AirMDR
Also known as: AirMDR, AirMDR, Inc., AirMDR AI SOC Platform, AirMDR Virtual Analyst
AI-native MDR built around a Virtual Analyst that triages 95% of alerts in under five minutes and covers 100% of alert volume 24/7, paired with a round-the-clock human expert team that supervises, validates, and escalates its findings. Ships 240+ out-of-the-box integrations, automated playbooks, and an always-free plan automating 100% of alert triage. Founded by ArcSight/Sumo Logic/LogicHub veteran Kumar Saurabh; $15.5M seed; SOC 2 certified; sells to SMBs, enterprises, and through MSSPs.
AirMDR is an AI-native Managed Detection and Response provider built around a Virtual Analyst: an AI engine that autonomously triages, investigates, and responds to security alerts, completing investigations in two to five minutes that would take a human analyst 45 minutes or more, a roughly 20x speed gain. The AI triages 95% of all alerts in under five minutes and covers 100% of alert volume in real time, while a 24/7 team of experienced human analysts supervises, validates, escalates, and improves on the AI's findings, a hybrid architecture the company positions as a second layer of defense and the core of its product. The platform ships over 240 out-of-the-box integrations with custom integrations in two to four weeks, combining automated playbooks with AI investigation. In August 2025 AirMDR launched its AI SOC Platform for MSSPs and enterprise SOCs, automating more than 90% of Tier-1 alert triage, including an always-free plan that automates 100% of alert triage with quick setup and no credit card. Founded by Kumar Saurabh, who built first-generation SIEM at ArcSight, cloud analytics at Sumo Logic, and detection automation at LogicHub, AirMDR's mission is bringing Fortune 500 quality SOC coverage to every enterprise at an affordable price, targeting SMBs and mid-market organizations underserved by traditional MDR, and selling through MSSPs as a channel. SOC 2 certified and in production across multiple enterprise environments. Within the AI-SOC-analyst cluster, AirMDR is the managed-service entrant: the AI analyst is wrapped in a human MDR delivery layer rather than sold as a standalone platform, with the strongest structural human-in-the-loop story in the sub-cluster and the lane's second free tier after Tines.
Vendor details
Canonical URL
https://airmdr.com
Category
Security / SOC agent
Funding status
Independent Menlo Park company founded by CEO Kumar Saurabh (built first-generation SIEM at ArcSight, cloud-native analytics at Sumo Logic, and founded LogicHub) with Anthony Morris (Head of SOC Operations); $15.5M seed closed July 2025 led by Race Capital with Foundation Capital and Storm Ventures ($10.5M infusion on an initial $5M round); in production across multiple enterprises; SOC 2 certified
Company status
independent
Use cases & customers
Primary use cases
Target customers
Deployment options
Integrations
Ships more than 240 out-of-the-box integrations across the security stack with custom integrations delivered in two to four weeks, combining automated playbooks with the Virtual Analyst's investigations. The AI SOC Platform (launched August 2025) is purpose-built for MSSP and enterprise SOC workflows, with alert intake, triage, and investigation delivered as a service alongside a 24/7 human analyst team.
Sources & related URLs
Research sources
Capability coverage
6.0 / 14 capabilities · 43%
| Integrations & Tool CallingMore than 240 out-of-the-box integrations across the security stack with custom integrations delivered in two to four weeks, Brilliance Security Magazine and AirMDR materials 2026-07-22 | Full |
|---|---|
| Workflow OrchestrationVirtual Analyst autonomously triages, investigates, and executes responses end-to-end, completing in 2 to 5 minutes investigations that take humans 45+, combining automated playbooks with AI investigation, AirMDR materials and Brilliance Security Magazine 2026-07-22 | Full |
| Knowledge Grounding & RAGInvestigations ground on data correlated across 240+ connected sources with threat detection and intelligence capabilities; no first-class knowledge base or RAG surface documented, AirMDR materials 2026-07-22 | Partial |
| Human Oversight & GuardrailsStructural human oversight is the product architecture: a 24/7 team of expert analysts supervises, validates, escalates, and improves on every AI finding as a second layer of defense, AirMDR funding blog 2026-07-22 | Full |
| Security, Identity & GovernanceSOC 2 certification assures operational integrity and data protection; product-level RBAC and governance features not documented, Brilliance Security Magazine 2026-07-22 | Partial |
| Observability & AuditabilityPlatform positioned on speed, quality, and transparency with investigation findings delivered for human review; detailed attestable audit-trail features not documented at the level of cluster leaders, AirMDR AI SOC Platform launch materials 2026-07-22 | Partial |
| Memory & State PersistenceFindings improve through the human analyst validation loop rather than a documented product memory; no persistent environmental state or learning store retrieved, AirMDR materials 2026-07-22 | Unable to verify |
| Deployment & Data ResidencyCloud-delivered service and platform with quick setup; no on-premise, VPC, or options documented, AirMDR materials 2026-07-22 | Unable to verify |
| Prebuilt Agents, Templates & PacksAutomated playbooks and 240+ out-of-the-box integrations ship prebuilt, with a quick-setup free plan requiring no configuration, AirMDR materials 2026-07-22 | Partial |
| Triggers & Channel CoverageAutomatically triages 100% of alerts in real time around the clock, with 95% of alerts triaged in under five minutes, AirMDR funding blog and Channel Insider 2026-07-22 | Full |
| Model Flexibility & RoutingNo customer-facing model choice or routing; the Virtual Analyst AI is internal to the service, AirMDR materials 2026-07-22 | Unable to verify |
| APIs, SDKs & MCP ExtensibilityCustom integrations are delivered by the vendor as a service; no public API, SDK, or MCP surface for customer extensibility documented, AirMDR materials 2026-07-22 | Unable to verify |
| Testing, Debugging & OptimizationAI findings improve through human analyst validation, but no customer-facing testing, evaluation, or optimization capability is documented, AirMDR materials 2026-07-22 | Unable to verify |
| Browser & Computer UseNo browser or computer-use capability documented; AirMDR operates on alert and investigation data via integrations, AirMDR materials 2026-07-22 | Unable to verify |
Pricing
Free plan; paid tiers not public
alert volume and scope of MDR service coverage
What is public
The always-free triage plan is public and prominently promoted; the hybrid AI-plus-human MDR service and AI SOC Platform are positioned as affordable and cost-effective, but no plans, tiers, or dollar amounts are disclosed.
Variable cost rationale
Cost scales with alert volume and the scope of environments under managed detection and response, growing with organization size and detection coverage.
Sales call required
Yes — required for paid access
Free / trial
Always-free plan: 100% alert triage, quick setup, no credit card
Related vendors
- 7AI — Swarming agentic SOC from the Cybereason founders: sixty plus domain…
- Airrived — Agentic OS that unifies SOC, GRC, IAM, vulnerability management, IT,…
- Andesite — Bionic SOC: a human-AI collaboration platform that automates triage,…
- Assail — Autonomous red teaming platform (Ares) whose AI agents discover,…
- Astelia — AI native exposure management platform from Israeli National Red…
- BlinkOps — Agentic security operations platform running a digital workforce of…