Qevlar AI vs Simbian (2026)

More than 50 API based integrations cover Microsoft Defender, Sentinel and Entra ID, CrowdStrike, Splunk, Elastic, AWS, Okta, Palo Alto, ServiceNow, Jira, Tines and others, with response actions such as blocking a suspicious IP or contacting the user.

They span SIEM, SOAR and ticketing, EDR and XDR, email, identity, threat intel, malware sandboxes, cloud and network tools, including Cortex XSIAM and XSOAR, Google SecOps, SentinelOne, Proofpoint, Mimecast, Zscaler and VirusTotal.

After an investigation, Qevlar moves to the next action, whether containment for malicious activity, tuning for false positives, or a policy or compliance follow up.

SourceQevlar AI, qevlar.com/integrations and qevlar.comread 2026-10-05

Simbian reads more than 100 integrated sources (SIEM, EDR, XDR, identity, CVE feeds, firewall rules, ITSM) and writes back into the customer's tools, with response actions in EDR, cloud and Active Directory, detection rules in the SIEM's own query language, WAF and firewall rules, and ITSM tickets. Sources also include CDR tools, bug databases, threat hunts and pentest reports.

SourceSimbian, simbian.ai and /self-improving-defenseread 2026-10-05

A graph based orchestrator, not an LLM, runs each investigation along structured, reproducible paths across the stack and follows the customer's procedures. It connects related activity into a single incident story, maps the full blast radius and moves containment forward. There is no branching, conditions, multiple agents or flow that customers build, and each investigation follows the product's own pipeline.

SourceQevlar AI, qevlar.comread 2026-10-05

Several agents hand work to each other: when alerts cluster on an application the SOC Agent launches a pentest, and the proven exploit becomes a detection rule, a WAF rule, a network firewall rule and a patch ticket, with SOC, Pentest, Threat Hunt and NetSecOps agents sharing one Context Lake. One alert can produce a response, a tighter detection, a closed attack path, or a false positive tuned down for good. Simbian describes the loop as seeing a threat, investigating, responding, scoring its own work and proposing a better version of itself.

SourceSimbian, simbian.ai/self-improving-defenseread 2026-10-05

New alerts from across the security stack start investigations with no analyst initiating them, alerts can be pushed in through POST /alert, and hunts run continuously. A pushed alert is accepted at once with a PENDING status. Hunt queries are written and run across the SIEM and EDR automatically, and the platform works around the clock.

SourceQevlar AI, help.qevlar.com SOC Workflow Integration API and qevlar.com/soc-and-vulnerabilityread 2026-10-05

Work starts without a person asking: every alert is investigated on arrival, clustered alerts launch a pentest, and vulnerability feeds and peer breach reports start agent work. The SOC Agent begins the instant an alert is detected and reaches a response in under 4 minutes on average.

SourceSimbian, simbian.ai/self-improving-defense and /products/ai-soc-agentread 2026-10-05

Investigations correlate telemetry and threat intelligence from the connected stack and draw on an organizational context of past investigations. For each MSSP client, the provider sets the enrichment and context sources Qevlar uses in every investigation, along with that client's business context. There is no index or graph that Qevlar maintains over the customer's own knowledge.

SourceQevlar AI, qevlar.com and qevlar.com/solutions/msspsread 2026-10-05

Context Lake is an organization wide, persistent map of the customer's assets and identities built from more than 100 sources, including SIEM, EDR, identity, CVE feeds, pentest reports, firewall rules and ITSM runbooks, which every agent queries. It stays in the customer's tenant. It also holds every past verdict, so a new investigation starts from what earlier ones found.

SourceSimbian, simbian.ai and /products/ai-soc-agentread 2026-10-05

When analysts override a verdict and add context, Qevlar applies it to future cases, and an organizational context keeps past investigations, so state carries across cases. That knowledge stays in the platform as shared intelligence when analysts move on, and each investigation sharpens the next. Qevlar does not say how widely that store applies or how long it is kept.

SourceQevlar AI, qevlar.comread 2026-10-05

Every alert the SOC Agent closes is written back to the shared Context Lake, an organization wide persistent memory the other agents read, so they start with prior context instead of starting cold. Simbian does not say how long that memory is kept or how to delete anything from it.

SourceSimbian, simbian.ai/products/ai-soc-agent and simbian.airead 2026-10-05

Investigations follow the customer's procedures with analyst control, and analysts can override any verdict and add context. Analysts review alerts judged malicious, confirm the outcome and take the next steps Qevlar suggests. No approval step comes before a response action runs.

SourceQevlar AI, qevlar.com and qevlar.com/productread 2026-10-05

The customer's analysts approve the responses Simbian proposes, and Simbian reports that 95 percent are approved. Before the agents change their own skills, Simbian shows the change and its evidence, and the customer approves before anything is applied. Every action passes through a gate and can require approval, and customers lift gates one action type at a time on their own schedule. Anything that touches an employee, and anything destructive, stays gated permanently.

SourceSimbian, simbian.ai/self-improving-defenseread 2026-10-05

The platform supports SSO integration, with role based access and mandatory MFA on internal and production access, and holds a SOC 2 Type II attestation for the Security criteria. Data is encrypted with AES-256 at rest and TLS 1.2 or higher in transit, with keys held in GCP KMS, and an outside firm runs a penetration test every year. Qevlar does not train its AI models on customer data, and it notifies customers within 72 hours of confirming a personal data breach.

SourceQevlar AI, help.qevlar.com Data Privacy and Protection FAQsread 2026-10-05

Simbian publishes no attestation and no SSO, SCIM or role model. Its DPA lists Auth0 as the authentication sub-processor, and it has no security page or trust center. Simbian says its TrustedLLM is hardened against prompt injection and data poisoning.

SourceSimbian, simbian.ai/legal/dpa and simbian.airead 2026-10-05

Every verdict is transparent. Analysts see every step and every observable queried in the investigation, and audit logs are kept for up to 12 months. Full investigation reports can go straight to a SOAR or ticketing system or be read inside Qevlar, and actions can be traced for compliance.

SourceQevlar AI, qevlar.com, qevlar.com/solutions/mssps and help.qevlar.com Data Privacy and Protection FAQsread 2026-10-05

Each investigation returns a verdict with its reasoning, which analysts can watch and correct, and self scoring shows which cases fell short and why. There is no per run trace of the steps and tool calls, and no audit log. Each verdict carries a confidence rating and a severity that weighs business impact.

SourceSimbian, simbian.ai/products/ai-soc-agent and /self-improving-defenseread 2026-10-05

Primary hosting is Google Cloud in Belgium with LLM inference on Azure in Sweden, customer data retained in the EU, and a Bring Your Own Cloud deployment through which customers can choose another region. Bring Your Own Cloud runs on GCP or Azure, and Qevlar can run as SaaS or in a private cloud. Setup goes through APIs and usually takes a few hours, and the fastest so far took 10 minutes. Alert data is deleted 60 days after a contract ends unless agreed otherwise.

SourceQevlar AI, help.qevlar.com Data Privacy and Protection FAQs, qevlar.com/product and qevlar.com/solutions/msspsread 2026-10-05

The AI SOC Agent is offered as SaaS or as an on premises agent, and the Context Lake stays in the customer's tenant. No hosting regions are named, and the DPA lists US based sub-processors. Simbian says the SOC Agent deploys in hours with minimal configuration.

SourceSimbian, simbian.ai/products/ai-soc-agent and /legal/dparead 2026-10-05

One platform covers investigation, threat hunting, detection engineering and vulnerability prioritization, and Qevlar sells these as parts of one product, not as separate prebuilt agents or templates.

The vulnerability agents, still in preview, blend CVE intelligence with live SOC signal into a contextual severity score, find each asset's owner from ITSM, identity provider and EDR records, and write and run threat hunts across the SIEM and EDR.

Qevlar packages the product for phishing, network, identity and cloud alerts, and MSSPs get a separate tenant for each client with its own investigations and settings.

SourceQevlar AI, qevlar.com, qevlar.com/soc-and-vulnerability and qevlar.com/solutions/msspsread 2026-10-05

The lineup is four named agents, each with its own job: the AI SOC Agent investigates alerts, the AI Pentest Agent tests and validates exploit paths, the AI Threat Hunt Agent tests hypotheses against historical data, and the AI NetSecOps Agent runs firewall and network operations around the clock. Named customers include Bottomline, Matillion, Axelar and Wipro, and Simbian says it runs in more than 300 enterprise environments.

SourceSimbian, simbian.airead 2026-10-05

Core reasoning runs in Qevlar's graph orchestrator, and LLMs handle narrow tasks such as enrichment and summaries on Azure inference in Sweden. Qevlar chose that single provider, and customers cannot choose a model. Inference stays under EU and EEA processing, and customer data is not used for training.

SourceQevlar AI, help.qevlar.com Data Privacy and Protection FAQs and qevlar.comread 2026-10-05

Simbian does not name the models behind its agents or offer the customer a model choice. The 27 models on its homepage are the entrants in its Cyber Defense Benchmark research, not options in the product. The entrants include Claude, GPT, Grok, GLM, DeepSeek and Kimi models, and the best of the 27 covers 45.1% of MITRE tactics.

SourceSimbian, simbian.airead 2026-10-05

A REST API at api.qevlar.com with Bearer token auth submits alerts (POST /alert), returns investigation status and results (GET /alert/{id}), and publishes its reference at api.qevlar.com/redoc. A new alert returns an alert ID with a PENDING status, a status check returns IN_PROGRESS, FAILURE or the full results, and rate limits follow the subscription plan.

SourceQevlar AI, help.qevlar.com SOC Workflow Integration APIread 2026-10-05

There are no developer docs and no API, SDK or MCP server for the Simbian platform. Simbian connects to the tools a customer already runs through its 100+ integrations, multi vendor from day one.

SourceSimbian, simbian.ai and /products/ai-soc-agentread 2026-10-05

Analyst overrides feed later cases. Customers have no evaluation harness, scored test cases, quality gate or optimization loop to run. Qevlar reports a 3 minute average alert investigation and up to 80% of tickets closed automatically, and says MSSPs using it report an average 300% return on investment.

SourceQevlar AI, qevlar.com/product and qevlar.com/solutions/mssps; qevlar.comread 2026-10-05

Simbian builds a test for a customer authored objective, scores itself on the customer's own data and shows which cases fell short and why, and proposed changes to its skills are shown with evidence for approval before they apply. It checks itself constantly where it is unsure and rarely where it is confident. Customers write objectives such as never paying a ransom, keeping a production line running or answering every alert.

SourceSimbian, simbian.ai/self-improving-defenseread 2026-10-05

No agent drives a browser, desktop or remote computer. Investigations and actions run through API integrations, and results can go straight into the team's SOAR or ticketing tool.

SourceQevlar AI, qevlar.com and qevlar.com/solutions/msspsread 2026-10-05

No agent drives a browser, desktop or remote computer. The agents read and write through integrations, and Simbian does not describe the pentest agent reaching applications through browser control. Response actions land in EDR, cloud and Active Directory through those integrations.

SourceSimbian, simbian.ai and /self-improving-defenseread 2026-10-05