CISO Tribune

Vendor comparison · 2 companies

Legion Security vs Mave

Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn. Mave runs investigations, searches, threat hunts, detection hardening, and governed responses across a customer's existing stack. CISO Tribune files both under AI SOC analysts. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Legion Security
  • Mave
Legion Security vs Mave: Products, Customers and Funding Compared
Legion SecurityLegion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn.legionsecurity.aiMaveMave runs investigations, searches, threat hunts, detection hardening, and governed responses across a customer's existing stack.mave.com
What it sells
  • Legion[1][2][3][4][5][6][7][8]Turns a team's knowledge, tools and processes into agents that investigate alerts and carry out approved responses.
  • AI SOC[1][14]Governed AI agents that investigate alerts, apply threat intelligence, hunt across tools, improve detections, and execute authorized response actions.
  • Threat Hunting[1][13]Runs continuous, cross-tool threat hunts for threats that never triggered an alert.
  • Detection Engineering[1][13]Finds coverage gaps, tunes noisy detection rules, and creates new detections.
  • Threat Intelligence[1][9][10][14]Converts relevant threat intelligence into investigations, threat hunts, detections, and authorized responses.
Categories
Headquarters
Tel Aviv, Israel[1]Not stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pagesNot stated on its pages
G2 and Gartner Peer Insights
  • G2: listed, seen November 10, 2026[9]
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Legion is described as running in production across the SOC, DLP, identity, vulnerability management and GRC. Legion Security says it has early traction among financial services, healthcare and manufacturing customers. Legion operates through a browser extension and integrates with anything accessed through the browser.From its own pages, Mave sells mainly to security operations teams that run many tools and want investigation, hunting, detection work, and response across the stack they already have. Mave addresses managed security service providers that want to scale without adding analysts at the same rate as customers. Mave addresses organizations with multiple SIEMs, tenants, and subsidiaries. Mave addresses organizations that want to reduce SIEM ingestion and retention costs. Mave addresses organizations that want alert triage, investigation, and response in-house, and organizations with on-premises workloads alongside cloud and SaaS. Mave also describes an alternative package for smaller teams.
Last verified
November 8, 2026October 23, 2026

Where they overlap

  • AI SOC analysts is the primary category of both Legion Security and Mave.

Where they differ, field by field

  • Mave is also filed under SIEM and Threat intelligence.
  • Legion Security lists Legion. Mave lists AI SOC, Threat Hunting, Detection Engineering and Threat Intelligence.
  • Legion Security is headquartered in Tel Aviv, Israel.

How they differ

CISO Tribune files Legion Security under AI SOC analysts, and it files Mave under AI SOC analysts, SIEM and threat intelligence, with AI SOC analysts as the primary category for both. Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts and carry out approved responses. Mave sells AI SOC, governed agents that investigate alerts, apply threat intelligence, hunt across tools, improve detections and execute authorized response actions. Mave also sells Threat Hunting, Detection Engineering and Threat Intelligence as separate offerings. Legion Security is headquartered in Tel Aviv, Israel, and describes itself as a Series A startup.

The two differ in how they connect to a customer's tools. Legion operates through a browser extension, without integrations or APIs, and works with anything accessed through the browser. Mave integrates through APIs, starts read-only, and queries data in the systems that already hold it. Legion starts from a browser recording, runbook or past case and turns it into an agent that the team reviews, refines and deploys. Mave's detection work spans formats including SPL, KQL, YARA-L, Sigma, EQL, Lucene and SQL-based rules.

Legion Security says it has early traction among financial services, healthcare and manufacturing customers. Legion is described as running in production across the SOC, DLP, identity, vulnerability management and GRC. Mave addresses security operations teams running many tools, managed security service providers, and organizations with multiple SIEMs, tenants and subsidiaries. Mave is priced by endpoints protected and team size rather than data volume, and it offers a fixed-price package for smaller teams. Legion can be bought through the AWS Marketplace, the GCP Marketplace and the CrowdStrike Marketplace.

What it sells: Legion Security

What Legion does[1][2][3][4][5][6][7][8]
Legion learns a team's current processes, tools and context from the browser, past cases and more. Legion investigates everything, clearing false positives and benign activity, and escalates what matters and contains threats. Legion operates through a browser extension, without integrations or APIs.

What it sells: Mave

What AI SOC does[1][14]
Mave runs an AI SOC across the security stack a customer already uses. Mave queries live data in the systems that already hold it, reasons across the evidence, and takes the next authorized action. No telemetry migration, duplicate data lake, central index, or fixed SOAR playbook is required.
What Threat Hunting does[1][13]
Mave applies threat intelligence to the customer's environment and runs continuous, cross-tool threat hunts across the SIEM, EDR, cloud, identity, and other security tools. Each finding becomes a complete investigation, a new or tuned detection, or an authorized response action. Source telemetry stays in place, with no new data lake, central index, or prebuilt correlation pipeline.
What Detection Engineering does[1][13]
Mave works across detection languages and formats, including SPL, KQL, YARA-L, Sigma, EQL, Lucene, and SQL-based rules. Agents review, create, translate, test, and tune detection content in the existing workflow, validate it against historical data where it already lives, and commit or deploy approved changes.
What Threat Intelligence does[1][9][10][14]
Mave determines which campaigns, actors, vulnerabilities, indicators, and techniques are relevant to the customer's environment. Mave evaluates each threat against assets, identities, technologies, vulnerabilities, detections, and live activity.

Questions about Legion Security and Mave

What do Legion Security and Mave sell?
Legion Security sells Legion. Mave sells AI SOC, Threat Hunting, Detection Engineering and Threat Intelligence.
Are Legion Security and Mave in the same category?
Yes. AI SOC analysts is the primary category of both on CISO Tribune.
Where are Legion Security and Mave headquartered?
Legion Security is headquartered in Tel Aviv, Israel.
Who are Legion Security and Mave sold to?
Legion is described as running in production across the SOC, DLP, identity, vulnerability management and GRC. From its own pages, Mave sells mainly to security operations teams that run many tools and want investigation, hunting, detection work, and response across the stack they already have.

About Legion Security

Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn. Legion maps a team's knowledge, people and processes and grows with every investigation. Legion Security is building an AI security analyst designed to see, think and act like an expert human analyst. Legion Security built a companion that captures how a team actually works, and scales it.[2][3][4][5][6]

Legion learns a team's current processes, tools and context from the browser, past cases and more, and deploys agents for the team. Legion continuously learns from browser recordings, cases, tools and more. Legion starts from a browser recording, runbook or past case and turns it into an agent that the team reviews, refines and deploys. Agents in Legion reason where judgment matters and follow fixed steps where consistency does, in a single workflow. Legion lets teams build agents for the processes they run, in the tools they already use.[3][4]

Legion integrates with all of a team's tools, with or without APIs. Legion comes with prebuilt integrations for all common security tools. Legion integrates with anything accessed through the browser.[3][7]

Legion investigates everything, clearing false positives and benign activity, and escalates what matters and contains threats. Legion triages and investigates alerts with an organization's context and tunes detections from what it finds. Legion works across the teams that security depends on, including the SOC, identity and DLP. Legion is running in production across the SOC, DLP, identity, vulnerability management and GRC. Legion supports separating real exfiltration from false positives, establishing who did what and why, then revoking access, quarantining data or closing the exposure. Legion supports testing exploitability against an environment to prioritize real risk, then driving the fix with the teams that own it. Legion supports checking whether a threat is active against an organization's assets and feeding what is learned. Legion helps find which alerts, workflows and tasks take the most time and which are ready to become agents. Legion lets users ask one question across all their tools, hunt new threats and hand strong leads to the Investigator. Legion lets users describe a report or board summary, schedule it and ask what is behind the numbers.[3][4]

Legion runs agents beside analysts on live cases so the two can be compared decision for decision. Before agents gain authority, each is tested against the customer's benchmarks. Legion begins by observing, then supporting, and only takes on autonomous workflows when the customer's team decides it is ready. Every insight Legion captures, every suggestion it offers and every action it takes is visible, explainable and reversible.[3][4][8]

Legion operates through a browser extension, with the customer having full control over what data is collected and when. Legion operates directly in the browser without integrations or APIs. Customers decide when Legion records by starting and stopping it manually, set a browser-level allow list for where recording happens, and use masking rules that redact sensitive data. Legion does not train models on business data by default. Legion has a built-in DLP layer to help prevent unintended data exposure. Legion aligns with frameworks including SOC 2, ISO 27001 and HIPAA where applicable.[8]

CrowdStrike users can access Legion on the CrowdStrike Marketplace, with deeper access to Charlotte AI and CrowdStrike tools. Legion can be purchased on the AWS Marketplace. Legion is offered through GCP Marketplace and works natively across Google products from Chrome to GTI. Legion Security describes itself as a Series A startup with early traction among financial services, healthcare and manufacturing customers.[3][4][5][7]

Legion Security on the record

Sources

Legion Security full record

  1. [1]Legion security launches dragonclaw agent orchestration with context for your socLegion Security · legionsecurity.ai · published July 30, 2026 · Tier A
  2. [2]legionsecurity.aiLegion Security · legionsecurity.ai · undated page, accessed November 8, 2026 · Tier A
  3. [3]Legion Security | The Agentic Security Operations PlatformLegion Security · undated page, accessed November 10, 2026 · Tier A
  4. [4]Learning Mode - AI SOC Workflow Mapping | Legion SecurityLegion Security · undated page, accessed November 10, 2026 · Tier A
  5. [5]Legion CareersLegion Security · undated page, accessed November 10, 2026 · Tier A
  6. [6]About Legion Security | AI that learns from within your SOCLegion Security · undated page, accessed November 10, 2026 · Tier A
  7. [7]Partners & IntegrationsLegion Security · undated page, accessed November 10, 2026 · Tier A
  8. [8]Trust | Legion SecurityLegion Security · undated page, accessed November 10, 2026 · Tier A
  9. [9]Legion Security Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed November 10, 2026 · Tier C

Mave full record

  1. [1]mave.comMave · mave.com · undated page, accessed October 23, 2026 · Tier A
  2. [2]Terms and conditionsMave · mave.com · published February 15, 2026 · Tier A
  3. [3]AI Security Operations Platform | MaveMave · undated page, accessed November 10, 2026 · Tier A
  4. [4]Mave Platform | The SecOps Operating SystemMave · undated page, accessed November 10, 2026 · Tier A
  5. [5]Reduce MDR Reliance | MaveMave · undated page, accessed November 10, 2026 · Tier A
  6. [6]SIEM Cost Reduction & Replacement | MaveMave · undated page, accessed November 10, 2026 · Tier A
  7. [7]On-Prem SecOps Deployment | MaveMave · undated page, accessed November 10, 2026 · Tier A
  8. [8]Multi-SIEM & Post-M&A SecOps | MaveMave · undated page, accessed November 10, 2026 · Tier A
  9. [9]Multi-Tenant SecOps For MSSPs | MaveMave · undated page, accessed November 10, 2026 · Tier A
  10. [10]Threat Hunting | MaveMave · undated page, accessed November 10, 2026 · Tier A
  11. [11]Detection Engineering with MITRE ATT&CK | MaveMave · undated page, accessed November 10, 2026 · Tier A
  12. [12]Threat Intelligence | MaveMave · undated page, accessed November 10, 2026 · Tier A
  13. [13]Pricing | MaveMave · undated page, accessed November 10, 2026 · Tier A
  14. [14]AI SOC Agents for Full-Loop SecOps | MaveMave · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.