# Dropzone AI — Autonomous SOC agents that investigate alerts across a customer’s security stack. > Source: AgentsIndex — https://agentsindex.ai/dropzone-ai (structured, researched, re-verified) Dropzone AI is an agentic security operations platform whose SOC analysts investigate alerts using connected security tools. It also provides threat hunting, contextual investigation workflows, and response automations within a dedicated customer tenant. **Best for:** Security operations teams investigating high alert volumes across existing security tools **Look elsewhere if:** - you want to use it for real without paying - you want any plan without talking to sales | Fact | Value | | --- | --- | | Website | https://dropzone.ai/ | | Category | AI security operations | | API | Yes | | Open source | No | | Price | Price on request | | Price source | https://www.dropzone.ai/pricing | | Price checked | 29 October 2026 | | MCP server | Not stated | | Self-host | Not stated | | Facts | 15 facts from 7 sources | | Facts checked | 29 October 2026 | Screenshot of Dropzone AI: https://agentsindex.ai/img/1920/screenshots/dropzone-ai.webp, captured 31 October 2026 **What we checked** - Pages last read: 29 October 2026 - Facts checked: 15 facts (From 7 sources) ## It is a SOC investigation system, not a new SIEM Dropzone AI is positioned as an agentic security operations product that sits alongside an existing security stack. Its AI SOC Analyst is said to investigate each security alert autonomously, gathering evidence from tools that a human analyst would use and producing a recommended conclusion with links to the underlying evidence. The published workflow covers alert intake, hypothesis formation, evidence collection, analysis, reporting, and optional response. Its [security description](https://www.dropzone.ai/security-privacy-trust) says the system connects through APIs to security and IT systems rather than copying every log. The vendor also says its agents can analyze phishing material, endpoint and identity detections, cloud events, and network evidence. That makes it a security operations layer for triage and investigation, rather than a log store or a rule authoring product. The current product lineup also separates investigation from broader SOC work. The main [product page](https://www.dropzone.ai/ai-soc-analyst) describes an AI SOC Analyst for alerts and an AI Threat Hunter for hypothesis-driven hunts across SIEM, EDR, and cloud sources. The homepage presents the AI Threat Intel Analyst as a later offering, marked “Fall 2026,” while the pricing page already refers to threat intelligence and enrichment feeds. The main commercial subscription therefore appears to package alert investigation, hunting, and intelligence feeds, but the site does not clearly establish that the separately named threat intelligence agent has shipped. ## Autonomy is constrained by customer-controlled access The service can act without a person approving each investigation step. Dropzone says the analyst is autonomous and its [security page](https://www.dropzone.ai/security-privacy-trust) describes recursive investigation until a conclusion. It can also automate containment, including quarantining an endpoint, disabling compromised credentials, and blocking a malicious IP address. Those response actions are described as completely configurable. That autonomy starts from permissions the customer grants. The vendor says it defaults to read-only access and customers choose which alert and data sources are enabled. Write access is framed as optional for tasks such as writing to ticketing systems. Its public documentation also describes custom investigation strategies, outcome rules, global alert filters, context memory, response actions, and three application roles. The marketed distinction is a visible process rather than a black-box verdict: the [product page](https://www.dropzone.ai/ai-soc-analyst) says every question, tool query, and finding appears in an audit trail. Buyers that want an autonomous investigator but require approval over what systems it can read or alter have documented controls to examine during deployment. ## Integrations are the product’s working surface Dropzone says it has more than 90 integrations across SIEM, endpoint, cloud, identity, email, network, SOAR, and threat intelligence categories. Its [integration page](https://www.dropzone.ai/integrations) names Splunk, Microsoft Sentinel, Google Security Operations, QRadar, CrowdStrike, Microsoft Defender, SentinelOne, AWS, Azure, Google Cloud, Wiz, Okta, and Entra ID. It says agents query connected tools through native APIs with no data migration, log normalization, or custom connector work. Most integrations are configured through an API key or OAuth in the console, which is the vendor’s basis for saying deployment needs no code. There is also a documented tenant API for customers. Admins can create keys and interact with alerts, investigations, context memory, and response actions through the [Dropzone API](https://docs.dropzone.ai/api). The API is not presented as anonymous public infrastructure. It is an authenticated interface for a customer’s own Dropzone instance, and the documentation says the tenant Swagger UI is the current source of available endpoints. No MCP server is documented on the reviewed product, pricing, security, integration, or API pages. ## Commercial pricing needs a sales conversation The commercial service has no published dollar amount. The [pricing page](https://www.dropzone.ai/pricing) describes one package priced according to the environment covered, calls out an annual subscription in its page description, and routes Enterprise and MSSP buyers to contact the company. It lists unlimited users and full AI-driven investigations in the subscription, but also says customers approaching an investigation limit receive notice and can purchase extra investigation capacity. No rate card or overage price is published. This makes the actual cost unavailable until a buyer engages Dropzone. There are ways to inspect the product before a subscription. The vendor advertises a self-guided demo and a structured proof of concept for evaluating the AI SOC analyst before full deployment, but it does not state the price or card requirement for either. The separate [COACH extension](https://www.dropzone.ai/coach) is free for Chrome and Edge. COACH reads an analyst’s alert page and offers step-by-step coaching, but it is not the autonomous commercial AI SOC product. It is a distinct product-line entry and should not be confused with a free production tier of the main service. ## The published security posture is tenant isolation and no training Dropzone says each SaaS tenant runs in its own isolated AWS subnet, with a dedicated cloud tenant and no data co-mingling. Its [security and trust page](https://www.dropzone.ai/security-privacy-trust) says deployments normally reside in AWS us-west-2, while regional deployments and EU in-region deployments can be requested. The same page says customer data is not used to train Dropzone or subprocessors’ models, and that LLM providers are contractually obligated not to retain data beyond immediate query processing. The retention statement is more limited than the no-training promise. Investigation data is retained until the end of the contract or upon request, while operational logs are retained for 30 days. The site names SOC 2 Type 2 certification and says its findings document is available under NDA. It also describes Microsoft SSO, Google SSO, and SAML identity provider integration. Public material does not establish self-hosting of the full platform, a customer export route on departure, an open-source license, or a formal uptime percentage. The vendor does document an optional connector for reaching on-premises security tools, which is different from running the service on the customer’s own infrastructure. ## The company is a venture-backed cybersecurity vendor The company page identifies Edward Wu as founder and CEO and says he previously spent eight years building ExtraHop’s detection engine. [Dropzone’s company page](https://www.dropzone.ai/company) says the company was founded in 2022 and reports $57.4 million total funding. It identifies Theory Ventures, Decibel, Madrona, PSL, and In-Q-Tel among its investors. The same page reports more than 300 deployments and a 2025 $37 million Series B, although those counts and dates are company claims rather than independently evaluated performance results. The buyer fit is therefore a security operations team with an established stack and enough alert volume to justify an investigation service. The product’s value depends on connecting systems that contain alert and context data, then granting the access needed for its agents to query them. It is less suited to a team seeking a standalone log platform, an open-source deployment, fixed published pricing, or an MCP interface for an external AI assistant. ## Dropzone AI price and terms **Terms** - Free to start: Partly — COACH is a separate free Chrome and Edge extension for alert coaching — the commercial AI SOC itself directs buyers to request pricing. - Sign up without sales: Some plans ## For AI agents - API: Yes Pricing page as we captured it: https://agentsindex.ai/img/1920/screenshots/dropzone-ai/pricing.webp, captured 31 October 2026 Read on https://www.dropzone.ai/pricing, 29 October 2026. ## What we checked on Dropzone AI ### What it costs to start **What the price counts** · Yes — The commercial AI SOC is quote-only and priced against the environment being covered. > priced against the environment you’re covering rather than the agents you switch on. > — https://www.dropzone.ai/pricing · One agentic SOC. One price. section, checked 29 October 2026 **Free tier** · Partly — COACH is a free browser extension, while the commercial AI SOC subscription requires pricing contact. > COACH (Cyber Operations Alert & Context Helper) is a free Chrome extension > — https://www.dropzone.ai/coach · COACH introduction, checked 29 October 2026 **Self-serve signup** · Partly — A self-guided demonstration is available, but the commercial AI SOC directs prospective buyers to request pricing. > Ready for Reinforcements? AI SOC agents, priced according to the capacity you need. Deployed in hours. No playbooks. No code. Request Pricing > — https://www.dropzone.ai/ai-soc-analyst · Ready for Reinforcements call to action, checked 29 October 2026 **Contract** · Yes — The vendor describes the standard offering as an annual subscription with environment-based pricing. > Annual subscription for 4,000 AI investigations. Unlimited users, 80+ integrations, threat intel included. > — https://www.dropzone.ai/pricing · Pricing page meta description, checked 29 October 2026 ### What it works with **Works with** · Yes — It connects with named SIEM, endpoint, cloud, identity, email, SOAR, and threat intelligence systems. > Dropzone AI integrates with 90+ security tools across 14 categories: SIEM (Splunk, Microsoft Sentinel, Google Security Operations, QRadar), endpoint (CrowdStrike, Microsoft Defender, SentinelOne) > — https://www.dropzone.ai/integrations · Frequently asked questions, What security tools does Dropzone AI integrate with?, checked 29 October 2026 **Public API** · Yes — Admins can create API keys to manage alerts, investigations, context memory, and response actions programmatically. > You can interact with your Dropzone instance via API for various actions, such as managing alerts and investigations, context memory, and response actions. > — https://docs.dropzone.ai/api · Dropzone API section, checked 29 October 2026 ### What it does on its own **Acts on its own** · Yes — The AI SOC analyst investigates alerts without per-step human approval and can trigger configured containment actions. > Dropzone's AI SOC Analyst replicates the techniques of elite analysts to autonomously investigate every security alert. > — https://docs.dropzone.ai/ · What is Dropzone?, checked 29 October 2026 **Limits on what it may do** · Yes — Customers control enabled sources, receive read-only access by default, and can configure automated containment actions. > You have control over what types of access you provide to the Dropzone AI solution. We default to read-only access. > — https://www.dropzone.ai/security-privacy-trust · Customer Data Used by Dropzone AI, Access Controls, checked 29 October 2026 **No code needed** · Yes — Most listed integrations use API key or OAuth configuration in the console without scripts or custom code. > Most integrations are configured through API key or OAuth authentication in the Dropzone console. No scripts, no custom code, no professional services engagement. > — https://www.dropzone.ai/integrations · Frequently asked questions, Does Dropzone AI require coding to set up integrations?, checked 29 October 2026 ### What happens to your data **No training on your data** · Yes — The vendor states that neither it nor its subprocessors use customer data to train models. > No customer data is used to train Dropzone AI or sub-processors' models. > — https://www.dropzone.ai/security-privacy-trust · Customer Data Used by Dropzone AI, Model Training, checked 29 October 2026 **Retention you control** · Partly — Investigation data normally remains through the contract, though the vendor says it can be removed upon request. > Investigation data is retained until contract end or upon request; logs are stored for 30 days > — https://www.dropzone.ai/security-privacy-trust · Data Security Matrix, Data Retention row, checked 29 October 2026 **Data stays in your region** · Partly — Deployments normally run in AWS us-west-2, with regional and EU in-region deployment available by request. > Dropzone AI deployments are normally located in AWS us-west-2, with optional regional deployments available to comply with privacy and regulatory requirements. > — https://www.dropzone.ai/security-privacy-trust · Customer Data Used by Dropzone AI, Data Residency, checked 29 October 2026 ### Whether a company can buy it **Security audits** · Yes — The vendor states it has achieved SOC 2 Type 2 certification and offers the findings document under NDA. > SOC 2 Type 2: Dropzone AI has achieved SOC 2 Type 2 certification. The SOC 2 findings document can be made available under NDA. > — https://www.dropzone.ai/security-privacy-trust · Third Party Assessments, SOC 2 Type 2, checked 29 October 2026 **Single sign-on** · Yes — The platform supports local login plus Microsoft, Google, and SAML identity provider single sign-on options. > Yes, customers can securely manage user access via local login, Microsoft SSO, Google SSO, or SAML IDP integration. > — https://www.dropzone.ai/security-privacy-trust · Common Questions, Does Dropzone AI support SSO?, checked 29 October 2026 **Audit log** · Yes — Investigation activity is presented with a full audit trail covering questions, queried tools, and generated findings. > Every question asked, every tool queried, every finding generated. Full audit trail for compliance and governance. > — https://www.dropzone.ai/ai-soc-analyst · Glass Box, Not Black Box section, checked 29 October 2026 ## Questions about Dropzone AI ### How much does Dropzone AI cost? Dropzone AI gives its price on request. From dropzone.ai/pricing, checked 29 October 2026. ### Does Dropzone AI have an API or an MCP server? It has an API. ### What have we checked on Dropzone AI? 15 facts, under these headings: What it costs to start, what it works with, what it does on its own, what happens to your data, whether a company can buy it. ### How do we check Dropzone AI? We hold 15 facts on Dropzone AI, quoted from 7 pages. Facts and price last checked 29 October 2026. How we check every listing: https://agentsindex.ai/methodology/ ## Sources and changes Last changed 31 October 2026 **Sources** (7) - https://www.dropzone.ai/security-privacy-trust, read 29 October 2026 - https://www.dropzone.ai/pricing, read 29 October 2026 - https://www.dropzone.ai/ai-soc-analyst, read 29 October 2026 - https://www.dropzone.ai/integrations, read 29 October 2026 - https://docs.dropzone.ai/, read 29 October 2026 - https://docs.dropzone.ai/api, read 29 October 2026 - https://www.dropzone.ai/coach, read 29 October 2026 ## Is this yours? AI assistants like ChatGPT, Claude and Perplexity opened AgentsIndex pages 1,237 times from 17 October to 31 October. Claim Dropzone AI: https://agentsindex.ai/claim/dropzone-ai Report an error if a fact is wrong: hello@agentsindex.ai, subject "Report an error: Dropzone AI (dropzone-ai)".