Tool profile
D3 Security: cost, fit and limits
D3 Security is a Vancouver-based security automation vendor, D3 Security Management Systems Inc., whose Morpheus platform triages, investigates and responds to alerts with AI agents and playbooks for security operations centers and managed security providers.
What to know first
D3 Security sells Morpheus as an annual subscription sized by a daily alert envelope, with AI reasoning, tokens and inference included. Tiers run from 500 to 10,000 alerts per day, and volume above that is priced by quote. The vendor displays SOC 2 Type II, offers Azure regions including Ireland plus on-premises and air-gapped options, and runs an exit program for buyers leaving Cortex XSOAR. Dollar figures are not printed on the pricing page.
D3 Security at a glance
| Maker | D3 Security Management Systems Inc., Canada |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI SOAR Platforms in 2026, rank 1 of 10 |
| Website | d3security.com |
Who D3 Security is best for
SOCs with unpredictable alert volume
A flat per-alert rate above the tier and no token metering make monthly cost easier to forecast than a usage meter that moves with model reasoning.
Teams migrating off legacy SOAR
D3 runs an XSOAR Exit Program and a legacy SOAR migration program, which suits buyers who already hold playbooks and want help moving them.
Regulated organizations in the EU or Canada
Deployment on Azure Ireland, Canadian hosting and a compliance page covering NIS2, DORA and the EU AI Act help teams with residency rules.
D3 Security plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Alert tiers | Annual subscription, quote only | Daily alert volume tiers from 500 up to 10,000 alerts, with an annual module license tied to the tier. |
| Named users | Per-user annual rate, quote only | Licenses for analysts who use the platform, priced per user per year in addition to the tier. |
| Overage | Flat per-alert rate | Alerts above the daily tier are billed at a flat rate published in advance, without token or compute surcharges. |
| Threat Hunting | Licensed with the tier | Includes 90 days of hot hunting data, with 180 days available as an option. It is priced separately from the alert tier. |
Checked November 2026.
What D3 Security does
- Attack Path Discovery
- The investigation engine traces an alert across identities, endpoints, cloud and email, maps the blast radius, validates indicators and drafts remediation. The page describes it as read-only and mapped to MITRE ATT&CK techniques.
- Verified Verdicts
- Each finding is graded Confirmed, Inferred or Gap, with the evidence or reasoning shown to the analyst. That grading lets a reviewer see where the agent had proof and where it filled a hole.
- Autonomy modes
- Teams set Deterministic, AI-Assisted, AI-Led or Autonomous behavior per use case, and the record format stays the same across deployment models, so audit output does not change when the setting does.
- Self-healing integrations
- Connectors adapt when a vendor changes an API, and the page cites more than 800 integrations including Microsoft Sentinel, Splunk, CrowdStrike Falcon, SentinelOne, Okta and ServiceNow.
- Single reasoning engine
- Morpheus uses one engine with one audit trail per incident instead of a mesh of specialized agents, which the vendor says simplifies review of how a verdict was reached.
How D3 Security handles your data
The compliance page says D3 Security is a Canadian company with Canadian hosting and shows a SOC 2 Type II badge without audit scope or period. Morpheus deploys on Azure regions including Ireland, the US, Canada and Japan, and telemetry, investigation artifacts and audit trails stay in the chosen jurisdiction. On-premises, hybrid and air-gapped deployments keep AI inference inside the customer boundary, and customers can bring their own LLM. The privacy policy, dated April 2022, names no hosting location or subprocessors and says nothing about AI.
Where D3 Security falls short in practice
- Prices are still hidden. The pricing page explains the structure but not the tier prices, the per-user rate or the per-alert overage rate, so a budget needs a quote.
- Compliance mapping is not certification. The compliance page lists NIS2, DORA, the EU AI Act, NYDFS and others as frameworks the audit record serves. It says it does not claim certification against them, so auditors still need their own evidence.
- Learning period. The FAQ says confidence scoring and recommendations tune over the first 60 to 90 days, so early results will be less accurate than steady-state results.
Works with
Alternatives to D3 Security
D3 Security: common questions
How does D3 Security price Morpheus?
As a fixed annual subscription set by a daily alert tier, with an annual module license, named user licenses and a flat per-alert rate above the tier. Nothing is metered by tokens or model calls, and the page gives no dollar amounts.
What happens if I send more alerts than my tier?
Alerts above the daily tier are billed at a flat per-alert rate published in advance, and token costs are not passed through during surges. Volumes above 10,000 alerts per day get custom pricing. Ask for the overage rate in writing before signing, since the pricing page does not print it.
Can Morpheus run in an air-gapped environment?
Yes. The compliance page lists on-premises, hybrid and fully air-gapped options, with AI inference inside the customer's infrastructure. Autonomy settings and record format are the same as in the Azure cloud deployments. Teams that need this should ask which integrations work without internet access, since some connectors rely on cloud APIs.
Does D3 Security hold SOC 2?
The compliance page displays a SOC 2 Type II badge without describing the audit scope or period. It also lists membership in the Microsoft Intelligent Security Association and compatibility with MITRE ATT&CK and D3FEND. Request the report under NDA if your review needs the auditor and the period covered.
Can I use my own LLM with Morpheus?
Yes. The pricing page says AI costs are included whether you use D3's models or your own LLM, and that D3 charges nothing for tokens when you bring your own. Check model terms with your provider. Ask which model versions are supported and who is liable for output quality when the model is yours.