CISO Tribune

Vendor comparison · 2 companies

Anomali vs Legion Security

Anomali is a cybersecurity platform that combines a unified security data lake, threat intelligence, and agentic AI for security operations. Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn. CISO Tribune files both under AI SOC analysts. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Anomali
  • Legion Security
Anomali vs Legion Security: Products, Customers and Funding Compared
AnomaliAnomali is a cybersecurity platform that combines a unified security data lake, threat intelligence, and agentic AI for security operations.anomali.comLegion SecurityLegion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn.legionsecurity.ai
What it sells
  • Anomali IntegratorEnriches and automatically distributes threat intelligence across a security ecosystem.
  • Legion[1][2][3][4][5][6][7][8]Turns a team's knowledge, tools and processes into agents that investigate alerts and carry out approved responses.
Categories
Headquarters
Redwood City, United States[2]Tel Aviv, Israel[1]
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • May 5, 2026Anomali announced ThreatStream Next-Gen, available as a standalone intelligence solution and embedded within the Anomali Unified Security Data Lake.[2]
Not stated on its pages
G2 and Gartner Peer Insights
  • G2: listed, seen November 4, 2026[4]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 10, 2026[9]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Anomali sells mainly to enterprise security teams and public-sector organizations. Anomali says its 400+ enterprise customers span financial services, critical infrastructure, government, and national defense. Anomali also says its platform works alongside the SIEM, EDR, and SOC tools customers already own, and the data lake can optimize existing SIEMs or replace them. Anomali's threat intelligence sharing is aimed at ISACs and partners.Legion is described as running in production across the SOC, DLP, identity, vulnerability management and GRC. Legion Security says it has early traction among financial services, healthcare and manufacturing customers. Legion operates through a browser extension and integrates with anything accessed through the browser.
Last verified
September 27, 2026November 8, 2026

Where they overlap

  • AI SOC analysts is the primary category of both Anomali and Legion Security.

Where they differ, field by field

  • Anomali is also filed under Threat intelligence and Security data lakes and pipelines.
  • Anomali lists Anomali Integrator. Legion Security lists Legion.
  • Anomali is headquartered in Redwood City, United States. Legion Security is headquartered in Tel Aviv, Israel.

How they differ

CISO Tribune files Anomali under AI SOC analysts, threat intelligence, and security data lakes and pipelines, with AI SOC analysts as its primary category. CISO Tribune files Legion Security under AI SOC analysts only, and that is also its primary category. Anomali describes a platform that combines a unified security data lake, threat intelligence, and agentic AI for security operations. Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts and carry out approved responses.

Anomali says it normalizes data into OCSF and that its data lake can optimize existing SIEMs or replace them. It also sells Anomali Integrator, which distributes threat intelligence across a security ecosystem, and its AURA agent triages and investigates with approval thresholds. Legion operates through a browser extension, without integrations or APIs, and learns from browser recordings, runbooks and past cases. Legion Security says Legion runs in production across the SOC, DLP, identity, vulnerability management and GRC.

Anomali is headquartered in Redwood City, United States, while Legion Security is headquartered in Tel Aviv, Israel. Anomali states that it has 400+ enterprise customers across financial services, critical infrastructure, government, and national defense, and that it is backed by Google Ventures, General Catalyst, and IVP. Legion Security describes itself as a Series A startup with early traction among financial services, healthcare and manufacturing customers. On May 5, 2026, Anomali announced ThreatStream Next-Gen, available as a standalone intelligence solution and embedded within the Anomali Unified Security Data Lake. Legion can be purchased on the AWS Marketplace and is offered through the CrowdStrike Marketplace and GCP Marketplace.

What it sells: Legion Security

What Legion does[1][2][3][4][5][6][7][8]
Legion learns a team's current processes, tools and context from the browser, past cases and more. Legion investigates everything, clearing false positives and benign activity, and escalates what matters and contains threats. Legion operates through a browser extension, without integrations or APIs.

Questions about Anomali and Legion Security

What do Anomali and Legion Security sell?
Anomali sells Anomali Integrator. Legion Security sells Legion.
Are Anomali and Legion Security in the same category?
Yes. AI SOC analysts is the primary category of both on CISO Tribune.
Where are Anomali and Legion Security headquartered?
Anomali is headquartered in Redwood City, United States. Legion Security is headquartered in Tel Aviv, Israel.
Who are Anomali and Legion Security sold to?
From its own pages, Anomali sells mainly to enterprise security teams and public-sector organizations. Legion is described as running in production across the SOC, DLP, identity, vulnerability management and GRC.
What have Anomali and Legion Security announced recently?
May 5, 2026: Anomali announced ThreatStream Next-Gen, available as a standalone intelligence solution and embedded within the Anomali Unified Security Data Lake.

About Anomali

Anomali is a cybersecurity platform that combines a unified security data lake, threat intelligence, and agentic AI for security operations. Anomali says the platform is designed to help security teams centralize data, enrich it with threat context, and improve detection, investigation, and response.[6]

Anomali describes the problem it addresses as security teams having more telemetry, tools, and AI initiatives than ever while the underlying data remains fragmented, noisy, and disconnected from the intelligence needed to act. Anomali cites 69% of enterprises running 10 or more detection and response tools, and says analysts face 174 alerts per day, of which only 22% are worth a real investigation.

Anomali says it normalizes everything into OCSF, one common schema, so a detection is written once and works everywhere. Native threat intelligence enrichment is applied at ingest and search time through native integration with ThreatStream Next-Gen. Anomali says the data lake can be used to optimize existing SIEMs or replace them entirely.[7][12]

Anomali says it aggregates intelligence from hundreds of open, commercial, and community sources, backed by over a decade of continuously curated threat graph. That intelligence is fused with the customer's assets, users, event logs, and incident history, and can be pushed to detection tools, response playbooks, and AI agents. ThreatStream Next-Gen also supports sharing intelligence with ISACs, partners, and internal teams via Trusted Circles and STIX/TAXII.[8]

AURA, the Anomali Unified Response Agent, triages, investigates, and recommends, with approval thresholds, rollback, and an audit trail. Anomali says that by default, consequential actions await human approval. The Anomali Autonomy Model moves each workflow from Recommend to Approve to Act, one step at a time.

Anomali Integrator enriches and automatically distributes threat intelligence across a customer's security ecosystem. It includes out-of-the-box integrations with common endpoints, SIEMs, firewalls, proxies, DNS, ISACs, and more.[9][10]

Anomali states that it has 400+ enterprise customers across financial services, critical infrastructure, government, and national defense, and says it is backed by Google Ventures, General Catalyst, and IVP. Anomali says its platform works with the SIEM, EDR, cloud, identity, email, and SOC tools customers already own.

Anomali names its founder as Hugh Njemanze and its CTO as Wei Huang.[1][6][7][9][10][11]

Anomali on the record

Sources

Anomali full record

  1. [1]anomali.comAnomali · anomali.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Anomali launches ThreatStream Next-Gen to turn intelligence into action — at the speed threats demandAnomali · published May 5, 2026 · Tier A
  3. [3]Anomali | Agentic SOC Platform for Governed Security ActionAnomali · undated page, accessed October 23, 2026 · Tier A
  4. [4]Anomali Security Analytics Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 23, 2026 · Tier C
  5. [5]Anomali Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed October 23, 2026 · Tier C
  6. [6]About Anomali | AI-Powered Security and IT OperationsAnomali · undated page, accessed November 4, 2026 · Tier A
  7. [7]Unified Security Data Lake | AnomaliAnomali · undated page, accessed November 4, 2026 · Tier A
  8. [8]ThreatStream Next-Gen - Managed Threat Intelligence | AnomaliAnomali · undated page, accessed November 4, 2026 · Tier A
  9. [9]Anomali Integrator | Security Automation and OrchestrationAnomali · undated page, accessed November 4, 2026 · Tier A
  10. [10]Customer Success for Security Operations Teams | AnomaliAnomali · undated page, accessed November 4, 2026 · Tier A
  11. [11]Cybersecurity Training | Anomali UniversityAnomali · undated page, accessed November 4, 2026 · Tier A
  12. [12]AI-Powered Cybersecurity & Agentic SOC Platform | AnomaliAnomali · undated page, accessed November 4, 2026 · Tier A

Legion Security full record

  1. [1]Legion security launches dragonclaw agent orchestration with context for your socLegion Security · legionsecurity.ai · published July 30, 2026 · Tier A
  2. [2]legionsecurity.aiLegion Security · legionsecurity.ai · undated page, accessed November 8, 2026 · Tier A
  3. [3]Legion Security | The Agentic Security Operations PlatformLegion Security · undated page, accessed November 10, 2026 · Tier A
  4. [4]Learning Mode - AI SOC Workflow Mapping | Legion SecurityLegion Security · undated page, accessed November 10, 2026 · Tier A
  5. [5]Legion CareersLegion Security · undated page, accessed November 10, 2026 · Tier A
  6. [6]About Legion Security | AI that learns from within your SOCLegion Security · undated page, accessed November 10, 2026 · Tier A
  7. [7]Partners & IntegrationsLegion Security · undated page, accessed November 10, 2026 · Tier A
  8. [8]Trust | Legion SecurityLegion Security · undated page, accessed November 10, 2026 · Tier A
  9. [9]Legion Security Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed November 10, 2026 · Tier C

Spot a factual error? Request a correction.