Exaforce
by Exaforce Inc.
Agentic SOC and MDR platform whose Exabot AI agents detect, triage, investigate and respond, now with an AI-agent kill switch
Exaforce is an agentic security operations (SOC) platform, sold either self-operated or as a managed detection and response (MDR) service, for security leaders who need to scale their SOC without adding analysts. Its AI agents, called Exabots, take over alert triage, investigation and response across cloud, SaaS, identity and endpoint. In September 2026 it added discovery and a kill switch for rogue AI agents.
Exaforce is a San Francisco security-operations company founded in 2023 and led by co-founder and CEO Ankur Singla. It builds an agentic SOC platform that can run alongside a SIEM or replace it. The platform ingests logs and telemetry from more than 100 sources, including AWS, Google Cloud, Azure, Okta, Microsoft Entra ID, CrowdStrike, GitHub, Google Workspace and Zscaler. It stores the raw data in real time and builds a security knowledge graph that links events, identities, permissions, configurations, code, files and cloud activity. Correlation happens when data is ingested rather than when it is queried. On top of that graph, a multi-model AI engine combines ingestion models, behavioural machine learning and LLMs, instead of relying on one general-purpose model. It drives four agents: Exabot Detect, Exabot Triage, Exabot Investigate and Exabot Respond. Customers can operate the platform with their own team or buy it as a 24/7 MDR service in which Exaforce analysts work alongside the Exabots. On 15 September 2026 the company made Exaforce AI Security generally available. The module finds AI apps, coding agents such as Claude Code and Cursor, custom GPTs, MCP servers and plugins without installing an agent. It ties each AI agent to the human identity whose permissions it uses, grades its risk, and detects misuse by correlating model-provider audit logs with endpoint, identity and code telemetry. Its 'agent kill switch' can revoke sessions, deactivate API keys, isolate devices or kill processes, at autonomy levels ranging from analyst-approved to fully automatic. Exaforce has raised $200M in total, including a $125M Series B in May 2026 that SiliconANGLE reports valued it at $725M. Named customers include Guardant Health, Invisible Technologies, Forcepoint and Commonwealth Fusion Systems. Analysts list it alongside Prophet Security, Dropzone AI, Torq and Intezer in the crowded AI-SOC category.
A CISO or SOC director running a lean team on cloud- and SaaS-heavy infrastructure who is drowning in SIEM alerts and needs AI agents, optionally backed by a managed MDR service, to cover triage and investigation.
Alert triage and investigation are handled by Exabot agents over a unified knowledge graph. Exaforce claims 90% fewer false positives and a 95% lower mean time to investigate.
At a Glance
- Category
- Governance & Security
- Pricing
- Contact for pricing, Subscription
- Target Market
- CISOs, SOC Managers, CIOs, Security Engineers
- Deployment
- Cloud-only
- Founded
- 2023
- Headquarters
- San Francisco, USA
- Team Size
- 51-200
Key Features
- ✓Exabot Detect
AI-driven detections across cloud, SaaS, identity and endpoint that aim to reduce the noise and blind spots of rule-based SIEMs.
- ✓Exabot Triage
Automated alert triage that the vendor says cuts false positives by around 90%, so analysts only see alerts that need a human decision.
- ✓Exabot Investigate
Natural-language investigation and threat hunting over the knowledge graph, so analysts do not have to write SIEM query syntax.
- ✓Exabot Respond
Automated containment actions under analyst oversight. Exaforce reports an average of under 30 minutes from alert to response.
- ✓Security knowledge graph
Correlates events, identities, permissions, configurations, code and files at ingest time, giving agents full context without expensive query-time joins.
- ✓Exaforce AI Security and agent kill switch
Discovers AI apps, coding agents, custom GPTs and MCP servers without installing an agent, then can revoke sessions, disable API keys, isolate devices or kill processes.
- ✓Self-managed or MDR delivery
The same platform can be run by an in-house team or delivered as a 24/7 managed detection and response service staffed by Exaforce analysts.
Capabilities
Use Cases
- •Replacing tier-1 alert triage
Exabots triage and investigate the SIEM/EDR alert queue automatically, and analysts review only the escalations with full investigation context.
- •Containing rogue or compromised AI agents
Security discovers the coding agents and MCP servers acting under employee credentials, flags excessive permissions, and uses the kill switch to revoke keys or sessions.
- •Cloud and SaaS identity threat detection
Correlates Okta, Entra ID, AWS and Google Workspace activity to catch token theft and OAuth abuse like the Salesloft Drift incident.
- •Outsourced 24/7 SOC coverage
A mid-size company without a night shift buys the MDR tier, and Exaforce analysts plus Exabots handle detection through response around the clock.
- •Lowering SIEM spend
The unified data layer ingests and normalises telemetry, which lets teams reduce what they store and pay for in a legacy SIEM.
Ideal For
Best For
- ✓Lean SOC teams that need 24/7 detection and response without hiring more analysts
- ✓Cloud- and SaaS-first companies whose attack surface is mainly identity, IaaS and SaaS rather than on-prem networks
- ✓Security teams that want to find, risk-grade and shut down AI agents and coding assistants running under employee identities
- ✓Organisations that want to cut SIEM storage and licensing costs by moving to a unified security data layer
- ✓Buyers who want the option of the same platform as self-operated software or a managed MDR service
Not Ideal For
- ✗Buyers who require many independent peer reviews before shortlisting: reviewers note limited review volume, and PeerSpot had collected none as of July 2026
- ✗Teams that need published list pricing to budget. Pricing is not disclosed and requires scoping with sales
- ✗Organisations with heavily on-premises or OT estates. The platform's strengths and integrations centre on cloud, SaaS and identity telemetry
- ✗Shops wanting a same-day deployment. Comparison guides note that SIEM/XDR integration tuning can require upfront effort
Deployment
Market Analysis
Pros
- ✓Covers the full SOC lifecycle (detect, triage, investigate, respond) on one platform rather than being a triage-only bolt-on
- ✓Verified Gartner Peer Insights reviewers report faster triage, more consistent investigations and less manual workload
- ✓Well funded ($200M raised, 130+ employees at the Series B), which lowers vendor-viability risk for a young company
- ✓Broad compliance posture: SOC 2 Type 2, ISO 27001, HIPAA, PCI DSS, GDPR and HITRUST listed
- ✓Among the first SOC platforms to ship detection and response for AI agents acting under employee identities
Cons
- ✗Newest entrant in the AI-SOC field (founded 2023) with limited independent validation so far, per Intezer's and UnderDefense's comparison guides
- ✗Pricing is undisclosed and must be scoped with sales, adding procurement friction
- ✗Initial SIEM/XDR integration tuning can require upfront effort before the automation pays off
- ✗Headline outcome metrics (90% fewer false positives, 95% faster MTTI, $600K savings) are vendor-reported, not independently audited
Pricing
Agentic SOC Platform (self-managed)
Contact for pricing
- ✓Exabot Detect, Triage, Investigate, Respond
- ✓100+ data source integrations
- ✓Exaforce AI Security module
Managed MDR
Contact for pricing
- ✓24/7 expert analysts plus Exabots
- ✓Detection, triage, investigation and response on the customer's behalf
No list pricing is published. According to an UnderDefense comparison guide, Exaforce offers two models: one priced on named users and cloud resources, the other outcome-based on alerts triaged and data ingested. Both require a sales scoping call. The MDR service is quoted separately from the self-managed platform.
Security & Compliance
Sources
This page was written from 7 sources, 5 on domains other than exaforce.com.
- 1.exaforce.com — exaforce.comvendor
- 2.exaforce.com — exaforce raises 125m series b to combat ai powered attacks wvendor
- 3.siliconangle.com — exaforce adds a kill switch for ai agents that go rogue
- 4.securityweek.com — exaforce raises 125 million for agentic soc platform
- 5.venturebeat.com — exaforce raises 125m series b to combat ai powered attacks w
- 6.underdefense.com — best ai soc providers
- 7.intezer.com — top 15 ai soc platforms in 2026
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
Arcjet
Runtime security for AI agents: observe, enforce and audit agent tool calls, with prompt-injection, PII and abuse controls in code
Vals AI
Independent AI benchmarking on private test sets, plus custom evals built from your own code, for legal, finance, healthcare and coding workloads
Alation AIOS
Governed data, context and AI agents in one intelligence operating system for the enterprise
Apollo Research Watcher
Runtime monitoring and blocking for Claude Code and Codex: catch dangerous coding-agent actions before they run