The two buying questions
A standalone AI SOC sits on top of whatever tools you run and works alerts from all of them. Platform AI sits inside one vendor's SIEM, EDR or security suite and works best, or only, with that vendor's data. A team that runs Microsoft for everything faces a different decision from a team with a mixed stack. This site ranks the first kind. This note reads the pages of the second kind, as of 11 October 2026.
Microsoft Security Copilot
Microsoft describes Security Copilot as a generative AI assistant, available standalone or embedded in Microsoft security products. It is priced in security compute units. At least one provisioned SCU is required, and overage SCUs are billed pay-as-you-go up to a limit you set. Microsoft's own billing example uses $4 per provisioned SCU and $6 per overage SCU per hour. The page also says Security Copilot agents across Defender, Entra, Intune and Purview come at no added cost with Microsoft 365 E5. Of everything in this note, this is the most transparent pricing, and it is published by a platform vendor, not a standalone AI SOC.
Gemini in Google Security Operations
Google Security Operations combines SIEM, SOAR and threat intelligence. Gemini features include natural-language search, an investigation chat assistant, AI case summaries, recommended response actions and help creating detections and playbooks. Gemini is listed in the Enterprise and Enterprise Plus packages, not Standard. All three packages are priced by ingestion and marked contact sales.
CrowdStrike Charlotte AI
CrowdStrike calls Charlotte AI agentic AI for the modern SOC, with sections on agentic triage and on taking action across the stack. Neither the Charlotte AI page nor CrowdStrike's pricing page shows a Charlotte AI price; the pricing page lists Falcon endpoint packages per device.
SentinelOne Purple AI
Search results show SentinelOne describing Purple AI as an agentic AI security analyst that automates triage, investigation and threat hunting; the page itself did not render for us. Purple AI is not listed on SentinelOne's package pricing page.
What the pattern shows
- Packaging. Each is bought as part of a platform purchase or an upgrade to it.
- Price. Only Microsoft publishes a usable rate. Google and CrowdStrike route pricing through sales or bundles.
- Scope. Each works best on its own platform's data. Google's page says Security Operations ingests from on-premises and all major clouds, which widens its reach as a SIEM, but the AI still lives inside that SIEM.
When platform AI is the better choice
If your SIEM, EDR and identity tools come from one vendor, its AI may already see everything you need, and it may be included in licences you hold. Adding a standalone AI SOC on top would add a supplier and a data flow.
When a standalone AI SOC is the better choice
If your alerts come from several vendors' tools, if you want autonomy settings that do not depend on any one platform, or if you expect to change SIEM or EDR in the next few years, a standalone AI SOC keeps the investigation layer separate from the tools underneath.
Why we do not rank them together
Scoring Security Copilot against Mate Security or Dropzone AI on the same rubric would compare a feature of a suite with a product bought on its own. The answer would mostly reflect how much of that suite you already own. We list the four on the rankings page with what their pages say, and leave the comparison to your stack.
A quick test for your own case
List the tools your top five alert sources come from. If all five belong to one platform vendor, price that vendor's AI first, since you may already be licensed for part of it. If they come from three or more vendors, start with the standalone platforms ranked on this site, and ask each how deeply it queries the tools you named.