Dropzone AI

Dropzone AI is positioned as an agentic security operations product that sits alongside an existing security stack. Its AI SOC Analyst is said to investigate each security alert autonomously, gathering evidence from tools that a human analyst would use and producing a recommended conclusion with links to the underlying evidence. The published workflow covers alert intake, hypothesis formation, evidence collection, analysis, reporting, and optional response. Its security description says the system connects through APIs to security and IT systems rather than copying every log. The vendor also says its agents can analyze phishing material, endpoint and identity detections, cloud events, and network evidence. That makes it a security operations layer for triage and investigation, rather than a log store or a rule authoring product.

The current product lineup also separates investigation from broader SOC work. The main product page describes an AI SOC Analyst for alerts and an AI Threat Hunter for hypothesis-driven hunts across SIEM, EDR, and cloud sources. The homepage presents the AI Threat Intel Analyst as a later offering, marked “Fall 2026,” while the pricing page already refers to threat intelligence and enrichment feeds. The main commercial subscription therefore appears to package alert investigation, hunting, and intelligence feeds, but the site does not clearly establish that the separately named threat intelligence agent has shipped.

The service can act without a person approving each investigation step. Dropzone says the analyst is autonomous and its security page describes recursive investigation until a conclusion. It can also automate containment, including quarantining an endpoint, disabling compromised credentials, and blocking a malicious IP address. Those response actions are described as completely configurable.

That autonomy starts from permissions the customer grants. The vendor says it defaults to read-only access and customers choose which alert and data sources are enabled. Write access is framed as optional for tasks such as writing to ticketing systems. Its public documentation also describes custom investigation strategies, outcome rules, global alert filters, context memory, response actions, and three application roles. The marketed distinction is a visible process rather than a black-box verdict: the product page says every question, tool query, and finding appears in an audit trail. Buyers that want an autonomous investigator but require approval over what systems it can read or alter have documented controls to examine during deployment.

Dropzone says it has more than 90 integrations across SIEM, endpoint, cloud, identity, email, network, SOAR, and threat intelligence categories. Its integration page names Splunk, Microsoft Sentinel, Google Security Operations, QRadar, CrowdStrike, Microsoft Defender, SentinelOne, AWS, Azure, Google Cloud, Wiz, Okta, and Entra ID. It says agents query connected tools through native APIs with no data migration, log normalization, or custom connector work. Most integrations are configured through an API key or OAuth in the console, which is the vendor’s basis for saying deployment needs no code.

There is also a documented tenant API for customers. Admins can create keys and interact with alerts, investigations, context memory, and response actions through the Dropzone API. The API is not presented as anonymous public infrastructure. It is an authenticated interface for a customer’s own Dropzone instance, and the documentation says the tenant Swagger UI is the current source of available endpoints. No MCP server is documented on the reviewed product, pricing, security, integration, or API pages.

The commercial service has no published dollar amount. The pricing page describes one package priced according to the environment covered, calls out an annual subscription in its page description, and routes Enterprise and MSSP buyers to contact the company. It lists unlimited users and full AI-driven investigations in the subscription, but also says customers approaching an investigation limit receive notice and can purchase extra investigation capacity. No rate card or overage price is published. This makes the actual cost unavailable until a buyer engages Dropzone.

There are ways to inspect the product before a subscription. The vendor advertises a self-guided demo and a structured proof of concept for evaluating the AI SOC analyst before full deployment, but it does not state the price or card requirement for either. The separate COACH extension is free for Chrome and Edge. COACH reads an analyst’s alert page and offers step-by-step coaching, but it is not the autonomous commercial AI SOC product. It is a distinct product-line entry and should not be confused with a free production tier of the main service.

Dropzone says each SaaS tenant runs in its own isolated AWS subnet, with a dedicated cloud tenant and no data co-mingling. Its security and trust page says deployments normally reside in AWS us-west-2, while regional deployments and EU in-region deployments can be requested. The same page says customer data is not used to train Dropzone or subprocessors’ models, and that LLM providers are contractually obligated not to retain data beyond immediate query processing.

The retention statement is more limited than the no-training promise. Investigation data is retained until the end of the contract or upon request, while operational logs are retained for 30 days. The site names SOC 2 Type 2 certification and says its findings document is available under NDA. It also describes Microsoft SSO, Google SSO, and SAML identity provider integration. Public material does not establish self-hosting of the full platform, a customer export route on departure, an open-source license, or a formal uptime percentage. The vendor does document an optional connector for reaching on-premises security tools, which is different from running the service on the customer’s own infrastructure.

The company page identifies Edward Wu as founder and CEO and says he previously spent eight years building ExtraHop’s detection engine. Dropzone’s company page says the company was founded in 2022 and reports $57.4 million total funding. It identifies Theory Ventures, Decibel, Madrona, PSL, and In-Q-Tel among its investors. The same page reports more than 300 deployments and a 2025 $37 million Series B, although those counts and dates are company claims rather than independently evaluated performance results.

The buyer fit is therefore a security operations team with an established stack and enough alert volume to justify an investigation service. The product’s value depends on connecting systems that contain alert and context data, then granting the access needed for its agents to query them. It is less suited to a team seeking a standalone log platform, an open-source deployment, fixed published pricing, or an MCP interface for an external AI assistant.