CISO Tribune

Vendor comparison · 2 companies

Legion Security vs ThreatDefence

Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn. ThreatDefence delivers a fully managed 24×7 SOC as a Service that combines its SecOps Platform with a team of cyber security experts who monitor, investigate and respond. CISO Tribune files both under AI SOC analysts. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Legion Security
  • ThreatDefence
Legion Security vs ThreatDefence: Products, Customers and Funding Compared
Legion SecurityLegion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn.legionsecurity.aiThreatDefenceThreatDefence delivers a fully managed 24×7 SOC as a Service that combines its SecOps Platform with a team of cyber security experts who monitor, investigate and respond.threatdefence.com
What it sells
  • Legion[1][2][3][4][5][6][7][8]Turns a team's knowledge, tools and processes into agents that investigate alerts and carry out approved responses.
  • SecOps Platform[2][3][4][5]A platform providing end-to-end coverage and threat detection, backed by an AI-enabled 24x7 SOC.
  • SOC as a Service[2]A fully managed 24×7 SOC that combines the SecOps Platform with a team of cyber security experts.
  • SIEM[1][5][6]A SIEM built for investigation that connects, enriches and keeps security events searchable.
  • Network Detection and Response[3]Network Detection and Response sensors and a deception toolset to discover lateral movement.
  • Compromise Assessment[8]A review of an environment to reveal existing or past intrusions and security weaknesses.
  • Cyber Risk Management[9]A solution that assists customers in proactively identifying security gaps in their environment.
  • Cyber Range[10]Cyber range solutions with simulations of cyber attacks for cyber security teams and students.
Categories
Headquarters
Tel Aviv, Israel[1]Not stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pagesNot stated on its pages
G2 and Gartner Peer Insights
  • G2: listed, seen November 10, 2026[9]
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Legion is described as running in production across the SOC, DLP, identity, vulnerability management and GRC. Legion Security says it has early traction among financial services, healthcare and manufacturing customers. Legion operates through a browser extension and integrates with anything accessed through the browser.Not written yet
Last verified
November 8, 2026November 10, 2026

Where they overlap

  • Legion Security and ThreatDefence are both filed under AI SOC analysts.

Where they differ, field by field

  • Legion Security's primary category is AI SOC analysts; ThreatDefence's is MDR and managed SOC.
  • ThreatDefence is also filed under SIEM and Network detection and response.
  • Legion Security lists Legion. ThreatDefence lists SecOps Platform, SOC as a Service, SIEM, Network Detection and Response, Compromise Assessment and 2 more.
  • Legion Security is headquartered in Tel Aviv, Israel.

What it sells: Legion Security

What Legion does[1][2][3][4][5][6][7][8]
Legion learns a team's current processes, tools and context from the browser, past cases and more. Legion investigates everything, clearing false positives and benign activity, and escalates what matters and contains threats. Legion operates through a browser extension, without integrations or APIs.

What it sells: ThreatDefence

What SOC as a Service does[2]
ThreatDefence continuously monitors customer environments across cloud, network, endpoints, identity and applications. ThreatDefence analysts conduct scheduled and intelligence-led hunts to identify indicators of compromise, lateral movement, credential misuse and living-off-the-land activity. ThreatDefence customers have access to a dedicated portal with real-time dashboards, incident timelines, analyst notes, reporting and service visibility.
What Network Detection and Response does[3]
ThreatDefence offers Network Detection and Response sensors and a deception toolset to discover lateral movement. ThreatDefence network detection covers lateral movement and insider threats using session evidence and packet analysis. ThreatDefence agents connect network findings with endpoint and identity activity, helping analysts assess the scope and prepare targeted containment.
What Compromise Assessment does[8]
ThreatDefence offers a Compromise Assessment that helps reveal existing or past intrusions, identify vulnerabilities or weaknesses, and detect malicious activity, policy violations and security misconfigurations. ThreatDefence deploys sensors to collect real-time data from endpoints, cloud and network. ThreatDefence inspects an environment over an extended period of time to identify dormant malware or covert threat actors.
What Cyber Risk Management does[9]
ThreatDefence offers a Cyber Risk Management solution that assists customers in proactively identifying security gaps in their environment. ThreatDefence provides automated weekly and monthly reporting based on operational and compliance needs. ThreatDefence pinpoints vulnerable, exploitable or misconfigured systems in a customer network.
What Cyber Range does[10]
ThreatDefence offers cyber range solutions that provide simulations of cyber attacks for cyber security teams and students. ThreatDefence runs simulations on virtual replicas of critical infrastructure networks including power grids, train control systems and water treatment plants. The platform of ThreatDefence organizes trainees into groups dedicated to specific missions and objectives.

Questions about Legion Security and ThreatDefence

What do Legion Security and ThreatDefence sell?
Legion Security sells Legion. ThreatDefence sells SecOps Platform, SOC as a Service, SIEM, Network Detection and Response, Compromise Assessment and 2 more.
Are Legion Security and ThreatDefence in the same category?
They share AI SOC analysts. Legion Security's primary category is AI SOC analysts and ThreatDefence's is MDR and managed SOC.
Where are Legion Security and ThreatDefence headquartered?
Legion Security is headquartered in Tel Aviv, Israel.
Who are Legion Security and ThreatDefence sold to?
Legion is described as running in production across the SOC, DLP, identity, vulnerability management and GRC.

About Legion Security

Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn. Legion maps a team's knowledge, people and processes and grows with every investigation. Legion Security is building an AI security analyst designed to see, think and act like an expert human analyst. Legion Security built a companion that captures how a team actually works, and scales it.[2][3][4][5][6]

Legion learns a team's current processes, tools and context from the browser, past cases and more, and deploys agents for the team. Legion continuously learns from browser recordings, cases, tools and more. Legion starts from a browser recording, runbook or past case and turns it into an agent that the team reviews, refines and deploys. Agents in Legion reason where judgment matters and follow fixed steps where consistency does, in a single workflow. Legion lets teams build agents for the processes they run, in the tools they already use.[3][4]

Legion integrates with all of a team's tools, with or without APIs. Legion comes with prebuilt integrations for all common security tools. Legion integrates with anything accessed through the browser.[3][7]

Legion investigates everything, clearing false positives and benign activity, and escalates what matters and contains threats. Legion triages and investigates alerts with an organization's context and tunes detections from what it finds. Legion works across the teams that security depends on, including the SOC, identity and DLP. Legion is running in production across the SOC, DLP, identity, vulnerability management and GRC. Legion supports separating real exfiltration from false positives, establishing who did what and why, then revoking access, quarantining data or closing the exposure. Legion supports testing exploitability against an environment to prioritize real risk, then driving the fix with the teams that own it. Legion supports checking whether a threat is active against an organization's assets and feeding what is learned. Legion helps find which alerts, workflows and tasks take the most time and which are ready to become agents. Legion lets users ask one question across all their tools, hunt new threats and hand strong leads to the Investigator. Legion lets users describe a report or board summary, schedule it and ask what is behind the numbers.[3][4]

Legion runs agents beside analysts on live cases so the two can be compared decision for decision. Before agents gain authority, each is tested against the customer's benchmarks. Legion begins by observing, then supporting, and only takes on autonomous workflows when the customer's team decides it is ready. Every insight Legion captures, every suggestion it offers and every action it takes is visible, explainable and reversible.[3][4][8]

Legion operates through a browser extension, with the customer having full control over what data is collected and when. Legion operates directly in the browser without integrations or APIs. Customers decide when Legion records by starting and stopping it manually, set a browser-level allow list for where recording happens, and use masking rules that redact sensitive data. Legion does not train models on business data by default. Legion has a built-in DLP layer to help prevent unintended data exposure. Legion aligns with frameworks including SOC 2, ISO 27001 and HIPAA where applicable.[8]

CrowdStrike users can access Legion on the CrowdStrike Marketplace, with deeper access to Charlotte AI and CrowdStrike tools. Legion can be purchased on the AWS Marketplace. Legion is offered through GCP Marketplace and works natively across Google products from Chrome to GTI. Legion Security describes itself as a Series A startup with early traction among financial services, healthcare and manufacturing customers.[3][4][5][7]

Legion Security on the record

Sources

Legion Security full record

  1. [1]Legion security launches dragonclaw agent orchestration with context for your socLegion Security · legionsecurity.ai · published July 30, 2026 · Tier A
  2. [2]legionsecurity.aiLegion Security · legionsecurity.ai · undated page, accessed November 8, 2026 · Tier A
  3. [3]Legion Security | The Agentic Security Operations PlatformLegion Security · undated page, accessed November 10, 2026 · Tier A
  4. [4]Learning Mode - AI SOC Workflow Mapping | Legion SecurityLegion Security · undated page, accessed November 10, 2026 · Tier A
  5. [5]Legion CareersLegion Security · undated page, accessed November 10, 2026 · Tier A
  6. [6]About Legion Security | AI that learns from within your SOCLegion Security · undated page, accessed November 10, 2026 · Tier A
  7. [7]Partners & IntegrationsLegion Security · undated page, accessed November 10, 2026 · Tier A
  8. [8]Trust | Legion SecurityLegion Security · undated page, accessed November 10, 2026 · Tier A
  9. [9]Legion Security Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed November 10, 2026 · Tier C

ThreatDefence full record

  1. [1]threatdefence.comThreatDefence · threatdefence.com · undated page, accessed November 10, 2026 · Tier A
  2. [2]24x7 SOC as a Service | Managed SOC Monitoring and ResponseThreatDefence · undated page, accessed November 11, 2026 · Tier A
  3. [3]Enterprise Security Operations Platform | 24x7 SOC and SIEMThreatDefence · undated page, accessed November 11, 2026 · Tier A
  4. [4]24x7 Security Operations Team | ThreatDefenceThreatDefence · undated page, accessed November 11, 2026 · Tier A
  5. [5]AI-Enabled Security Operations Platform and 24x7 SOC | ThreatDefenceThreatDefence · undated page, accessed November 11, 2026 · Tier A
  6. [6]SIEM as a Service | Next Generation Cloud SIEM | ThreatDefenceThreatDefence · undated page, accessed November 11, 2026 · Tier A
  7. [7]Industrial SecOps Platform for OT Security | ThreatDefenceThreatDefence · undated page, accessed November 11, 2026 · Tier A
  8. [8]Cyber Security Compromise Assessment | Breach Detection & Forensics - ThreatDefenceThreatDefence · undated page, accessed November 11, 2026 · Tier A
  9. [9]Cybersecurity Risk Management Services | Enterprise Risk Protection | ThreatDefenceThreatDefence · undated page, accessed November 11, 2026 · Tier A
  10. [10]Cyber Security Simulation & Attack Simulation Platform | ThreatDefenceThreatDefence · undated page, accessed November 11, 2026 · Tier A
  11. [11]Evidence-Based Security for Financial Services | ThreatDefenceThreatDefence · undated page, accessed November 11, 2026 · Tier A

Spot a factual error? Request a correction.