Prophet Security

What is Prophet Security?

Prophet Security is a company that builds Prophet AI, an agentic AI platform for security operations teams. Its main agent, the AI SOC Analyst, picks up every incoming alert, plans an investigation, queries your connected security tools and returns a verdict with the evidence behind it. The goal is to cut the alert backlog that leaves human analysts chasing false positives while real threats wait in the queue.

The platform now has four parts: the AI SOC Analyst, an AI Threat Hunter, an AI Detection Engineer and Prophet AI Watchtower, a 24/7 human review service. Kamal Shah is co-founder and CEO, and the company came out of stealth in 2024 with offices in Menlo Park, California. In July 2025 it announced a $30 million Series A led by Accel, which took total funding to $41 million with an earlier $11 million seed. Customers named on its site include Udemy, Instacart, Redis and Bill.com.

Key Features

• AI SOC Analyst: Prophet’s AI SOC Analyst investigates every alert end to end and returns a determination with supporting evidence. It summarises the alert, pulls out key artefacts and decides whether the activity is malicious or benign, so analysts start from a finished investigation.
• Dynamic investigation planning: The agent writes the questions an experienced analyst would ask, then runs them across SIEM, EDR, identity, cloud and email tools at once. Prophet says investigation time stays flat whether a day brings 50 alerts or 2,000.
• Audit-ready reasoning: Every investigation records the questions asked, queries run and reasoning steps, with citations to the original data. Reviewers can check how the agent reached a verdict, which helps with audits and with building trust in the output.
• Controlled response actions: Prophet groups related investigations into one incident and can run scoped, permissioned actions such as notifications or machine quarantine. Actions are previewed and backtested first, and only pre-approved actions run without a human.
• AI Threat Hunter: The AI Threat Hunter accepts hunting questions in plain English and runs them against your environment. Hunters no longer need to write custom query languages, and the agent also researches emerging threats to suggest new hunts.
• AI Detection Engineer: The AI Detection Engineer maps your real MITRE ATT&CK coverage and points out gaps. It then delivers backtested detections and flags noisy rules, so detection teams can tune what reaches the queue.
• Prophet AI Watchtower: Watchtower adds 24/7 human experts who review malicious determinations made by the AI. The company says escalations reach your team within 30 minutes, which suits teams without overnight analyst cover.
• Plain-language feedback: Teams teach Prophet their playbooks, policies and preferences in plain language, either organisation-wide or for one investigation. Each learned entry shows its source, and changes are previewed and backtested before they shape future verdicts.
• Enterprise data controls: Prophet offers single-tenant deployment, bring-your-own-key encryption and data residency support. The company states that customer data never trains its models and that it holds a SOC 2 Type 2 report.

Pros

• Faster investigations: Prophet reports investigations finishing in under five minutes on average, against hours for manual triage. The company also claims 10 times faster response, and one customer quote cites a 95% cut in manual review.
• Fewer false positives: Prophet says its platform cuts false positives by 96% across its customer base. Analysts spend less time closing benign alerts and more time on confirmed incidents, though you should measure this on your own alert mix.
• Transparent verdicts: Each verdict comes with cited evidence and a full query log, so nothing is a black box. Senior analysts can audit a decision in minutes and correct the agent when it gets context wrong.
• Wide tool coverage: Prophet lists more than 200 out-of-the-box integrations across SIEM, EDR, identity, cloud, email and ticketing. It works on top of your current stack, so you do not need to centralise data or replace existing tools first.
• Quick deployment: Prophet says setup takes 30 minutes or less with read-only access to two or three data sources. Teams can see results on live alerts early in an evaluation rather than after a long rollout project.
• Strong data governance: Single-tenant hosting, customer-managed keys and a no-training commitment address common worries about sending security data to AI. These controls make the platform easier to approve through procurement and legal review.

Cons

• No public pricing: Prophet Security does not publish prices, so every buyer must book a demo to get a quote. Smaller teams cannot judge affordability early, and budget comparisons with rivals take longer.
• Depends on telemetry quality: Prophet’s verdicts can only be as good as the logs and tool access you connect. One analysis notes that sparse logging or missing API access will weaken accuracy, so mature data sources come first.
• Few independent reviews: Independent user reviews on sites such as G2 and TrustRadius were still sparse when we checked. Most performance figures come from the vendor, so a proof of concept is the safest way to confirm results.
• Enterprise-focused product: Prophet targets mid-sized and large organisations with established security operations. Small businesses without a SIEM, EDR or dedicated analysts may get limited value and might prefer a managed detection service instead.
• Autonomy needs governance: Automated remediation only runs for actions you pre-approve, so teams must define and maintain those permissions. Some practitioners also question how far AI SOC tools go beyond automation layered on older SOAR ideas.

Who is Using Prophet Security?

• Enterprise SOC teams: Large security teams use Prophet to clear high alert volumes and reduce analyst burnout.
• Lean security teams: Smaller in-house teams use it to cover alerts around the clock without adding headcount.
• Threat hunters: Hunters ask plain-English questions of their data instead of writing complex queries.
• Detection engineers: Engineers use coverage mapping and backtested rules to close MITRE ATT&CK gaps.

Pricing

Prophet Security uses custom enterprise pricing that you get by requesting a demo (checked October 2026).

Directories such as Toolradar also list Prophet as paid only, with no self-serve tier. Ask for a written quote that covers alert volume, data sources and any Watchtower add-on before you commit.

What Makes Prophet Security Unique?

Prophet pairs fully autonomous alert investigation with a visible trail of every question, query and citation behind each verdict. Many AI SOC tools give a score; Prophet shows the work, then lets analysts correct it in plain language and backtest that guidance before it changes future results. The optional Watchtower service adds human experts on top of the agents, which gives teams a hybrid of AI speed and human sign-off for malicious findings.

Compatibilities and Integrations

• SIEM and data lakes: Splunk, Microsoft Sentinel, Elastic, Google Security Operations, QRadar, Sumo Logic, Snowflake and Databricks.
• Endpoint and identity: CrowdStrike Falcon, Microsoft Defender, SentinelOne, Okta, Microsoft Entra ID and Ping Identity.
• Cloud and email: AWS, Azure, Google Cloud, Wiz, Proofpoint, Mimecast and Abnormal Security.
• Ticketing and chat: Jira, ServiceNow, Slack, Microsoft Teams, PagerDuty and webhooks.

Prophet Security Tutorials

Getting Prophet running on live alerts takes a short setup and a few connections.

1. Request a demo on the Prophet Security website and agree the scope of your evaluation.
2. Create your account and grant read-only access to two or three core data sources, such as your SIEM and EDR.
3. Let the AI SOC Analyst investigate incoming alerts and review its verdicts, evidence and query logs.
4. Teach it your playbooks and policies in plain language, then backtest those changes.
5. Connect Slack, Teams or Jira so results reach your team, and pre-approve any response actions.

How We Rated It

Summary

Prophet Security suits mid-sized and enterprise security teams that drown in alerts and want an AI analyst whose reasoning they can inspect. Its main limitation is opaque pricing, and results depend heavily on the quality of the telemetry you connect. We like the audit trail and data controls, but the evidence for its headline metrics is still mostly vendor-supplied. Run a proof of concept on a week of your own alerts and compare its verdicts with your analysts’ calls before signing.