How much does AirMDR cost?

The free FAST plan includes 100 investigations with no credit card or sales call; additional investigations are $4 each. Full Service AI MDR and the AI SOC Platform are quote only, on annual contracts with no onboarding fees.

What are the best alternatives to AirMDR?

Based on documented capability coverage across the Agentic Index 14 point taxonomy, the closest alternatives to AirMDR among security and SOC agents are Kai, Linx Security, Radiant Security, Astelia. Each is graded on the same public evidence, and no vendor pays for placement.

Does AirMDR have SOC 2, SSO and role based access control?

Full under the Agentic Index verification standard. AirMDR publishes public evidence of enterprise security and identity controls, covering a compliance posture such as SOC 2 or ISO 27001, single sign on (SSO or SAML), and role based access control (RBAC). Evidence basis: AirMDR states it is SOC 2 certified, without giving the type, and its MSSP platform offers "true tenant segregation with role-based access controls". Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Does AirMDR require human approval before an agent acts?

Full under the Agentic Index verification standard. AirMDR publishes public evidence of human approval steps and guardrails, so an agent action can be held for review before it executes. Evidence basis: Remediation gives the customer a choice between one click approvals and full automation, so a customer can require approval before an action runs, and actions execute either automatically or once an analyst approves them. In the managed ser. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Does AirMDR give you tracing and observability into agent runs?

Partial under the Agentic Index verification standard. AirMDR publishes some public evidence of logging or observability, but narrower than full tracing and auditability across agent runs. Evidence basis: Each alert gets an audit ready case write up covering the investigation process, the evidence and artifacts collected, enriched context, a timeline, the verdict rationale with a confidence level and next steps. AirMDR describes no trace of. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Back to vendors

AirMDR

Also known as: AirMDR Virtual Analyst

Visit site

Security / SOC agentindependentVerified 2026-09-28

Entry priceFree FAST plan with 100 investigations; additional investigations $4 each. Full Service AI MDR and AI SOC Platform are quote only.Full pricing detail

AI native MDR whose AI analyst investigates every alert and writes an audit ready case, with human analysts on escalation, one click approval for remediation and a free plan of 100 investigations.

AirMDR is an AI native managed detection and response provider built around an AI analyst, named Darryl in its free plan. Each alert ingested from a connected security tool starts an AI investigation that gathers evidence, enriches and standardizes the data, reasons to a verdict and recommends or takes an action, and AirMDR says most investigations finish in under five minutes. Every alert gets an audit ready case write up with the investigation process, evidence, verdict rationale and next steps. AirMDR sells three ways. A Full Service AI MDR for small security teams has 24/7 monitoring and human analysts who review critical alerts and escalate.

An AI SOC Platform for MSSPs and enterprise SOC teams has tenant segregation and role based access. A free self serve plan, FAST, has 100 investigations, 40+ starter integrations and no response actions. Remediation runs with one click customer approval or full automation, at the customer's choice. The company states more than 240 out of the box integrations and SOC 2 certification. AirMDR is based in Menlo Park, was founded by CEO Kumar Saurabh, previously of ArcSight and LogicHub, and raised a $15.5 million seed round in July 2025 led by Race Capital with Foundation Capital and Storm Ventures.

Vendor details

Canonical URL

https://airmdr.com

Funding status

Independent Menlo Park company founded by CEO Kumar Saurabh (built first-generation SIEM at ArcSight, cloud-native analytics at Sumo Logic, and founded LogicHub) with Anthony Morris (Head of SOC Operations); $15.5M seed closed July 2025 led by Race Capital with Foundation Capital and Storm Ventures ($10.5M infusion on an initial $5M round); in production across multiple enterprises; SOC 2 certified

Company status

independent

Use cases & customers

Primary use cases

AI-powered alert triage and investigation (95% of alerts in under 5 minutes)managed detection and response with a 24/7 human analyst layerTier-1 SOC automation for MSSPs and enterprise SOCsaffordable enterprise-grade SOC coverage for SMBs

Target customers

SMBs and mid-market organizations underserved by traditional MDRenterprise SOC teams reducing Tier-1 workloadMSSPs building AI-powered service deliveryorganizations wanting 24/7 coverage without SOC headcount

Deployment options

cloud-delivered AI SOC platform with quick setup and a free plandelivered as a managed MDR service with a 24/7 human analyst layer

Integrations

AirMDR offers more than 240 out of the box integrations across endpoint, email, identity, cloud and SaaS tools (40+ starter integrations on the free plan) and adds new tools in under two weeks on average. AirMDR publishes no public API, SDK or MCP server for building on the platform.

In practice

A three person security team cannot keep up with alerts overnight. AirMDR's AI analyst triages every alert as it arrives, builds the case with evidence and a verdict, and AirMDR's analysts review the critical ones and escalate.

A CISO wants automation but not blind automation. AirMDR lets the team choose, per action, between one click approval and full automation, so blocking at the firewall can wait for a person while closing benign alerts runs on its own.

An MSSP serves many clients from one SOC. AirMDR's platform keeps each tenant separate with role based access and writes an audit ready case for every alert it handles.

Sources & related URLs

Research sources

https://airmdr.com/blog/funding-announcement-2025 https://www.channelinsider.com/news-and-trends/airmdr-funding-ai-soc/ https://www.msspalert.com/brief/airmdr-raises-15-5m-to-scale-ai-driven-soc-services-benefits-mssps https://brilliancesecuritymagazine.com/cybersecurity/ai-powered-security-for-all-airmdr-raises-15-5m-to-democratize-mdr/

Agentic Index coverage score

6.0 / 14 capabilities · 43%

Integrations & Tool Calling	Full
Over 240 out of the box integrations span endpoint, email, identity, cloud and SaaS, with new tools added in under two weeks on average and custom integrations delivered in two to four weeks. AirMDR takes response actions in them, such as closing benign alerts and blocking at the firewall. SourceAirMDR, airmdr.com/servicesread 2026-10-06
Workflow Orchestration	Partial
One AI analyst runs a fixed product pipeline, from an ingested alert through investigation across data sources, evidence collected and correlated into a timeline, and reasoning, to a verdict with rationale and confidence and then automated or analyst approved actions. AirMDR pitches the service as "No SOAR. No playbooks" for the customer, and it adjusts natural language playbooks itself from customer feedback. There is no flow for the customer to build, and no second agent is named. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06
Knowledge Grounding & RAG	Partial
Each investigation enriches, contextualizes and standardizes data from the connected tools and correlates the artifacts into a timeline, and results are tailored per client. AirMDR names no maintained knowledge base or retrieval structure over the customer's estate. SourceAirMDR, airmdr.com/virtual-analyst and /airmdr-ai-soc-agent-and-platformread 2026-10-06
Human Oversight & Guardrails	Full
Remediation gives the customer a choice between one click approvals and full automation, so a customer can require approval before an action runs, and actions execute either automatically or once an analyst approves them. In the managed service AirMDR analysts review critical alerts manually and escalate when needed. The free FAST plan takes no response actions. SourceAirMDR, airmdr.com/services and /airmdr-ai-soc-agent-and-platformread 2026-10-06
Security, Identity & Governance	Full
AirMDR states it is SOC 2 certified, without giving the type, and its MSSP platform offers "true tenant segregation with role-based access controls". Sourceairmdr.com/airmdr-for-msspread 2026-09-28
Observability & Auditability	Partial
Each alert gets an audit ready case write up covering the investigation process, the evidence and artifacts collected, enriched context, a timeline, the verdict rationale with a confidence level and next steps. AirMDR describes no trace of the analyst agent's own tool calls, and it reports an average case quality of 8.8 out of 10. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06
Memory & State Persistence	Not documented
Customer feedback is incorporated by AirMDR's team, and the free plan keeps alert data and outputs for 30 days. AirMDR names no agent memory. SourceAirMDR, airmdr.com/free-planread 2026-10-06
Deployment & Data Residency	Not documented
Customers get AirMDR as a platform or a managed MDR service, with 2 to 4 week onboarding and no onboarding fees, and AirMDR cites live deployment of the platform in an hour. No hosting region is published, and AirMDR names no customer environment or data residency option. SourceAirMDR, airmdr.com/pricing, /services and /airmdr-ai-soc-agent-and-platformread 2026-10-06
Prebuilt Agents, Templates & Packs	Partial
The one named AI analyst is Darryl, and AirMDR maintains playbooks "built with industry standards in mind". AirMDR names no catalog of agents or templates for the customer to choose from. Managed detections map to the MITRE ATT&CK framework, and threat hunting runs on automated playbooks. SourceAirMDR, airmdr.com/virtual-analyst and /servicesread 2026-10-06
Triggers & Channel Coverage	Full
"Alert Triggered, Alert ingested from integrated security tools" starts each AI investigation, and the product "triages every alert, every time", so the arrival of an alert starts the work with no one asking. AirMDR reports 95% of alerts triaged in under five minutes. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06
Model Flexibility & Routing	Not documented
The model behind the AI analyst is not named, and AirMDR describes no model choice or routing for customers. SourceAirMDR, airmdr.com/virtual-analystread 2026-10-06
APIs, SDKs & MCP Extensibility	Not documented
AirMDR collects data from connected tools through their APIs, but publishes no public API, SDK or MCP server for building on the platform, and custom integrations are added by AirMDR. SourceAirMDR, airmdr.com/virtual-analyst and /servicesread 2026-10-06
Testing, Debugging & Optimization	Not documented
Analyst supervision and tuning from feedback are part of AirMDR's own service, which comes with SLAs on mean time to investigate and mean time to resolve. AirMDR names no testing or evaluation of the AI analyst that customers run themselves. SourceAirMDR, airmdr.com/servicesread 2026-10-06
Browser & Computer Use	Not documented
The AI analyst works through integrations, and AirMDR names no browser or computer use by it. SourceAirMDR, airmdr.com/airmdr-ai-soc-agent-and-platformread 2026-10-06

The Agentic Index coverage score grades every vendor Full, Partial or Not documented against the same 14 buyer facing capabilities, from public evidence only. Each capability links to how all vendors in the index score on it. How this evidence is graded

Product updates

October 19, 2026·Agent capabilityPartially Verified

Release M29 adds Agentic One Click Remediation, where the agent picks a predefined remediation playbook from a case recommendation and fills its inputs from the case and source alert for an analyst to launch with one click. Teams can also set auto remediation conditions so eligible actions run on their own, and those runs are listed in a separate Auto Remediated section.

Bears on: Human approval / guardrails

View source

View all AirMDR updates →Tracked since Oct 2026 · Verified from public vendor sources

Pricing

Free FAST plan with 100 investigations; additional investigations $4 each. Full Service AI MDR and AI SOC Platform are quote only.

Per investigation on FAST; paid MDR and platform tiers are quoted on annual contracts.

Free tier

Included quota

FAST includes 100 investigations; alert data and outputs are retained for 30 days.

What is public

The FAST free plan (100 investigations) and its $4 per additional investigation rate are public; Full Service AI MDR and AI SOC Platform prices are by quote.

Cost watchouts

FAST excludes response actions and human analysts, which sit in the quoted tiers; FAST data is retained for 30 days.

Variable cost rationale

Cost scales with alert volume and the scope of environments under managed detection and response, growing with organization size and detection coverage.

Overage / add-ons

On FAST, investigations beyond the 100 free are $4 each.

Sales call required

Mixed (some tiers require a call)

Free / trial

FAST free plan: 100 investigations, no credit card or sales call, 40+ starter integrations, no response actions.

Lowest paid plan

FAST pay as you go: $4 per investigation after the 100 free.

Key ambiguities

Paid MDR and AI SOC Platform prices are not published; the FAST plan takes no response actions and includes no human analysts.

Agentic Index verified 2026-09-28

Official pricing page Docs

Related vendors

Alternatives to AirMDR

The closest documented capability profiles to AirMDR among security and SOC agents tracked by Agentic Index, ordered by similarity on the same 14 point evidence the rankings use. No vendor pays for placement.

Kai7.0 / 14Adds documented Testing, Debugging & Optimization
Linx Security6.5 / 14Fuller documented coverage on Knowledge Grounding & RAG and Observability & Auditability
Radiant Security6.5 / 14Adds documented APIs, SDKs & MCP Extensibility
Astelia8.0 / 14Adds documented APIs, SDKs & MCP Extensibility
Intezer7.0 / 14Adds documented Memory & State Persistence and APIs, SDKs & MCP Extensibility
Knostic6.0 / 14Adds documented APIs, SDKs & MCP Extensibility and Testing, Debugging & Optimization

Similarity is computed from each vendor's Agentic Index coverage score evidence, axis by axis, not from the totals. How this evidence is graded

Compare AirMDR with other vendors →Compare all security and SOC agents →See where AirMDR ranks →

Data confidence: medium

Head to head

AirMDR vs UnderDefenseAirMDR vs Dropzone AI