its own release work and publishes revelation and closure rates. Customers get no published way to test Morpheus on their own deployment. D3's own figure is that up to 95 percent of alerts are triaged and investigated to L2 depth in under two minutes.

SourceD3 Security, d3security.com/morpheusread 2026-10-05

Changes to the agent's guidance are previewed and backtested against the customer's own alert history before they apply, so a change has to hold up on past alerts first. Remediations and new detections are backtested the same way. One customer reports 95% less manual review, and Prophet cites a 10 times faster MTTR.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

There is no browser or computer use by Morpheus, which acts through integrations and commands. Attack Path Discovery queries the connected tools through their APIs and stays read only.

SourceD3 Security, d3security.com/morpheusread 2026-10-05

The agents do not drive a browser, desktop or remote computer. They act through integrations.

Sourceprophetsecurity.airead 2026-09-28