CyberKord, D3 Security, Swimlane and Tines

About D3 Security

D3 Security sells Morpheus, an agentic SOC platform. Morpheus triages, investigates and responds across the full alert lifecycle, with every verdict graded by its evidence and every step on one traceable record. Morpheus defers to a human when it is uncertain. Morpheus includes the AI in its price rather than charging on a meter. D3 Security states that it is independent and profitable, has been in cybersecurity since 2012 and built Morpheus from scratch. D3 Security launched its SOAR in 2014.^[1][4]

Morpheus grades every finding by evidence quality: Confirmed, Inferred, or Gap. When Morpheus cannot confirm a finding, Morpheus grades it Gap and hands the alert to an analyst. The Cybersecurity Triage Reasoning Graph classifies each alert, scores confidence and decides whether the alert warrants a full investigation. Attack Path Discovery is D3 Security's investigation engine and traces every alert across identities, endpoints, cloud and email infrastructure. Attack Path Discovery maps blast radius, validates IOCs and drafts remediation before an analyst opens the case. When incident response opens a Morpheus case, the case already carries a verdict, evidence, MITRE mapping and a drafted response plan. Adaptive Tasking is a conversational copilot inside every Morpheus case. Adaptive Tasking is grounded in the case's evidence and can dispatch agents to gather more intel from any of the 800+ integrations. Morpheus vulnerability triage applies the same investigation engine to scanner and AI-discovered findings.^[1][5][9]

Morpheus offers four autonomy modes, Deterministic, AI-Assisted, AI-Led and Autonomous, on one engine with one audit trail, chosen per use case and changed by configuration. In one Morpheus mode, Morpheus investigates and proposes, and the analyst approves every state-changing action such as host isolation, account suspension or IP block. Morpheus response actions flow through 800+ self-healing integrations, including host isolation, account suspension, mailbox purge and ticket creation.^[5]

Morpheus includes deterministic playbooks, 800+ self-healing integrations, integrated case management and a full audit trail per incident. The deterministic playbook engine in Morpheus offers drag-and-drop authoring, version control, YAML export and GitHub versioning. Morpheus connectors cover SIEM, EDR, IAM, cloud, email security, NDR, threat intel and ITSM platforms. Morpheus monitors every connector across every tenant and generates corrective code autonomously when drift is detected. Morpheus reads the detections a customer already has, investigates across the identity, endpoint, email, network and cloud tools the customer already owns, and writes the result back to the existing system of record where the integration supports it.^[4][6]

Case management in Morpheus keeps one incident record across triage, investigation, response and evidence. Morpheus case management includes incident timeline, evidence preservation, custody chain, analyst notes, SLA tracking and regulator-ready exports. Morpheus writes every playbook step, analyst approval, integration call and command outcome to a single audit trail per incident. Morpheus maps its audit trail to SEC Item 1.05, NYDFS 500, HIPAA, NERC CIP, NIS2, DORA and the EU AI Act.^[4]

Smart SOAR gives security teams automation and orchestration to offload manual processes, spot real incidents and trigger actions. Smart SOAR connects tools through REST API and vendor-agnostic integrations and automates workflows without coding. Smart SOAR enriches security events with threat intelligence including indicator, actor, digital risk, fraud, industry and service data. Smart SOAR lets teams configure and test integrations and playbooks from a single screen. Analysts opening an alert in Smart SOAR see incident types, playbooks, linked events, IOCs, logs and data from threat intelligence, incident knowledge and MITRE ATT&CK TTPs. Smart SOAR custom dashboards compare metrics such as MTTR, MTTD, number of incidents by type and open and close tickets by analyst against predetermined benchmarks. Smart SOAR provides customized compliance reporting for GDPR, HIPAA and 23 NYCRR 500.^[7][8]

D3 Security states that Morpheus is built for Fortune 500 SOCs and the largest MSSPs. Morpheus is a multi-tenant agentic SOC platform for MSSPs and MDR providers. For service providers, Morpheus runs L1 and L2 investigation end to end on every client's alerts, grades every verdict by its evidence and executes response on deterministic playbooks with hard guardrails. In Morpheus, autonomy is set per client and tenant data stays sealed, including from the AI. Morpheus gives each tenant its own data partition, credentials, playbooks and audit trail, and scopes the AI's context to that tenant. Morpheus invokes no AI inference for tenants set to Deterministic. Morpheus tenants can be placed in Azure regions in the US, Canada, Ireland and Japan, on-premises, or air-gapped. Morpheus drafts client-specific playbooks from the client's connected stack and the provider's SOPs, the provider's team reviews and approves them, and a deterministic engine executes what was approved.^[9]

Banks and major financial organizations use Morpheus to investigate alerts, build audit ready case records and track cases across cyber, fraud, privacy and corporate security teams. Morpheus runs Tier 1 and Tier 2 investigations across identity, endpoint, email and cloud signals. Morpheus investigates across IT, OT and physical signals and builds case records. Morpheus triages and investigates routine alerts and escalates the cases that need human judgment.^{[4][5][7][10]}

About Swimlane

Swimlane sells an agentic AI automation platform that puts AI agents to work across the SOC, from customer-defined detections to fully agentic investigations. Swimlane AI SOC uses agentic AI that plans, executes, and documents each investigation, keeping every decision explainable and every action auditable. Swimlane AI SOC takes alerts from SIEM, EDR, and cloud tools, plus detection logic that the customer writes for threats those tools miss. Swimlane AI SOC uses intelligent routing to send each alert to automation, AI-assisted investigation or fully agentic investigation. Swimlane AI SOC sends known alerts to deterministic playbooks and reserves tokens for AI reasoning when unknown alert types occur.^[4]

Customer-defined detections in Swimlane AI SOC run organization-specific detection logic against large volumes of data in Turbine. Swimlane AI SOC detects AI risks that vendor tools may not alert on, including local AI model use, unsanctioned AI accounts, sensitive data submitted to AI services, prompt injection, and disabled or bypassed guardrails. Swimlane lets customers write detections for prompt injection, compromised guardrails and runaway AI spend from rogue agents, then route each alert to agentic investigation. Agents in Swimlane AI SOC pull threat data, past cases, and knowledge base articles into each investigation. Analysts can review, modify or rebuild any AI-generated plan in Swimlane AI SOC before it executes. Swimlane AI SOC generates a human-readable reasoning chain for every investigation, exportable for audit.^[4]

Swimlane offers a Hero AI playbook generator agent that creates and deploys production-grade playbooks, with clarifying questions and real-time progress updates. Users of all skill levels can create or modify playbooks with natural-language prompts in Swimlane AI SOC. Hero AI generates a live preview of a report or visualization that a user describes in plain language, and the preview can be applied to dashboards or case views. Two-way MCP support lets users connect Cursor or Cloud Code to Swimlane AI SOC and build playbooks, connectors, applications, and widgets.^[4]

Turbine Canvas is used to create playbooks, applications, and AI agents with no, low or full code supported by AI. Swimlane Marketplace holds thousands of pre-built playbooks. Swimlane AI SOC lets analysts execute recommended remediation playbooks in a single click. The Swimlane Turbine platform can be customized so that the customer's company name and logo appear first for its clients upon login. Swimlane provides pre-built MSSP dashboards that track portfolio health, caseloads, and analysis productivity across every client.^[4]

The Swimlane Compliance Audit Readiness (CAR) Solution, built on Turbine, moves compliance work from manual spreadsheets to a consolidated multi-framework compliance view. The CAR Solution helps GRC teams streamline audits and evidence gathering when managing multiple frameworks. The CAR Solution includes over 30 compliance framework extensions, available in the Swimlane Marketplace. Compliance evidence can be created, stored and monitored from multiple sources and linked to controls. External stakeholders can be assigned as control owners, and evidence requests go to the right person from a central location.^[5]

Swimlane offers the Swimlane Vulnerability Response Management (VRM) Solution for risk prioritization and management. Swimlane Intelligence enriches findings with known exploits, CVSS scores, EPSS scores, and 30+ customizable enrichment sources. The Risk Score in VRM consolidates data from CVSS, exploit scores, and asset criticality. The VRM Prioritization Rank uses Swimlane Intelligence to assess risk and prioritize responses, factoring in exceptions to reduce unnecessary alerts. Hero is Swimlane’s private agentic AI companion, used in vulnerability response management. VRM includes a case management application that integrates with ITSM and collaboration tools.

Swimlane Turbine brings message details, threat intelligence, authentication results, and user context into a single investigation. When phishing is confirmed, automation can help remove related messages, block malicious indicators, revoke sessions, and escalate affected users or endpoints. Higher-impact steps can be routed for analyst approval before execution. Swimlane Turbine’s pre-built phishing triage solution combines low-code playbooks, threat intelligence insights and case management applications. Phishing triage groups related messages and reports across users and inboxes so one campaign shows up as a single case.^{[1][2][4][7][8]}

About Tines

Tines is an environment for turning ideas into software that a business can build, deploy and operationalize. Tines lets every team build, and IT and Security maintain complete visibility, governance, and control. Tines gives teams a place to create agents, apps and automations and put them to work.^[4]

Teams in Tines build in spaces, by prompt, in chat, code-first, or from Claude Code and Codex. Teams can build from the coding assistant they already use and run and monitor the result in Tines. In Tines, every step runs sandboxed, isolated from the next. Tines connectors reach customer systems through a secure credential proxy. Tines is model-agnostic and works with any API or MCP server. Tines lets customers choose the models, tools and infrastructure that work for their enterprise. Tines connects to the tools a team already runs on and to any other system reachable on a network.^[4][5][14]

IT and Security monitor spend, access, duplicates and dependencies from one console in Tines. Teams in Tines build inside spaces the organization has already approved, so most work never needs a ticket. Tines monitors running software, identifies problems and proposes tested fixes and improvements, and the customer decides which changes go live.^[4][14]

For security teams, Tines offers pre-built triage agents that can be tuned to a team's detections, escalation paths, and tools. Tines security use cases include enrichment, containment, and remediation, with each step running as the customer designed it. Tines handles feeds, indicators, and enrichment, with what matters routed to the right tools. Tines handles findings, owners, and fixes, with the riskiest issues addressed first. Tines handles firewall rules, DNS, and proxies, with threats blocked across vendors. Tines handles evidence, control testing, and vendor risk. Tines offers case and incident management integrated with Tines 3B and Tines Stories, where teams investigate, remediate and report on incidents in one collaborative workspace.^[5][15]

Tines handles patching, configuration changes and capacity, with monitoring that flags issues early. Tines handles network changes, access, incidents and certificates across every device and vendor. Tines is used to match, reconcile and post across systems for the close. Tines logs, routes and resolves every employee issue, with sensitive cases kept private. Tines gives teams access to legal guidance, past decisions and approved positions for moving contracts forward.^[16][17][20]

Tines is both a cloud service that Tines hosts and a product that customers can host. A customer working under specific regulatory requirements, such as FedRAMP, can deploy Tines in its own data center. Tines supports SSO/SAML by default across all plans. Administrators in Tines can set a custom session timeout length to match organizational policies. Tines automatically captures an audit log any time a user changes any piece of data in a Tines tenant. With teams in Tines, customers can logically separate users, credentials, resources, and stories.^[21]

Tines aligns its information security program to the SOC2 framework. Tines maintains SOC Type II compliance and is audited annually. Tines maintains a Trust Center where customers can obtain security reports and attestations.^{[1][3][4][5][6][7][8][9][10][11][15][16][17][19][21]}