Prophet Security vs UnderDefense (2026)

More than 200 integrations come out of the box, and the AI SOC Analyst responds through scoped, permissioned Agent Actions in the customer's systems, from notifications to quarantining a machine. Results are delivered to Slack, Teams or the customer's own webhook. Investigations query SIEM, EDR, identity, cloud and email tools, and delivery can be set separately for each channel.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

More than 100 integrations come ready to use. Queries run against the customer's SIEM, Splunk or Elastic, containment is automated, and results go to Microsoft Teams, Jira or Slack, or by email, so UnderDefense acts in those outside systems itself. Named integrations also include Microsoft Sentinel, Google Chronicle, IBM QRadar, CrowdStrike, SentinelOne, Palo Alto Networks, AWS, Azure, GCP and Okta. Containment isolates infected devices from the network with ready to use playbooks.

SourceUnderDefense, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Each alert runs through a fixed investigation, determination and response sequence, and customers can add guidance to a single step. There is no branching, conditions, handoff between agents or workflow that customers build. Related investigations are grouped into incidents automatically.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

Six specialized AI Teammates pass an investigation along, from MITRE classification and SIEM index selection, through querying and validating evidence, to writing the verdict and routing it to workflows. They draw on 200+ agent skills and 400+ AI tools. Evidence gathering turns the investigation plan in a workbook into precise SIEM queries, and validation scores each piece of evidence as benign, suspicious or malicious before the verdict is written.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

Alerts are investigated the moment they arrive, 100 percent of them at every severity, with no analyst starting the work. Each investigation begins by summarizing the alert, pulling out its artifacts and planning the questions an expert analyst would ask.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

A Teammate classifies each incoming alert against MITRE ATT&CK and investigates it around the clock, with automated containment within 5 minutes of detection, so each arriving alert starts the work. Classification works even when the detection rule carries no ATT&CK metadata, a full investigation takes about 2 minutes, and critical alerts carry a 20 minute response SLA.

SourceUnderDefense, underdefense.com/maxi-ai, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Investigations gather evidence live across the customer's connected tools and apply the guidance the customer writes. There is no index, graph or embeddings layer over the customer's own knowledge. The AI Detection Engineer maps the customer's MITRE ATT&CK coverage from its own investigations.

SourceProphet Security, prophetsecurity.ai/ai-soc-analyst and prophetsecurity.airead 2026-10-05

MAXI builds a persistent knowledge map of the customer's environment that gets smarter with every investigation, and RAG is named in the MAXI stack. The Teammates draw on that map. It starts with the SIEM, where one Teammate picks the most relevant log indices from environments with hundreds of them. Detection logic is kept as code, and UnderDefense says agents, workflows, MCP and RAG together raise performance by more than 70%.

SourceUnderDefense, underdefense.com/maxi-ai, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Customers teach the agent playbooks, policies and preferences in plain language, organization wide, per investigation or per step. Nothing is learned silently, and every entry's source is visible and correctable. What the agent learns carries into every later investigation and stays when an analyst leaves. Most entries are guidance the product applies, and Prophet does not say how long they are kept.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

Apart from the persistent knowledge map the Teammates draw on, the agents have no memory, and nothing says what they keep or for how long. That map is built from the customer's SIEM indices and improves with every investigation.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

Agent Actions run autonomously or only with the customer's sign-off, each remediation is previewed before it runs, and actions are scoped and permissioned. Autonomy covers only the actions a customer has approved, and the customer widens that scope when the agent's track record justifies it. With the optional Watchtower service, an expert engages within 30 minutes on every malicious or inconclusive determination, around the clock, guiding the response by default and running containment, with a rollback plan, only when the customer asks.

SourceProphet Security, prophetsecurity.ai/ai-soc-analyst and prophetsecurity.ai/watchtowerread 2026-10-22

Analysts validate and tune, verdicts come with a confidence level and a narrative meant for human review, and ChatOps asks affected employees through Slack or Teams to confirm suspicious activity such as a login attempt. Containment is automated within minutes through predefined playbooks, and no approval step comes before a response action goes through. UnderDefense says people are still needed to tune, verify and trust the system, while the AI handles 80% of Tier 1 and Tier 2 work.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05

Prophet states SOC 2 Type II, ISO/IEC 27001:2022 and ISO/IEC 42001:2023, and the homepage carries a SOC 2 Type 2 badge. There is no SSO, SCIM or user role model, and scoped Agent Actions limit what the agent can do, not what users can reach. The trust center sits at trust.prophetsecurity.ai, and Prophet does not train AI models on personal data.

SourceProphet Security, trust.prophetsecurity.ai and prophetsecurity.airead 2026-10-05

UnderDefense holds SOC 2 Type I, audited by Prescient Assurance. It now also holds ISO/IEC 27001:2022 certification covering MAXI MDR and MAXI Compliance AI, and says its SOC 2 Type II examination is in its final stage. MAXI Compliance AI has a view only Auditor role under role based access control, but UnderDefense names no SSO, roles or user access controls for the MAXI AI SOC itself.

SourceUnderDefense, underdefense.com/company-news SOC 2 post and underdefense.com/blog ISO 27001 postread 2026-10-05

Every question asked, every query run and every reasoning step in an investigation is documented, so the team can verify exactly how a determination was reached. Watchtower sends validated escalations in under 30 minutes, and results can go to Slack, Teams or a webhook for each channel.

SourceProphet Security, prophetsecurity.ai/ai-soc-analyst and prophetsecurity.airead 2026-10-05

Every step of the AI SOC layer is auditable, and each investigation ends in a verdict, a confidence level and a narrative for review or regulatory documentation, the agents' own record of their steps. Validation scores each piece of evidence as benign, suspicious or malicious, and the full investigation output goes to Microsoft Teams, Jira, Slack or email.

SourceUnderDefense, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Each customer gets a dedicated single tenant with a bring your own key option. Prophet does not say where that tenant is hosted, and offers no region choice or customer environment option such as VPC or on premises.

Sourceprophetsecurity.airead 2026-10-22

The on premises edition, sold as MAXI Agentic AI SOC On-Premise, runs entirely within the customer's own closed infrastructure, on any Kubernetes, data center or private cloud in any jurisdiction, including air gapped sites, with zero data leaving the perimeter. It is available now for enterprise customers worldwide. On prepared infrastructure, a full deployment finishes in under five minutes.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

Prophet ships three agents that each do their own job. The AI SOC Analyst investigates alerts, the AI Threat Hunter runs natural language and ready to run hunts, and the AI Detection Engineer maps ATT&CK coverage and ships backtested detections. Watchtower is a human review service, not an agent. Use cases span endpoint, email, identity, cloud, DLP and network alerts, and named customers include Redis, Udemy, Instacart, Penske and Moveworks.

SourceProphet Security, prophetsecurity.airead 2026-10-05

Six AI Teammates are described by role but not named, with 200+ agent skills and 400+ AI tools behind them. They work inside UnderDefense's own investigation pipeline, not as agents a customer picks up one at a time. The platform ships with more than 700 investigation workbooks mapped to MITRE ATT&CK, and containment uses ready to use playbooks. UnderDefense's site gives no figure of 1,500+ correlation rules. MAXI Compliance AI, a separate product, automates evidence collection and security questionnaires for SOC 2, ISO 27001, HIPAA and PCI DSS.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launch and underdefense.comread 2026-10-05

Prophet names no models or providers behind Prophet AI and offers no model choice.

Sourceprophetsecurity.airead 2026-09-28

Customers can bring their own AI model through Azure AI Foundry or AWS Bedrock, or run sovereign open source models hosted entirely inside their own perimeter, so the customer chooses the model. That choice comes with the on premises edition, which keeps all data inside the customer's network.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

Developers have no way in. There is no API, SDK or MCP server for the Prophet platform, and there are no developer or docs pages. Outbound delivery to the customer's own webhook is the platform calling out, not an interface for calling it.

Sourceprophetsecurity.ai/sitemap.xmlread 2026-10-22

UnderDefense publishes no public API, SDK or MCP server for building on MAXI. The MAXI page names MCP among its technologies without an endpoint or tools. Detection logic is managed as code, and results reach outside tools through the built in integrations.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05

Changes to the agent's guidance are previewed and backtested against the customer's own alert history before they apply, so a change has to hold up on past alerts first. Remediations and new detections are backtested the same way. One customer reports 95% less manual review, and Prophet cites a 10 times faster MTTR.

SourceProphet Security, prophetsecurity.ai/ai-soc-analystread 2026-10-05

Customers get no way to test or evaluate the Teammates themselves. Analyst tuning is part of the service. UnderDefense reports investigations 153 times faster, 99% less noise and 99%+ MITRE ATT&CK coverage, and a 15 minute mean time to contain for its MDR service.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05

The agents do not drive a browser, desktop or remote computer. They act through integrations.

Sourceprophetsecurity.airead 2026-09-28

The Teammates work through SIEM queries and integrations, and there is no browser or computer use. Endpoint containment, such as isolating an infected device, runs as an automated playbook action.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05