PAGES
← all tools
◆ SOAR

Dropzone AI

March 2026 product updates commercial

Dropzone AI is an agentic SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. platform with AI agents that investigate alerts, run threat hunts, and analyze threat intelligence 24/7.

Summary

Dropzone AI is a commercial SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. cyber tool that uses AI agents to investigate every alert, hunt attackers, and respond to emerging threats at machine scale. It operates as a customer-guided software execution. It is designed for SOC analysts, and its documentation positions it alongside automated investigation platforms. Dropzone AI was launched in 2022.

Dropzone AI is an agentic SOC platform with AI agents that investigate alerts, run threat hunts, and analyze threat intelligence 24/7.

How Dropzone AI helps

Which alerts in this shift's queue actually deserve an analyst's time?

investigates each alert with an AI agent that gathers the same evidence a human would pull, then reports which ones show real signs of malicious activity and which are benign, with the reasoning shown

What did this specific alert actually do across the environment?

runs an investigation that traces the alert's related activity, users, and hosts and produces a narrative of what happened, not just a severity score

Is there an attacker active right now that no alert has caught yet?

runs agents that hunt across the environment for suspicious patterns outside the existing alert queue and surfaces what they find as new leads

Should this alert trigger an automatic response or wait for a human?

judges each investigation's findings against the confidence of what it found and recommends or takes a response action, while leaving the decision guided by the customer's own rules

Why did the system conclude an alert was benign?

shows the evidence and steps the agent took to reach its verdict, so an analyst can check the reasoning rather than take the conclusion on faith

Are the same kinds of alerts getting consistent verdicts over time?

keeps a record of each investigation's evidence and conclusion, so similar alerts can be compared against past verdicts to spot drift or inconsistency

all 9 features, with the evidence for each →

Languages

Not documented

Features

9 capabilities across 3 capability groups

Built from Dropzone AI's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • Dropzone AI covers 2 of the 11 logs and telemetry capabilities we track.
  • Dropzone AI covers 1 of the 8 investigation and response capabilities we track.

What Dropzone AI offers you

  • Ticketing integration1
Log enrichment 2 features Logs and telemetry since 2026
Threat Intelligence & Indicator Management shipped Manages indicator collections from internal and external sources and enables enrichment for investigations. 2 releases · first seen Feb 2026

Shared capability: Log enrichment

release

  • Swimlane Threat Intelligence integration: enrichment for IPs, domains, URLs, hashes, email indicators; supports customer-owned intelligence sources March 2026 product updates · Mar 2026 · source · release history
  • Introduces Threat Intel workspace for managing Dropzone-provided and customer-provided indicator collections February 2026 product updates · Feb 2026 · source · release history
Alert Tagging & Classification shipped Labels incoming signals with semantic tags like Invalid Credentials and Research Scanner for better signal clarity. 1 release · first seen Jan 2026

Shared capability: Log enrichment

release

  • Adds new insight tags Invalid Credentials and Research Scanner for better signal clarity January 2026 product updates · Jan 2026 · source · release history
Log search 1 feature Logs and telemetry since 2026
Investigation Context Management shipped Provides search, filtering, sorting, and pagination capabilities for investigation context data. 1 release · first seen Mar 2026

Shared capability: Log search

release

  • Introduction of Context Memory API: filtering, search, sorting, pagination March 2026 product updates · Mar 2026 · source · release history
Incident case management 1 feature Investigation and response since 2026
Alert Investigation & Case Management shipped Breaks down large security cases into focused sub-investigations with prioritization views, blast radius analysis, and plain-language detection explanations. 4 releases · first seen Jan 2026

Shared capability: Incident case management

release

  • Adds blast radius analysis (Beta) to identify impacted users, hosts, and assets for email incidents February 2026 product updates · Feb 2026 · source · release history
  • Adds Detection objective summaries to explain alert intent in plain language February 2026 product updates · Feb 2026 · source · release history
  • Introduces multi-signal alert investigations that break large SIEM cases into focused sub-investigations with a single consolidated conclusion January 2026 product updates · Jan 2026 · source · release history
  • Launches a new investigation list view with swimlanes for faster prioritization January 2026 product updates · Jan 2026 · source · release history
Other / not yet classified 5 features Features we have not matched to a capability yet. A suggested match is marked.
Third-party Integrations shipped suggested Connects the cyber tooling to external data sources, sandbox environments, and ITSM platforms for broader alert ingestion and workflow automation. 4 releases · first seen Jan 2026

Suggested capability: Log enrichment. This is our guess, not confirmed.

Also counts toward: Ticketing integration

release

  • ServiceNow integration: query incidents, request items, alerts during investigations; configurable table selection for investigations March 2026 product updates · Mar 2026 · source · release history
  • Rapid7 InsightIDR integration: alert ingestion, user/device enrichment, process-tree analysis, LEQL query support March 2026 product updates · Mar 2026 · source · release history
  • Adds ANY.RUN integration for sandbox-based enrichment of files, URLs, domains, and IPs February 2026 product updates · Feb 2026 · source · release history
  • Expands integration coverage with Azure Monitor / Log Analytics, Vectra AI, and Exabeam (Beta) January 2026 product updates · Jan 2026 · source · release history
Threat Hunting & Reporting shipped Offers a catalog of hunt definitions and reporting capabilities to review hunt results with timelines and findings. 2 releases · first seen Feb 2026

release

  • Threat Hunter catalog and reporting (Beta): browse hunt definitions, review hunt results with timelines and findings March 2026 product updates · Mar 2026 · source · release history
  • Releases early Threat Hunter catalog and reporting (Beta) for threat hunting workflows February 2026 product updates · Feb 2026 · source · release history
Investigation Quality Metrics shipped suggested Tracks investigation accuracy by comparing outcomes against analyst feedback via dashboards. 1 release · first seen Feb 2026

Suggested capability: Metrics collection. This is our guess, not confirmed.

release

  • Adds outcome comparison dashboards (Beta) to track investigation accuracy against analyst feedback February 2026 product updates · Feb 2026 · source · release history
Integration Management shipped Provides programmatic control to list, create, update, test, enable, disable, and delete integrations. 1 release · first seen Jan 2026

release

  • Adds Integration Management APIs to list, create, update, test, enable/disable, and delete integrations January 2026 product updates · Jan 2026 · source · release history
Investigation Configuration & Response Management shipped suggested Allows configuration of investigation thresholds, global company settings, and response actions via customer APIs. 1 release · first seen Jan 2026

Suggested capability: Response playbook automation. This is our guess, not confirmed.

release

  • Adds Customer APIs to manage response actions, configure investigation thresholds, and manage global company settings January 2026 product updates · Jan 2026 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for Dropzone AI, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail Dropzone AI puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Website history

dropzone.ai, every change

Dropzone AI's home page and 34 more pages as they looked each month from August 2023 to October 2026: 43 renders, 4 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

3 entries

  1. March 20261
  2. February 20261
  3. January 20261

    3 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →