Exaforce vs Simbian (2026)

More than 140 sources across identity, cloud, endpoint, code and SaaS feed the platform, and Exabot Respond takes action in them. It quarantines endpoints and emails, isolates hosts, updates security groups, and suspends users, resets MFA and revokes sessions across Okta, Entra ID and AWS, and it acts on tickets in ServiceNow.

Exabot Triage also works alerts from a SIEM or EDR the customer keeps, such as Splunk and CrowdStrike, and the data platform can run alongside an existing SIEM. Claude Enterprise activity arrives through the Claude Compliance API, with OpenAI, Gemini and Microsoft Copilot added for AI Security. Response workflows can call REST APIs and webhooks and use Perplexity for web search, and customers can request new integrations.

SourceExaforce, exaforce.com/ai-info, /platform/exabot-respond and /platform/exabot-triage; exaforce.com/platform/exabot-respondread 2026-10-24

Simbian reads more than 100 integrated sources (SIEM, EDR, XDR, identity, CVE feeds, firewall rules, ITSM) and writes back into the customer's tools, with response actions in EDR, cloud and Active Directory, detection rules in the SIEM's own query language, WAF and firewall rules, and ITSM tickets. Sources also include CDR tools, bug databases, threat hunts and pentest reports.

SourceSimbian, simbian.ai and /self-improving-defenseread 2026-10-05

Teams build response workflows in a visual drag and drop builder with nodes for conditions, actions, approvals, AI reasoning, loops and branching, and can mix autonomous and approved steps in one workflow, beside the Detect, Triage, Investigate and Respond Exabots. Deterministic steps sit beside reasoning nodes that interpret context.

SourceExaforce, exaforce.com/platform/exabot-respondread 2026-10-05

Several agents hand work to each other: when alerts cluster on an application the SOC Agent launches a pentest, and the proven exploit becomes a detection rule, a WAF rule, a network firewall rule and a patch ticket, with SOC, Pentest, Threat Hunt and NetSecOps agents sharing one Context Lake. One alert can produce a response, a tighter detection, a closed attack path, or a false positive tuned down for good. Simbian describes the loop as seeing a threat, investigating, responding, scoring its own work and proposing a better version of itself.

SourceSimbian, simbian.ai/self-improving-defenseread 2026-10-05

Detections and alerts from ingested telemetry start triage and investigation without a person asking, and response workflows trigger automatically, on a schedule or manually. Analysts can also start work by asking a hypothesis in plain language, by voice in the ExaGo mobile app, which answers aloud and supports more than 30 spoken languages, or from Claude through the MCP connector. With the managed MDR option, Exaforce analysts and the Exabots run the SOC around the clock.

SourceExaforce, exaforce.com/platform/exabot-respond, the ExaGo press release and exaforce.comread 2026-10-24

Work starts without a person asking: every alert is investigated on arrival, clustered alerts launch a pentest, and vulnerability feeds and peer breach reports start agent work. The SOC Agent begins the instant an alert is detected and reaches a response in under 4 minutes on average.

SourceSimbian, simbian.ai/self-improving-defense and /products/ai-soc-agentread 2026-10-05

A semantic model builds and maintains relationships between the customer's identities, resources and actions as a living map of the environment, over a data platform that ingests and normalizes the customer's security data, with the customer's business context (org structure, policies, roles) layered in. The knowledge model blends technical expertise, curated outside intelligence and awareness of the environment, drawing on LLM reasoning, past decisions and fixed business rules. The data platform covers cloud, SaaS, identity, code and endpoint data.

SourceExaforce, exaforce.com/platform/multi-model-airead 2026-10-05

Context Lake is an organization wide, persistent map of the customer's assets and identities built from more than 100 sources, including SIEM, EDR, identity, CVE feeds, pentest reports, firewall rules and ITSM runbooks, which every agent queries. It stays in the customer's tenant. It also holds every past verdict, so a new investigation starts from what earlier ones found.

SourceSimbian, simbian.ai and /products/ai-soc-agentread 2026-10-05

The knowledge model draws on historic decisions, user confirmations and outcomes, so state carries across investigations, and the semantic model stores context in a structured form. Exaforce sets out no scope or retention period for that store.

SourceExaforce, exaforce.com/platform/multi-model-airead 2026-10-05

Every alert the SOC Agent closes is written back to the shared Context Lake, an organization wide persistent memory the other agents read, so they start with prior context instead of starting cold. Simbian does not say how long that memory is kept or how to delete anything from it.

SourceSimbian, simbian.ai/products/ai-soc-agent and simbian.airead 2026-10-05

Response workflows can require human approval through Slack, Teams or email before an action runs, with timeouts falling back to safe defaults (pause, rollback or limited containment), and Exaforce calls its responses approved and reversible. Ready made prompts ask users and managers to confirm with buttons, timeouts and automatic escalation, and Exabot Respond is sold as automated action with analyst oversight. Analysts can also approve response actions by voice from the ExaGo mobile app.

SourceExaforce, exaforce.com/platform/exabot-respond, the ExaGo press release and exaforce.comread 2026-10-24

The customer's analysts approve the responses Simbian proposes, and Simbian reports that 95 percent are approved. Before the agents change their own skills, Simbian shows the change and its evidence, and the customer approves before anything is applied. Every action passes through a gate and can require approval, and customers lift gates one action type at a time on their own schedule. Anything that touches an employee, and anything destructive, stays gated permanently.

SourceSimbian, simbian.ai/self-improving-defenseread 2026-10-05

Exaforce is independently audited for SOC 2 Type 2, ISO 27001 and HITRUST, holding HITRUST e1 certification since October 2025, and states HIPAA, GDPR and PCI DSS compliance. API tokens carry roles and an expiry, and access through them is scoped to those roles. It gives no public detail on SSO, SCIM or the user role model. The product docs sit behind the app login, and the trust center is at trust.exaforce.com. System status is published at exaforcestatus.com.

SourceExaforce, exaforce.com/ai-info, /blogs we're HITRUST certified and /platform/exaforce-claude-mcp-connectorread 2026-10-24

Simbian publishes no attestation and no SSO, SCIM or role model. Its DPA lists Auth0 as the authentication sub-processor, and it has no security page or trust center. Simbian says its TrustedLLM is hardened against prompt injection and data poisoning.

SourceSimbian, simbian.ai/legal/dpa and simbian.airead 2026-10-05

Every decision and approval in a response workflow is fully audited, and the team gets full visibility into every decision and action the Exabots take, with investigations shown in case context and explainable anomaly scores. Results come back as clear summaries with supporting evidence, so analysts and auditors see the reasoning behind each answer.

SourceExaforce, exaforce.com/platform/exabot-respond and /platform/multi-model-airead 2026-10-05

Each investigation returns a verdict with its reasoning, which analysts can watch and correct, and self scoring shows which cases fell short and why. There is no per run trace of the steps and tool calls, and no audit log. Each verdict carries a confidence rating and a severity that weighs business impact.

SourceSimbian, simbian.ai/products/ai-soc-agent and /self-improving-defenseread 2026-10-05

Every customer runs on dedicated, isolated infrastructure, so there is no data level multi tenancy. Customers cannot choose a hosting region or run the platform in their own environment, and the login host carries a us label. The data platform keeps 90 days of correlated data in memory for investigation and the full raw data in a lower cost data lake for compliance and forensics. Self managed means the customer's team runs the SOC on Exaforce's platform, and with Exaforce MDR, Exaforce analysts run it as a 24/7 SOC while the customer keeps full access.

SourceExaforce, exaforce.com/blogs we're HITRUST certified, /platform/data-platform and exaforce.comread 2026-10-24

The AI SOC Agent is offered as SaaS or as an on premises agent, and the Context Lake stays in the customer's tenant. No hosting regions are named, and the DPA lists US based sub-processors. Simbian says the SOC Agent deploys in hours with minimal configuration.

SourceSimbian, simbian.ai/products/ai-soc-agent and /legal/dparead 2026-10-05

Four named prebuilt agents have separate jobs. Exabot Detect, Exabot Triage, Exabot Investigate and Exabot Respond each do their own stage of SOC work, and Exabot Respond comes with playbooks for common scenarios, with new ones written in natural language. Exaforce AI Security, added in September 2026, inventories the AI agents, apps, skills and MCP servers in use, scores their risk and can stop a rogue agent with a kill switch. ExaGo, a voice driven mobile app launched in July 2026, runs the same Exabots from a phone or Apple Watch. Exaforce also sells the platform as a managed MDR service.

SourceExaforce, exaforce.com, /ai-info and the ExaGo and AI Security press releasesread 2026-10-24

The lineup is four named agents, each with its own job: the AI SOC Agent investigates alerts, the AI Pentest Agent tests and validates exploit paths, the AI Threat Hunt Agent tests hypotheses against historical data, and the AI NetSecOps Agent runs firewall and network operations around the clock. Named customers include Bottomline, Matillion, Axelar and Wipro, and Simbian says it runs in more than 300 enterprise environments.

SourceSimbian, simbian.airead 2026-10-05

Exaforce combines its own semantic, behavioral and knowledge models with LLMs from providers it does not name, and customers cannot choose the model. The LLMs act as the reasoning layer and take validated entities and calculated scores as input, which Exaforce says keeps them from hallucinating. The behavioral model learns what normal looks like for every entity and produces explainable anomaly scores.

SourceExaforce, exaforce.com/platform/multi-model-airead 2026-10-05

Simbian does not name the models behind its agents or offer the customer a model choice. The 27 models on its homepage are the entrants in its Cyber Defense Benchmark research, not options in the product. The entrants include Claude, GPT, Grok, GLM, DeepSeek and Kimi models, and the best of the 27 covers 45.1% of MITRE tactics.

SourceSimbian, simbian.airead 2026-10-05

Customers can connect Claude to their Exaforce tenant through an MCP connector.

A user generates an API token in the Exaforce console with an expiry and roles, points Claude Desktop or Claude Code at the tenant's /mcp/ endpoint, and an exabot_search tool answers questions about alerts, investigations, audit logs and configuration, scoped to the token's roles. The connector is a query path, so data stays in the tenant.

There is no public API reference or SDK, and the product docs at docs.exaforce.com sit behind the app login. Customers who need a source that is not listed can request an integration.

SourceExaforce, exaforce.com/platform/exaforce-claude-mcp-connector and /platform/integrationsread 2026-10-24

There are no developer docs and no API, SDK or MCP server for the Simbian platform. Simbian connects to the tools a customer already runs through its 100+ integrations, multi vendor from day one.

SourceSimbian, simbian.ai and /products/ai-soc-agentread 2026-10-05

The Exabots come with no evaluation harness, scored test cases, quality gate or optimization loop. Exaforce claims 90% fewer false positives, 95% less time to investigate, under 30 minutes from alert to response and more than $600K average savings against a traditional SOC stack.

SourceExaforce, exaforce.comread 2026-10-05

Simbian builds a test for a customer authored objective, scores itself on the customer's own data and shows which cases fell short and why, and proposed changes to its skills are shown with evidence for approval before they apply. It checks itself constantly where it is unsure and rarely where it is confident. Customers write objectives such as never paying a ransom, keeping a production line running or answering every alert.

SourceSimbian, simbian.ai/self-improving-defenseread 2026-10-05

Agents act through integrations, and no Exabot drives a browser, desktop or remote computer. Exabot Investigate hunts without the analyst writing SIEM queries.

SourceExaforce, exaforce.comread 2026-10-05

No agent drives a browser, desktop or remote computer. The agents read and write through integrations, and Simbian does not describe the pentest agent reaching applications through browser control. Response actions land in EDR, cloud and Active Directory through those integrations.

SourceSimbian, simbian.ai and /self-improving-defenseread 2026-10-05