Exaforce

Agentic SOC platform with separate agents for detection, triage, investigation and response

ToolTier 2 SOC AutomationCloud

Pricing: Not published; contact sales

Reviewed by the Cyber Vendor Guide editorial team against the public sources cited below · Last reviewed August 2026 · How we review listings

What is Exaforce?

Exaforce is a San Jose company founded in 2023 offering an agentic SOC platform built on a real-time knowledge graph. Four agents the vendor calls Exabots cover detection, triage, investigation and response across more than 100 integrations spanning AWS, Azure, GCP, Okta, GitHub, CrowdStrike and Splunk. Exabot Investigate supports cross-environment pivoting and natural-language hunting, and Exabot Respond executes containment such as isolating instances, disabling users and revoking sessions, with human approval gates where configured. It is sold either customer-operated or as an Exaforce-run managed detection and response service. The company raised $75m in April 2025 and $125m in May 2026.

Best for: Cloud and SaaS-heavy enterprises that want agent-driven investigation and hunting with automated containment behind approval gates.

Pros

✓ Names its containment actions explicitly rather than describing response in general terms (exaforce.com/platform/exabot-respond)
✓ Ships a dedicated investigation and hunting agent separate from triage (exaforce.com/platform/exabot-investigate)
✓ $200m raised across two rounds, reported at a $725m valuation (SecurityWeek, TechCrunch, May 2026)
✓ Named customers include Replit and Guardant Health (TechCrunch, May 2026)

Things to check

• Around 20 customers as of May 2026, so the deployment base is small (TechCrunch, May 2026)
• Cloud, SaaS and identity focused, with no self-hosted option stated
• Pricing is not published
• Certifications are vendor-stated on the site footer rather than shown on a public register

Reported in public reviews and vendor documentation. See sources below.

Key Features

Separate Detect, Triage, Investigate and Respond agents rather than a single triage engine

Real-time knowledge graph linking events, identities, permissions and configurations

Natural-language investigation and threat hunting

Identity chain and effective-permission visualisation for scoping an incident

Automated response actions including isolating cloud instances, quarantining email, blocking IPs, disabling endpoints, resetting MFA and revoking sessions

Approval gates in Slack, Teams or email before response actions run

Visual workflow builder mixing deterministic and reasoning steps

More than 100 integrations across cloud, identity, SaaS, endpoint and email

Available as a platform or as a managed service

Are you Exaforce? Improve this listing with screenshots, case studies and more.