Cumulative Scoring: AI-SOC Vendors.xlsx

	A	B	C
1	Crogl	Subcategory	Vendor answer
2		Demonstrated efficiency improvements	MTTR reduced from hours to minutes/seconds.
3		Alert escalation rate, True/False positive accuracy and verification method	Crogl doesn't track false positives as it is operating under the assume breach methodlogy. There are multiple built in self checking mechanisms to ensure correct verdict. About 5% of alerts are escalated.
4		Investigation speed, Scalability and performance during peak load	Investigation speed is 5 minutes. For threat hunts can be 20 minutes. Typical volume is 5000-6000 alerts / day and Crogl has no problems with that.
5		Context enrichment and artifact analysis	Context is gathered using API calls, close to 1 PB collected per day across all customers. No sandboxing built in as such. CISA Threat Intel is shipped with the product, clients can bring in their own TI platforms.
6		Detection of novel/unknown threats/AI evastion handling	AI evasion handling is accounted for. Novel threats can still be picked up by Crogl by mapping to kill chain steps and by relying on CISA advisories.
7		Explainability, Human feedback integration and learning speed	Explainability in place. Human feedback can be given and response plans can be modified. Users rarely disagree with the products assessment. Less than 3% of cases have their verdicts questioned.
8		Time to full operation	Fully operational within days or hours depnding on deployment type.
9		Integrations (out of the box, headless, custom)	100 total integrations. Out of the box integrations include major players in the cybersecurity landscape. No SOAR built in natively, but integrations with SOAR platforms are available and actions that need to be taken are communicated to analysts.
10		Multi-tenancy, data retention, export, governance, deletion control	Multi tenancy, data control - deletion, export, retention etc. are supported
11		Additional capabilities beyond detection and response	On-prem deployment, threat hunting using natural language
12		Compliance with security standards	SOC 2 Type 2, authorization to operate in classified environments
13		Licensing model, Total cost of ownership and hidden costs	Licensing per data source, even with more complex deployment there are no additional costs.
14		Roadmap visibility and feature requestability	Roadmap is communicated with the customers, features can be requested.
15		Support availability and SLAs	Support available through phone-call / e-mail, slack and teams
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100