Qevlar AI vs Radiant Security (2026)

More than 50 API based integrations cover Microsoft Defender, Sentinel and Entra ID, CrowdStrike, Splunk, Elastic, AWS, Okta, Palo Alto, ServiceNow, Jira, Tines and others, with response actions such as blocking a suspicious IP or contacting the user.

They span SIEM, SOAR and ticketing, EDR and XDR, email, identity, threat intel, malware sandboxes, cloud and network tools, including Cortex XSIAM and XSOAR, Google SecOps, SentinelOne, Proofpoint, Mimecast, Zscaler and VirusTotal.

After an investigation, Qevlar moves to the next action, whether containment for malicious activity, tuning for false positives, or a policy or compliance follow up.

SourceQevlar AI, qevlar.com/integrations and qevlar.comread 2026-10-05

Data connectors ingest from the customer's tools in categories that include authentication, cloud access security brokers, cloud, endpoint and network logs, email infrastructure and IAM, ICS and OT, messaging apps, password managers, SIEM tools, ticketing systems, security service edge, API protection and an S3 connector, and outgoing webhooks send data on.

Response actions run from the case view in CrowdStrike, Microsoft 365 Defender, SentinelOne, Microsoft 365, Okta, Google Workspace, Mimecast, Proofpoint, Netskope and KnowBe4, isolating devices, disabling users, resetting passwords, ending sessions, deleting messages, removing external forwarding rules and blocking IPs, URLs, domains and files. They also start full disk scans in SentinelOne and enroll users in KnowBe4 phishing training.

SourceRadiant Security, help.radiantsecurity.ai and /radiant-cases/radiant-cases/response-actionsread 2026-10-06

A graph based orchestrator, not an LLM, runs each investigation along structured, reproducible paths across the stack and follows the customer's procedures. It connects related activity into a single incident story, maps the full blast radius and moves containment forward. There is no branching, conditions, multiple agents or flow that customers build, and each investigation follows the product's own pipeline.

SourceQevlar AI, qevlar.comread 2026-10-05

Each alert runs through the product's own triage, investigation and case sequence, and response actions launch from the case, on one artifact or in bulk across selected users, IPs and URLs. The audit log mentions automated playbooks, but Radiant describes no branching, multi agent handoff or automation the customer configures.

SourceRadiant Security, help.radiantsecurity.ai/radiant-cases/radiant-cases/response-actions-in-cases and /log-management/audit-logs/introduction-to-audit-logsread 2026-10-06

New alerts from across the security stack start investigations with no analyst initiating them, alerts can be pushed in through POST /alert, and hunts run continuously. A pushed alert is accepted at once with a PENDING status. Hunt queries are written and run across the SIEM and EDR automatically, and the platform works around the clock.

SourceQevlar AI, help.qevlar.com SOC Workflow Integration API and qevlar.com/soc-and-vulnerabilityread 2026-10-05

Alerts arriving through data connectors or the custom alerts webhook are triaged and investigated automatically, with no analyst starting the work. Webhook alerts are posted as JSON with a token, enter the triage pipeline and become searchable within several minutes.

SourceRadiant Security, help.radiantsecurity.ai/radiant-connectors/ingestion-methods/custom-alerts-webhookread 2026-10-06

Investigations correlate telemetry and threat intelligence from the connected stack and draw on an organizational context of past investigations. For each MSSP client, the provider sets the enrichment and context sources Qevlar uses in every investigation, along with that client's business context. There is no index or graph that Qevlar maintains over the customer's own knowledge.

SourceQevlar AI, qevlar.com and qevlar.com/solutions/msspsread 2026-10-05

Integrated log management stores the customer's logs with search, query and retention settings, and alerts sent through the custom webhook land in its parsed and alert indexes, where teams can search and investigate them. Radiant says the platform continuously learns the environment, its tooling, behavior and activity to boost accuracy, but it does not say how investigations draw on what it has learned or on the customer's own documentation.

SourceRadiant Security, radiantsecurity.ai, help.radiantsecurity.ai/log-management/log-search-and-query and /radiant-connectors/ingestion-methods/custom-alerts-webhookread 2026-10-06

When analysts override a verdict and add context, Qevlar applies it to future cases, and an organizational context keeps past investigations, so state carries across cases. That knowledge stays in the platform as shared intelligence when analysts move on, and each investigation sharpens the next. Qevlar does not say how widely that store applies or how long it is kept.

SourceQevlar AI, qevlar.comread 2026-10-05

The platform continuously learns about the environment, its tooling, behavior and activity to boost accuracy, by Radiant's account, but Radiant describes no memory store, what it would keep, its scope or its lifetime.

SourceRadiant Security, radiantsecurity.ai and help.radiantsecurity.airead 2026-10-06

Investigations follow the customer's procedures with analyst control, and analysts can override any verdict and add context. Analysts review alerts judged malicious, confirm the outcome and take the next steps Qevlar suggests. No approval step comes before a response action runs.

SourceQevlar AI, qevlar.com and qevlar.com/productread 2026-10-05

Response actions launched from a case run when an analyst selects the targets, clicks the action and confirms the list of affected artifacts in a confirmation step, and many can be reversed with one click from the action history through the inverse action, such as enabling a user again. Hard deletes and password resets cannot be undone. The platform produces incident specific response plans for that analyst to execute. The audit log separates analyst actions from automated platform actions and playbooks, and Radiant does not say which actions, if any, run without that confirmation.

SourceRadiant Security, help.radiantsecurity.ai/radiant-cases/radiant-cases/response-actions-in-cases, /response-actions and /log-management/audit-logs/introduction-to-audit-logsread 2026-10-06

The platform supports SSO integration, with role based access and mandatory MFA on internal and production access, and holds a SOC 2 Type II attestation for the Security criteria. Data is encrypted with AES-256 at rest and TLS 1.2 or higher in transit, with keys held in GCP KMS, and an outside firm runs a penetration test every year. Qevlar does not train its AI models on customer data, and it notifies customers within 72 hours of confirming a personal data breach.

SourceQevlar AI, help.qevlar.com Data Privacy and Protection FAQsread 2026-10-05

SAML 2.0 SSO works with Okta, Google and Microsoft Entra ID and is enforced for all users once set, with an emergency bypass through support. Every user is assigned the Admin role, and Radiant names no SCIM provisioning. No compliance attestation is published, and a trust center sits at trust.radiantsecurity.ai.

SourceRadiant Security, help.radiantsecurity.ai/manage-radiant/organization-settings/security/set-up-single-sign-on-ssoread 2026-10-06

Every verdict is transparent. Analysts see every step and every observable queried in the investigation, and audit logs are kept for up to 12 months. Full investigation reports can go straight to a SOAR or ticketing system or be read inside Qevlar, and actions can be traced for compliance.

SourceQevlar AI, qevlar.com, qevlar.com/solutions/mssps and help.qevlar.com Data Privacy and Protection FAQsread 2026-10-05

Audit logs record who took action, what changed and when, with before and after values, across response actions, alert verdict changes, allow and deny list changes, deleted notes and data connector changes, and they tell analyst actions apart from automated platform actions. Configuration and administrative changes are not yet logged, and Radiant describes no record of the AI's investigation steps and reasoning.

SourceRadiant Security, help.radiantsecurity.ai/log-management/audit-logs/introduction-to-audit-logsread 2026-10-06

Primary hosting is Google Cloud in Belgium with LLM inference on Azure in Sweden, customer data retained in the EU, and a Bring Your Own Cloud deployment through which customers can choose another region. Bring Your Own Cloud runs on GCP or Azure, and Qevlar can run as SaaS or in a private cloud. Setup goes through APIs and usually takes a few hours, and the fastest so far took 10 minutes. Alert data is deleted 60 days after a contract ends unless agreed otherwise.

SourceQevlar AI, help.qevlar.com Data Privacy and Protection FAQs, qevlar.com/product and qevlar.com/solutions/msspsread 2026-10-05

How the product is hosted is not described, and no hosting region, choice of region or customer environment option is published.

SourceRadiant Security, radiantsecurity.ai and help.radiantsecurity.ai; trust.radiantsecurity.ai/resourcesread 2026-10-06

One platform covers investigation, threat hunting, detection engineering and vulnerability prioritization, and Qevlar sells these as parts of one product, not as separate prebuilt agents or templates.

The vulnerability agents, still in preview, blend CVE intelligence with live SOC signal into a contextual severity score, find each asset's owner from ITSM, identity provider and EDR records, and write and run threat hunts across the SIEM and EDR.

Qevlar packages the product for phishing, network, identity and cloud alerts, and MSSPs get a separate tenant for each client with its own investigations and settings.

SourceQevlar AI, qevlar.com, qevlar.com/soc-and-vulnerability and qevlar.com/solutions/msspsread 2026-10-05

One AI SOC analyst with incident response and log management around it covers many alert types out of the box, triaging every security alert across endpoint, identity, email, network and cloud. These are parts of one product, with no separate prebuilt agents or templates to adopt. Named customers include Nutcracker Therapeutics, Spellman High Voltage Electronics, Kyowa Kirin and Second Wave Delivery Systems.

SourceRadiant Security, radiantsecurity.ai and help.radiantsecurity.airead 2026-10-06

Core reasoning runs in Qevlar's graph orchestrator, and LLMs handle narrow tasks such as enrichment and summaries on Azure inference in Sweden. Qevlar chose that single provider, and customers cannot choose a model. Inference stays under EU and EEA processing, and customer data is not used for training.

SourceQevlar AI, help.qevlar.com Data Privacy and Protection FAQs and qevlar.comread 2026-10-05

The models and providers behind Radiant's AI are not disclosed, and no model choice is offered.

SourceRadiant Security, radiantsecurity.ai and help.radiantsecurity.airead 2026-10-06

A REST API at api.qevlar.com with Bearer token auth submits alerts (POST /alert), returns investigation status and results (GET /alert/{id}), and publishes its reference at api.qevlar.com/redoc. A new alert returns an alert ID with a PENDING status, a status check returns IN_PROGRESS, FAILURE or the full results, and rate limits follow the subscription plan.

SourceQevlar AI, help.qevlar.com SOC Workflow Integration APIread 2026-10-05

The custom alerts webhook has a published endpoint, a token sent in the authorization header and a JSON body carrying timestamp, alert ID and raw alert fields, for sending alerts from sources without a dedicated connector. Radiant has announced an API for automating operational work, but no API reference beyond the webhook is published.

SourceRadiant Security, help.radiantsecurity.ai/radiant-connectors/ingestion-methods/custom-alerts-webhookread 2026-10-06

Analyst overrides feed later cases. Customers have no evaluation harness, scored test cases, quality gate or optimization loop to run. Qevlar reports a 3 minute average alert investigation and up to 80% of tickets closed automatically, and says MSSPs using it report an average 300% return on investment.

SourceQevlar AI, qevlar.com/product and qevlar.com/solutions/mssps; qevlar.comread 2026-10-05

Claimed results are triage with the quality of a team's best analyst at any scale and response times cut from days to minutes, both Radiant's own figures. Radiant describes no evaluation harness, scored test cases, quality gate or optimization loop the customer runs.

SourceRadiant Security, radiantsecurity.ai and help.radiantsecurity.airead 2026-10-06

No agent drives a browser, desktop or remote computer. Investigations and actions run through API integrations, and results can go straight into the team's SOAR or ticketing tool.

SourceQevlar AI, qevlar.com and qevlar.com/solutions/msspsread 2026-10-05

The AI works through data connectors and response actions inside the customer's security and identity tools. Radiant describes no use of a browser, desktop or remote computer.

SourceRadiant Security, radiantsecurity.ai and help.radiantsecurity.ai/radiant-cases/radiant-cases/response-actionsread 2026-10-06