7AI

7AI sells a security operations platform in which AI agents detect, investigate, respond and hunt as one loop. The platform page says the agents categorize, group, triage and reach a determination on each alert from the customer's tools, "escalating only what needs a person". Sources are named as categories (endpoint, identity, cloud, email, network and threat intelligence), not as a list of vendor connectors.

The investigations page describes the unit of work: an agent swarm fetches the source data, enriches it with the customer's context, runs the tools an analyst would run and attaches the evidence to the verdict. Each step in the agentic report shows the agent's mission, the tools it ran, "the exact request and response" and its conclusion. A copilot answers questions about a single investigation from that investigation's evidence. The page says investigations "typically reach a conclusion in minutes" and gives one example of about six and a half minutes.

After a verdict, the response page says 7AI lays out actions such as revoking a session, resetting a password or isolating a host, and runs them against tools the customer already owns. The investigations page offers two modes, a pre approved step an analyst takes or orchestrated response that runs automatically, and says "Every action lands in an audit log."

Repeatable response is built in a visual workflow designer with If / Else, Switch and For Each branching, versioning and execution history, triggered when an investigation completes or a case changes. Runbooks for ransomware, phishing and account compromise sit beside the cases. Skills shape how the agents think rather than act: plain markdown documents describing a review sequence, scoped by module, alert type, alert category or source connector. 7AI also generates Skills from the customer's environment, and any Skill can be switched off or held as a draft.

The Federated SIEM page presents it as the platform's data layer. A customer can keep its SIEM as a source, move high volume logs to a security data lake or 7AI hot storage, or run with no central SIEM. Rules evaluate on arrival for data 7AI collects and as scheduled queries for data held elsewhere. Search takes plain language, normalizes results to OCSF at query time, and exports to CSV, which is the only export path the public pages describe.

The site disagrees on whether this ships. 7AI Federated SIEM is generally available." The Foundational AI Security page still calls it the capability that lets agents search across sources "available to design partners today".

7AI publishes no rate card, and there is no pricing page. Every call to action leads to the demo request form, which asks for name, job title, company, work email and phone number before "we'll schedule a demo". No free plan or trial is described.

The terms also disclaim any warranty that the service will run uninterrupted, and no uptime commitment is published.

Customers can run the platform with dedicated AI Security Engineers, build their own security offering on it, or buy PLAID ELITE, a fully managed service. There, an AI Security Engineer configures the platform, agents investigate every alert, and a 24x7 team handles escalations and response. Most true positives are "handled under a policy you approve in advance", and escalations arrive with root cause, timeline, evidence and recommended actions.

The page backs this with one anonymized customer month: 99.9% of alerts resolved before reaching the customer, about 2,427 analyst hours returned, 331 cases closed and 37 response actions. Its own verdict chart does not add up.

The company page says 7AI was founded in 2024 by Cybereason co-founders Lior Div (CEO) and Yonatan Striem Amit (CTO), came out of stealth in February 2025, and has $166 million in total funding from investors including Index Ventures and Blackstone.

Its usage figures change from page to page. The homepage shows "23M+ Alerts Processed", 3,533,480 analyst hours ("Nearly 1,767 full-time analyst-years") and $202.9M of reclaimed productivity, under a banner reading "14M+ ALERTS PROCESSED". The platform page shows 14M+ investigations, 1,038 analyst years and $119.3M. The demo is also described two ways: the homepage offers to show 7AI "on your own environment in 30 minutes", while the platform and investigations pages say the demo uses a demo environment and "Your own live investigations begin once you are set up."

The security page says 7AI completed a SOC 2 Type II audit covering security and confidentiality, conducted by Decrypt Compliance, with the report shared with customers.

The terms say nothing about 7AI's own training, and they let 7AI aggregate and de-identify customer data and use it during and after the subscription to analyze, improve and operate the service.