Andesite AI vs Legion Security
Andesite AI
Andesite AI, based in McLean, Virginia, sells what it calls the Human-AI SOC, connecting SIEM, SOAR, identity and other sources so configurable agents can automate investigation, high-volume alert handling and enrichment. Vendor pages describe threat hunting to determine scope, assessing scope and blast radius, and launching remediation directly from investigation findings, with an Evidentiary AI audit trail behind each conclusion. Founded in 2023, it has raised $38.25m from General Catalyst and Red Cell Partners, and announced FedRAMP High Authorized status on 31 March 2026. Deployment is SaaS, air-gapped self-managed, or hybrid.
Pros
- FedRAMP High Authorized status announced March 2026 (vendor press release)
- Air-gapped self-managed deployment is offered, which is rare in this category (vendor FAQ)
- SOC 2 Type II and ISO 27001, 27701 and 42001 stated by the vendor on the product page
- $38.25m raised from General Catalyst and Red Cell Partners (vendor release; SiliconANGLE February 2025)
Pricing: Not published. The vendor FAQ describes pricing as outcome-based rather than AI-usage-based; contact sales.
Legion Security
Legion Security helps enterprise security teams scale detection, investigation and response using agentic AI. The platform captures and learns from the real workflows analysts already use, and turns those actions into agentic playbooks the team can trust. The vendor positions this as a way to adopt frontier AI models gradually while keeping operational trust, reducing manual effort and preparing for autonomous security capabilities. It deploys through the analyst's browser rather than through API integrations, and uses vision models combined with other methods to observe how analysts investigate alerts, so the enterprise can either codify those processes or optimise them into visual agentic workflows that the team can inspect. Legion Security has offices in New York and Tel Aviv and is backed by Coatue, Accel and Picture, with investors from Island, CrowdStrike, Wiz and Google DeepMind. The company was founded in 2024 by former Microsoft Sentinel team members and emerged from stealth in July 2025.
Pros
- Raised $38M total: an $8M seed led by Picture Capital and Accel, and a $30M Series A led by Coatue (Calcalist, Fortune)
- Founding team includes former members of Microsoft's Sentinel product, per Calcalist
- Browser-based deployment is designed to avoid custom API integration work, per the company
- Customers cited on the vendor site report outcomes such as an 81% reduction in MTTI/R (WELL Health Technologies, vendor-cited)
Pricing: