D3 Security Morpheus vs Legion Security
D3 Security Morpheus
D3 Security is a Vancouver-based automation vendor that built SOAR products before launching Morpheus, which it describes as an accountable agentic SOC platform. The vendor states that Morpheus autonomously handles both first-line triage and second-line work: full attack path investigation, blast radius assessment and playbook generation, without analyst intervention. An Attack Path Discovery engine produces an attack narrative, horizontal and vertical attack paths, MITRE ATT&CK mapping and a timeline, and Morpheus generates and executes response playbooks at runtime. It claims more than 800 integrations and supports cloud, on-premise, hybrid and air-gapped deployment. Named customers on the vendor site include PwC, Scotiabank and S&P Global.
Pros
- The vendor FAQ states second-line investigation, blast radius assessment and runtime response playbooks explicitly (d3security.com/faq)
- Offers cloud, on-premise, hybrid and air-gapped deployment, which most agentic SOC vendors do not (d3security.com/faq)
- SOC 2 Type II stated by the vendor
- Rated 4.2 out of 5 across 69 reviews on G2 (g2.com/products/d3-security/reviews)
Pricing: Not published. The vendor describes a fixed annual subscription tied to a daily alert volume tier, from 500 to 10,000 alerts per day with custom pricing above that, plus named user licences and no per-alert fees.
Legion Security
Legion Security helps enterprise security teams scale detection, investigation and response using agentic AI. The platform captures and learns from the real workflows analysts already use, and turns those actions into agentic playbooks the team can trust. The vendor positions this as a way to adopt frontier AI models gradually while keeping operational trust, reducing manual effort and preparing for autonomous security capabilities. It deploys through the analyst's browser rather than through API integrations, and uses vision models combined with other methods to observe how analysts investigate alerts, so the enterprise can either codify those processes or optimise them into visual agentic workflows that the team can inspect. Legion Security has offices in New York and Tel Aviv and is backed by Coatue, Accel and Picture, with investors from Island, CrowdStrike, Wiz and Google DeepMind. The company was founded in 2024 by former Microsoft Sentinel team members and emerged from stealth in July 2025.
Pros
- Raised $38M total: an $8M seed led by Picture Capital and Accel, and a $30M Series A led by Coatue (Calcalist, Fortune)
- Founding team includes former members of Microsoft's Sentinel product, per Calcalist
- Browser-based deployment is designed to avoid custom API integration work, per the company
- Customers cited on the vendor site report outcomes such as an 81% reduction in MTTI/R (WELL Health Technologies, vendor-cited)
Pricing: