Exaforce vs Legion Security
Exaforce
Exaforce is a San Jose company founded in 2023 offering an agentic SOC platform built on a real-time knowledge graph. Four agents the vendor calls Exabots cover detection, triage, investigation and response across more than 100 integrations spanning AWS, Azure, GCP, Okta, GitHub, CrowdStrike and Splunk. Exabot Investigate supports cross-environment pivoting and natural-language hunting, and Exabot Respond executes containment such as isolating instances, disabling users and revoking sessions, with human approval gates where configured. It is sold either customer-operated or as an Exaforce-run managed detection and response service. The company raised $75m in April 2025 and $125m in May 2026.
Pros
- Names its containment actions explicitly rather than describing response in general terms (exaforce.com/platform/exabot-respond)
- Ships a dedicated investigation and hunting agent separate from triage (exaforce.com/platform/exabot-investigate)
- $200m raised across two rounds, reported at a $725m valuation (SecurityWeek, TechCrunch, May 2026)
- Named customers include Replit and Guardant Health (TechCrunch, May 2026)
Pricing: Not published; contact sales
Legion Security
Legion Security helps enterprise security teams scale detection, investigation and response using agentic AI. The platform learns from the real workflows security teams already run, across the SOC and beyond, and turns that institutional knowledge into agentic playbooks the team can trust and audit. This lets organisations adopt frontier AI models gradually while preserving operational trust, cutting manual effort and building toward autonomous security capabilities. Rather than depending on API integrations, Legion combines vision models with other methods to observe how practitioners actually work, so teams can codify those processes as they are or optimise them into transparent, inspectable agentic workflows, extending the same approach beyond the SOC to security operations across the enterprise. Legion Security has offices in New York and Tel Aviv and is backed by Coatue, Accel and Picture, with investors from Island, CrowdStrike, Wiz and Google DeepMind. The company was founded in 2024 by former Microsoft Sentinel team members and emerged from stealth in July 2025.
Pros
- Raised $38M total: an $8M seed led by Picture Capital and Accel, and a $30M Series A led by Coatue (Calcalist, Fortune)
- Founding team includes former members of Microsoft's Sentinel product, per Calcalist
- Browser-based deployment is designed to avoid custom API integration work, per the company
- Customers cited on the vendor site report outcomes such as an 81% reduction in MTTI/R (WELL Health Technologies, vendor-cited)
Pricing: