Dropzone AI vs UnderDefense (2026)

Dropzone has more than 90 integrations across SIEM, EDR, cloud, identity and email, read only by default. Response Actions run Python that the customer writes in an isolated container with stored secrets injected, to notify external systems, trigger remediation and apply policy actions.

Sourcedocs.dropzone.ai/platform/settings/response-actionsread 2026-10-22

More than 100 integrations come ready to use. Queries run against the customer's SIEM, Splunk or Elastic, containment is automated, and results go to Microsoft Teams, Jira or Slack, or by email, so UnderDefense acts in those outside systems itself. Named integrations also include Microsoft Sentinel, Google Chronicle, IBM QRadar, CrowdStrike, SentinelOne, Palo Alto Networks, AWS, Azure, GCP and Okta. Containment isolates infected devices from the network with ready to use playbooks.

SourceUnderDefense, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Beyond the agent's own multi step investigation, customers configure what follows it. Response Automations fire on more than 50 triggers, among them an investigation completing with a given status, and run the customer's own code, and versioned custom strategies set priority rules and investigation questions.

Sourcedocs.dropzone.ai/platform/settings/response-actionsread 2026-09-28

Six specialized AI Teammates pass an investigation along, from MITRE classification and SIEM index selection, through querying and validating evidence, to writing the verdict and routing it to workflows. They draw on 200+ agent skills and 400+ AI tools. Evidence gathering turns the investigation plan in a workbook into precise SIEM queries, and validation scores each piece of evidence as benign, suspicious or malicious before the verdict is written.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

Every alert the connected tools raise starts an investigation, hunts run on a schedule and on new CVEs and campaigns, and response automations fire on more than 50 system triggers.

Sourcedropzone.airead 2026-10-22

A Teammate classifies each incoming alert against MITRE ATT&CK and investigates it around the clock, with automated containment within 5 minutes of detection, so each arriving alert starts the work. Classification works even when the detection rule carries no ATT&CK metadata, a full investigation takes about 2 minutes, and critical alerts carry a 20 minute response SLA.

SourceUnderDefense, underdefense.com/maxi-ai, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Investigations query the customer's own tools live through the integrations, and analysts set custom strategies and define normal behavior. Context Memory serves as the persistent store, and no separate maintained index over the customer's documents is described.

Sourcedocs.dropzone.ai/platform/settings/custom-strategiesread 2026-09-28

MAXI builds a persistent knowledge map of the customer's environment that gets smarter with every investigation, and RAG is named in the MAXI stack. The Teammates draw on that map. It starts with the SIEM, where one Teammate picks the most relevant log indices from environments with hundreds of them. Detection logic is kept as code, and UnderDefense says agents, workflows, MCP and RAG together raise performance by more than 70%.

SourceUnderDefense, underdefense.com/maxi-ai, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Context Memory holds institutional facts across investigations. The agent writes to it when analysts change a conclusion, users add notes directly, and it can be reached through the API. Its scope and lifetime are not stated, and Dropzone only advises cleaning it up from time to time.

Sourcedocs.dropzone.ai/platform/context-memoryread 2026-09-28

Apart from the persistent knowledge map the Teammates draw on, the agents have no memory, and nothing says what they keep or for how long. That map is built from the customer's SIEM indices and improves with every investigation.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

Analysts approve or reopen each investigation in the product and from Slack (/dzapprove, /dzreopen), access to the customer's tools is read only by default, and response actions run only where the customer has configured them.

Sourcedocs.dropzone.ai/integrations/tools/slack-chatopsread 2026-09-28

Analysts validate and tune, verdicts come with a confidence level and a narrative meant for human review, and ChatOps asks affected employees through Slack or Teams to confirm suspicious activity such as a login attempt. Containment is automated within minutes through predefined playbooks, and no approval step comes before a response action goes through. UnderDefense says people are still needed to tune, verify and trust the system, while the AI handles 80% of Tier 1 and Tier 2 work.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05

Users sign in locally or through Microsoft, Google or a SAML provider such as Okta or Microsoft Entra, under three roles, Administrator, Member and Restricted Read Only. Dropzone holds SOC 2 Type 2, following a Type 1 audit by Sensiba, runs an annual third party penetration test and a trust center at trustcenter.dropzone.ai, and uses no customer data to train models.

Sourcedropzone.ai/security-privacy-trustread 2026-10-22

UnderDefense holds SOC 2 Type I, audited by Prescient Assurance. It now also holds ISO/IEC 27001:2022 certification covering MAXI MDR and MAXI Compliance AI, and says its SOC 2 Type II examination is in its final stage. MAXI Compliance AI has a view only Auditor role under role based access control, but UnderDefense names no SSO, roles or user access controls for the MAXI AI SOC itself.

SourceUnderDefense, underdefense.com/company-news SOC 2 post and underdefense.com/blog ISO 27001 postread 2026-10-05

Each investigation produces an evidence backed report that shows the agent's reasoning, and every response action's output, errors and execution status are logged for auditing.

Sourcedocs.dropzone.ai/platform/settings/response-actionsread 2026-09-28

Every step of the AI SOC layer is auditable, and each investigation ends in a verdict, a confidence level and a narrative for review or regulatory documentation, the agents' own record of their steps. Validation scores each piece of evidence as benign, suspicious or malicious, and the full investigation output goes to Microsoft Teams, Jira, Slack or email.

SourceUnderDefense, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Each customer gets a dedicated tenant in its own AWS subnet, normally in us-west-2, with optional regional deployments and in-region EU deployment on request for GDPR. An optional connector reaches security tools the customer runs on premises, and the Enterprise plan includes a dedicated single tenant environment.

Sourcedropzone.ai/security-privacy-trustread 2026-10-22

The on premises edition, sold as MAXI Agentic AI SOC On-Premise, runs entirely within the customer's own closed infrastructure, on any Kubernetes, data center or private cloud in any jurisdiction, including air gapped sites, with zero data leaving the perimeter. It is available now for enterprise customers worldwide. On prepared infrastructure, a full deployment finishes in under five minutes.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

Two agents ship, each doing its own job, the AI SOC Analyst for alert investigation and the AI Threat Hunter for hypothesis driven hunts, with prebuilt hunt packs such as APT29. An AI Threat Intel Analyst is planned that turns each new CVE or campaign into a hunt pack for the Threat Hunter, and COACH, a free Chrome extension, walks analysts through an alert step by step.

Sourcedropzone.airead 2026-10-22

Six AI Teammates are described by role but not named, with 200+ agent skills and 400+ AI tools behind them. They work inside UnderDefense's own investigation pipeline, not as agents a customer picks up one at a time. The platform ships with more than 700 investigation workbooks mapped to MITRE ATT&CK, and containment uses ready to use playbooks. UnderDefense's site gives no figure of 1,500+ correlation rules. MAXI Compliance AI, a separate product, automates evidence collection and security questionnaires for SOC 2, ISO 27001, HIPAA and PCI DSS.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launch and underdefense.comread 2026-10-05

Dropzone runs on several named LLM services, including Anthropic, Azure OpenAI and Perplexity, and chooses among them itself. Customers cannot choose the model.

Sourcedropzone.ai/security-privacy-trustread 2026-10-22

Customers can bring their own AI model through Azure AI Foundry or AWS Bedrock, or run sovereign open source models hosted entirely inside their own perimeter, so the customer chooses the model. That choice comes with the on premises edition, which keeps all data inside the customer's network.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

Developers get a REST API under /app/api/v1 with Api-Key authorization that covers investigations, bulk feedback, user notes, context memory, custom strategies, response actions and system events, with an OpenAPI 3.0.3 spec and a Swagger UI in the product.

Sourcedocs.dropzone.ai/apiread 2026-09-28

UnderDefense publishes no public API, SDK or MCP server for building on MAXI. The MAXI page names MCP among its technologies without an endpoint or tools. Detection logic is managed as code, and results reach outside tools through the built in integrations.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05

Analysts record feedback on investigations singly or in bulk and can reopen a conclusion, reviewing the agent's output after the fact. There is no evaluation harness, scored test set or gate before a strategy change goes live.

Sourcedocs.dropzone.ai/apiread 2026-09-28

Customers get no way to test or evaluate the Teammates themselves. Analyst tuning is part of the service. UnderDefense reports investigations 153 times faster, 99% less noise and 99%+ MITRE ATT&CK coverage, and a 15 minute mean time to contain for its MDR service.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05

The agent queries the customer's tools through their APIs, and driving a browser, desktop or remote computer is not described.

Sourcedropzone.airead 2026-09-28

The Teammates work through SIEM queries and integrations, and there is no browser or computer use. Endpoint containment, such as isolating an infected device, runs as an automated playbook action.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05