Legion Security vs Qevlar AI
Legion Security
Legion Security offers an agentic AI security operations platform that deploys through the analyst's browser rather than through API integrations. The system observes analyst investigations, playbooks and past cases in a learning mode, then executes workflows in the browser with human oversight (companion mode) or with reduced intervention (autonomous mode). Press coverage describes it as a browser extension AI SOC companion that works across tools such as Chrome, Edge and Island. The company was founded in 2024 by former Microsoft Sentinel team members and emerged from stealth in July 2025.
Pros
- Raised $38M total: an $8M seed led by Picture Capital and Accel, and a $30M Series A led by Coatue (Calcalist, Fortune)
- Founding team includes former members of Microsoft's Sentinel product, per Calcalist
- Browser-based deployment is designed to avoid custom API integration work, per the company
- Customers cited on the vendor site report outcomes such as an 81% reduction in MTTI/R (WELL Health Technologies, vendor-cited)
Pricing:
Qevlar AI
Qevlar AI is an autonomous SOC investigation platform founded in Paris, France in 2023. It connects to an existing detection stack via API, investigates alerts from connected tools, correlates related activity into unified incident narratives with blast-radius mapping, and recommends containment actions while keeping analysts in oversight. The company describes a graph-based orchestration approach that uses LLMs for enrichment and summarization rather than core investigative reasoning. It sells to both enterprise SOC teams and MSSPs, with results surfaced in native consoles or Qevlar's own interface.
Pros
- Reported customers include Mercedes-Benz and Sodexo, plus MSSPs such as Orange Cyberdefense, Atos, and ECI (Vestbee funding coverage)
- Raised a 30M dollar Series A in March 2026 led by Partech and Forgepoint Capital International, with EQT Ventures participating (Vestbee)
- Vendor reports roughly 10x faster investigations, to about three minutes per alert, as cited in funding coverage
Pricing: