Recommended Free Tools
Dropzone AI announced a $37 million Series B on July 17, 2025, to expand its autonomous security operations center (SOC) analyst business. Theory Ventures led the round, with Madrona, Decibel Ventures, Pioneer Square Labs and IQT participating. The company said it would use the funding for global expansion, specialized AI agents for manual security tasks, and deeper integrations and ecosystem partnerships.
What the $37 million round means
The financing was a Series B, not a product launch or a new security standard. SecurityWeek reported at the time that the round brought Dropzone AI’s total funding to more than $57 million. The company identified three intended investment areas: international growth, agents designed for additional manual security work, and technical integrations and partnerships.
As an Amazon Associate I earn from qualifying purchases.
Those plans describe how Dropzone said it would use the capital; they do not establish that any specific expansion or product capability has since been completed. The round’s lead investor was Theory Ventures. Madrona, Decibel Ventures, Pioneer Square Labs and IQT also participated.
What Dropzone AI does
Dropzone sells enterprise software that investigates security alerts. Its AI SOC Analyst is intended to follow techniques used by experienced analysts: collect evidence from a customer’s security tools, explain its reasoning, and send a decision-ready conclusion to a human for review. The company presents the software as an AI-native layer for an existing security stack, rather than infrastructure that replaces the stack.
#1 Best Overall
Dropzone says its agents can reason through investigations without relying on prebuilt SOAR playbooks. That distinction is about how an investigation is conducted; it does not mean an organization should assume the software independently makes every security decision or carries out remediation. The described workflow includes escalation for human review.
Integrations and investigation coverage
Dropzone’s integration page lists more than 90 integrations across 14 categories. The categories include SIEM, endpoint, cloud, identity, email, network, SOAR, threat intelligence and ticketing. Named examples include:
- SIEM and security operations: Splunk, Microsoft Sentinel, Google Security Operations and IBM QRadar.
- Endpoint: CrowdStrike, Microsoft Defender and SentinelOne.
- Cloud, identity and cloud security: AWS, Azure, Google Cloud, Wiz and Okta.
The company’s use-case catalog includes phishing, network, identity, cloud, endpoint, insider-threat, threat-hunting, context-knowledge and contextual-inquiry scenarios. An integration count or list of supported categories does not, by itself, establish how deeply a particular product is integrated or which actions are available for a specific customer deployment. Buyers should verify their exact tools, data access and desired response controls with Dropzone.
Does Dropzone replace a SIEM or SOAR?
Based on the company’s product description, Dropzone is meant to investigate alerts using information from a customer’s existing security tools, not to replace the SIEM, endpoint detection and response (EDR), cloud or identity systems that supply that information. The company also contrasts its investigation agents with conventional SOAR automation that depends on prebuilt playbooks. The available description does not establish that Dropzone replaces every SOAR function, such as automating a customer’s chosen response actions.
Rank #3
For an evaluation, distinguish investigation from response. Ask which alerts the analyst can investigate, what evidence it can retrieve from each integration, how it presents its reasoning, where a human must approve a decision, and whether remediation is included or handled by another system. The comparison should also cover deployment time, alert coverage and measured analyst-time or mean-time-to-resolution outcomes; no independent comparative benchmark is provided here.
What the reported performance figures show—and do not show
Dropzone’s July 2025 funding materials and company blog reported customer and efficiency outcomes. These are vendor-reported figures, not independently validated measurements:
| Metric | Company-reported figure | Attribution and scope |
|---|---|---|
| Enterprise use | More than 100 enterprises | Dropzone AI, 2025, at the time of the Series B announcement. |
| Tier-1 ticket handling | 90% cleared autonomously | Dropzone AI, 2025; the cited materials do not specify a measurement period or denominator. |
| Investigation time | About 25 minutes reduced to 3–10 minutes per alert | Dropzone AI, 2025; the cited materials do not specify the measurement method or whether the comparison was independently measured. |
| CBTS alert volume | 30–50% offloaded | Dropzone AI, 2025; the cited materials do not define the measurement period. |
In a later release about 2025 results, Dropzone reported 11× ARR growth during 2025, more than 300 production enterprises and over $10 million in recovered SOC productivity. These are separate, later company claims—not figures announced as part of the July 2025 financing—and the release’s summary does not provide the underlying calculation details. They should not be treated as audited financial results or as a forecast of future growth.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →For a buyer, the percentages are a starting point for diligence, not a substitute for a deployment-specific test. Request the definitions behind “cleared autonomously” and “recovered productivity,” the baseline and sample period, the alert types included, and the rate of cases escalated or corrected by analysts.
Best Value
Who the partner program is for
Dropzone publicly describes a partner program for resellers, managed security service providers (MSSPs) and managed detection and response providers (MDRs), plus technology-alliance partners. Its partner page mentions deal registration, license margin and services that partners may attach, including incident response, SOC optimization, SOC augmentation, integration consulting and response automation. The company says, “Dropzone AI is 100% software.”
The public description does not state commissions, commercial terms, approval criteria or tracking details. Cybersecurity channel operators should confirm those terms directly with Dropzone rather than infer them from the program overview.
How to assess the product before buying
Dropzone offers a self-guided browser demo. Its FAQ says the demo requires no software download, browser extension or credential configuration, and that most visitors complete it in 10–15 minutes. A demo can show the investigation experience, but it does not establish production performance with an organization’s own alerts and integrations.
- Confirm that the integrations cover the exact tools and data needed for your investigation workflow.
- Test the alert types your team handles most, and examine the evidence and reasoning shown for each conclusion.
- Define which actions require human approval and how the system handles uncertain or incomplete evidence.
- Agree on a baseline and measurement period for investigation time, escalation rates and analyst workload before interpreting efficiency claims.
For a finance-minded reader, the central distinction is between capital raised and demonstrated operating performance. The Series B establishes the amount and participants in the financing; the later growth and productivity figures remain company-reported outcomes. For security teams, the practical question is whether the software’s investigation quality, integrations and review controls fit their own environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
