How much does Andesite cost?

No published prices; Andesite says pricing is based on outcomes, not on AI usage. A 30-day Proof of Value program is offered.

What are the best alternatives to Andesite?

Based on documented capability coverage across the Agentic Index 14 point taxonomy, the closest alternatives to Andesite among security and SOC agents are D3 Security (Morpheus), Palo Alto Networks, Swimlane, UnderDefense. Each is graded on the same public evidence, and no vendor pays for placement.

Does Andesite have SOC 2, SSO and role based access control?

Full under the Agentic Index verification standard. Andesite publishes public evidence of enterprise security and identity controls, covering a compliance posture such as SOC 2 or ISO 27001, single sign on (SSO or SAML), and role based access control (RBAC). Evidence basis: Attestations include FedRAMP Authorized at the High impact level (31 March 2026), SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001, among others, and access is controlled by single sign-on, multi-factor authentication and identity provider. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Can Andesite be self hosted or run in a private VPC?

Full under the Agentic Index verification standard. Andesite publishes public evidence of self hosted or private VPC deployment, along with data residency options for controlling where agent data is processed and stored. Evidence basis: Andesite deploys as SaaS, air-gapped self-managed or hybrid, with on-prem deployments air-gapped and self-managed in the customer's own environment. Customer data is never used to train the AI. Cloud deployments are single tenant, so one cu. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Does Andesite give you tracing and observability into agent runs?

Full under the Agentic Index verification standard. Andesite publishes public evidence of tracing, observability and audit logging into agent runs, so a team can see what an agent did and why. Evidence basis: Under what Andesite calls Evidentiary AI, "every action carries an audit trail" and every AI driven investigation traces back to verified sources. "Every log and activity can be downloaded, reviewed, and audited," and that covers what the a. Graded from public evidence only against the Agentic Index 14 point capability taxonomy. No vendor pays for placement.

Back to vendors

Andesite

Q: Who is Andesite for?

national security and public sector cyber defense teams, financial services and healthcare SOCs, enterprise SOC teams shifting from reactive triage to proactive hunting, MSSPs and hybrid SOC models

Visit site

Security / SOC agentindependentVerified 2026-09-28

Entry priceContact sales. Pricing is based on outcomes, not on AI usage. No prices are published.Full pricing detail

Human-AI SOC platform where customers build their own agents and playbooks for triage, investigation and remediation, with plan review before queries run, a full audit trail, bring-your-own LLM and air-gapped deployment; FedRAMP High authorized.

Andesite builds a human-AI security operations platform in which customers configure their own agents and playbooks for detection, enrichment, triage, investigation and remediation. Configurable Agents can be pointed at use cases such as phishing or alert triage, and playbooks invoke them either when an analyst starts one or in response to an event, with automation adopted partially or fully in stages.

Analysts can review an investigation plan, adjust it or remove data sources before a query runs, and remediation is launched from investigation findings. Andesite's Evidentiary AI gives every action an audit trail and traces each AI-driven investigation back to verified sources, and every log and activity can be downloaded and audited.

The platform is model-agnostic and can run with a customer's enterprise LLM, deploys as SaaS, air-gapped self-managed or hybrid, and connects to 70+ tools including CrowdStrike, Okta, Microsoft Entra ID, Tanium, Splunk, Elastic, Snowflake and Jira. Andesite reached FedRAMP Authorized status at the High impact level in March 2026 and lists SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001 among its attestations, with SSO, MFA and identity provider integration for access. It never uses customer data to train its AI. Brian Carbaugh is co-founder and CEO and Grant Verstandig is co-founder and executive chairman; former US National Cyber Director Chris Inglis is lead independent director.

Vendor details

Canonical URL

https://andesite.ai

Funding status

Independent McLean, Virginia company founded 2023 by Brian Carbaugh (CEO, former Director of the CIA's Special Activities Center) and Grant Verstandig, incubated by Red Cell Partners' Cyber Practice and General Catalyst; $38.25M total seed funding ($15.25M Apr 2024 + $23M Feb 2025); leadership includes CPO William MacMillan (former CIA CISO, Salesforce SVP InfoSec), CSO Greg Rattray (former JPMorgan Chase CISO), CTO Alex Thaman (ex-Unity, Microsoft); former US National Cyber Director Chris Inglis on the board; traction in national security, financial services, and healthcare

Company status

independent

Use cases & customers

Primary use cases

automated triage, enrichment, and investigation across 100% of alertsproactive threat hunting from consolidated cross-tool dataTTP extraction from threat intelligence and rapid environment scanningauditable, explainable AI-assisted investigations (Evidentiary AI)regulated and public sector SOC modernization

Target customers

national security and public sector cyber defense teamsfinancial services and healthcare SOCsenterprise SOC teams shifting from reactive triage to proactive huntingMSSPs and hybrid SOC models

Deployment options

SaaSair-gapped self-managedhybrid

Integrations

70+ connectors across SIEM, SOAR, endpoint, identity, cloud, threat intelligence and data platforms, including CrowdStrike, Okta, Microsoft Entra ID, Tanium, Splunk, Elastic, Microsoft Sentinel, Snowflake, Databricks, Cribl Lake, Jira, Confluence, Slack and Tines; new connectors are added weekly or on request. No public API, SDK or MCP server is documented.

In practice

A SOC team points a Configurable Agent at phishing triage, and a triage playbook runs it on reported emails as alerts arrive.

An analyst asks Andesite to investigate a suspicious login, checks the plan's data sources and time range before the query runs, then launches remediation from the findings.

A government security team runs Andesite air gapped and self managed with its own enterprise LLM, under the FedRAMP High authorization.

Sources & related URLs

Research sources

https://andesite.ai/andesite-raises-additional-23-million-and-announces-general-availability-of-the-bionic-soc/ https://www.msspalert.com/news/andesite-launches-its-bionic-soc-for-human-ai-collaboration https://www.nextgov.com/cybersecurity/2025/02/ai-cybersecurity-firm-andesite-secures-added-23m-funding/402891/

Agentic Index coverage score

9.0 / 14 capabilities · 64%

Integrations & Tool Calling	Full
70+ connectors across 15 categories, named ones including CrowdStrike, Okta, Microsoft Entra ID, Tanium, Splunk, Elastic, Jira, Cloudflare and Tines, plus Microsoft Sentinel, SentinelOne and ServiceNow, with new connectors added every week. Remediation playbooks the customer configures, and remediation launched from investigation findings, sign in to these systems and act in them. The specific response actions per connector are not listed. Andesite queries data where it sits, with no ETL or data migration. SourceAndesite, andesite.ai/integrations, /product and /faqread 2026-10-05
Workflow Orchestration	Full
Customers configure detection, enrichment, triage and remediation playbooks that invoke Configurable Agents and run when an analyst starts them or an event fires. Each playbook coordinates several agents, and teams can automate it partially or fully in stages. Agents can also take standing assignments, such as looking for anomalies in the network, and they work under human oversight. A collaboration layer gives analysts one place to see and work with every element and data feed in their security stack. SourceAndesite, andesite.ai/product and /faqread 2026-10-05
Knowledge Grounding & RAG	Partial
Investigations draw context across connected sources, including Confluence, SharePoint and Google Drive connectors and data lakes such as Snowflake, Databricks and Cribl Lake, and each one traces back to verified sources. Andesite combines the organization's data sources to fit each customer's risk profile, but it describes no knowledge base or index of its own that the agents search. SourceAndesite, andesite.ai/product, /integrations and /faqread 2026-10-05
Human Oversight & Guardrails	Full
"Analysts can review the plan, adjust it, or remove data sources before the query runs", and the agent waits for that sign off before it acts. Before a query, Andesite shows which connectors and data sources it will search, the time range and its assumptions. Teams adopt automation partially or fully in stages, with humans making the critical decisions ("governed automation"). SourceAndesite, andesite.ai/faq and /productread 2026-10-05
Security, Identity & Governance	Full
Attestations include FedRAMP Authorized at the High impact level (31 March 2026), SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001, among others, and access is controlled by single sign-on, multi-factor authentication and identity provider integration. Andesite also cites CISA Secure by Design and NIST alignment. Data is encrypted at rest, in transit and in storage, and cloud deployments are single tenant. SourceAndesite, andesite.ai/faq and /product; andesite.ai/press-releases/andesite-achieves-fedramp-high-authorized-statusread 2026-10-05
Observability & Auditability	Full
Under what Andesite calls Evidentiary AI, "every action carries an audit trail" and every AI driven investigation traces back to verified sources. "Every log and activity can be downloaded, reviewed, and audited," and that covers what the agents themselves did. Investigations are kept ready for audit. SourceAndesite, andesite.ai/productread 2026-10-05
Memory & State Persistence	Not documented
Andesite says the product "learns from context and from experience" so previous events inform current ones. It does not say what is kept, for how long or how it can be removed. SourceAndesite, andesite.airead 2026-10-05
Deployment & Data Residency	Full
Andesite deploys as SaaS, air-gapped self-managed or hybrid, with on-prem deployments air-gapped and self-managed in the customer's own environment. Customer data is never used to train the AI. Cloud deployments are single tenant, so one customer's data never mixes with another's. SourceAndesite, andesite.ai/productread 2026-10-05
Prebuilt Agents, Templates & Packs	Partial
Customers build and configure their own agents and playbooks (for example for phishing or alert triage). There are no named prebuilt agents, templates or pack catalog. Use cases span alert investigation, cloud, endpoint, identity and access, network, ransomware, threat hunting and threat intelligence. SourceAndesite, andesite.ai/product and /faqread 2026-10-05
Triggers & Channel Coverage	Full
Playbooks can be "triggered in response to an event" as well as started by analysts, and detection and triage playbooks run on their own as alerts arrive. The event types are not listed. All four kinds of playbook, detection, enrichment, triage and remediation, can start from an event. SourceAndesite, andesite.ai/productread 2026-10-05
Model Flexibility & Routing	Full
The platform is model-agnostic and can work with a customer's enterprise LLM, so the customer can bring its own model. The default models are not named. Pricing is based on outcomes, not on AI usage. SourceAndesite, andesite.ai/product and /faqread 2026-10-05
APIs, SDKs & MCP Extensibility	Not documented
There is no public API, SDK or MCP server, and new connectors are requested from Andesite. Model Context Protocol appears in the integrations list, but there is no MCP server for calling Andesite from outside. SourceAndesite, andesite.ai/integrationsread 2026-10-05
Testing, Debugging & Optimization	Not documented
Andesite runs evaluation tests on every release in an internal simlab, scoring correctness, relevancy and faithfulness, and it tests performance against attacks based on the latest threats. That testing is Andesite's own, and customers get no published way to test the agents they configure. The 30 day Proof of Value checks fit before purchase. SourceAndesite, andesite.ai/blog on tracking AI accuracy, /product and /faqread 2026-10-05
Browser & Computer Use	Not documented
The agents have no browser or computer use and work through connectors. They reach systems through 70+ connectors and query data where it sits. SourceAndesite, andesite.ai/product and /integrationsread 2026-10-05

The Agentic Index coverage score grades every vendor Full, Partial or Not documented against the same 14 buyer facing capabilities, from public evidence only. Each capability links to how all vendors in the index score on it. How this evidence is graded

Pricing

Contact sales. Pricing is based on outcomes, not on AI usage. No prices are published.

Outcomes, not AI usage. The outcome unit is not published.

What is public

Andesite publishes that its pricing is based on outcomes, and it offers a 30 day Proof of Value program customized to the customer's environment and use cases. No plans, tiers or prices are disclosed.

Variable cost rationale

Andesite bills on outcomes, not on AI usage, so tokens are not metered. Its FAQ reads "Your cost reflects the value you get from the product, not the number of tokens consumed." The outcome unit is not published, so what makes the bill grow is not stated, and no cap, minimum or commitment is published to limit it.

Sales call required

Yes, required for paid access

Free / trial

30 day Proof of Value program, customized to the customer's environment

Lowest paid plan

Not published

Key ambiguities

The outcome unit that pricing is based on is not published.

Agentic Index verified 2026-09-28

Official pricing page

Related vendors

Alternatives to Andesite

The closest documented capability profiles to Andesite among security and SOC agents tracked by Agentic Index, ordered by similarity on the same 14 point evidence the rankings use. No vendor pays for placement.

D3 Security (Morpheus)10.5 / 14Adds documented Memory & State Persistence and APIs, SDKs & MCP Extensibility
Palo Alto Networks10.5 / 14Adds documented APIs, SDKs & MCP Extensibility
Swimlane10.5 / 14Adds documented APIs, SDKs & MCP Extensibility
UnderDefense8.5 / 14Fuller documented coverage on Knowledge Grounding & RAG
ContraForce11.0 / 14Adds documented APIs, SDKs & MCP Extensibility and Testing, Debugging & Optimization
Crogl9.0 / 14Fuller documented coverage on Knowledge Grounding & RAG and Prebuilt Agents, Templates & Packs

Similarity is computed from each vendor's Agentic Index coverage score evidence, axis by axis, not from the totals. How this evidence is graded

Compare Andesite with other vendors →Compare all security and SOC agents →See where Andesite ranks →

Data confidence: high

Head to head

Andesite vs StrikeReady