Tool profile
Sekoia: cost, fit and limits
Sekoia is a French cybersecurity platform made by Sekoia.io SAS that combines SIEM, threat intelligence, digital risk and asset visibility with agentic AI analysts for detection, investigation and automated response. It is sold on request.
What to know first
Sekoia sells a platform of five products: Defend (SIEM), Intelligence (CTI), Digital Risk, Reveal (CAASM) and Elevate, an agentic SOC analyst. Response is delivered by playbooks and agents that can isolate hosts or disable credentials automatically or after one-click approval. The trust center lists ISO 27001:2022, PCI DSS, SOC 2 Type 1 and more, and a self-hosted edition is live. Pricing is not stated.
Sekoia at a glance
| Maker | Sekoia.io SAS, France |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI SOAR Platforms in 2026, rank 1 of 10 |
| Website | sekoia.com |
Who Sekoia is best for
European teams that want local roots
The company is French, the trust center lists GDPR, NIS2 and DORA, and a self-hosted edition exists for buyers who cannot use a shared cloud.
Lean SOCs that want one platform
Detection, intelligence and response agents come from one vendor, so a small team does not stitch a SIEM, a CTI feed and a SOAR together.
Teams that need documents for audits
The trust center offers an AI transparency document, pentest report, security whitepaper, subprocessors list and SOC 2 and ISO reports.
Sekoia plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Sekoia Defend | Not stated | SIEM with detection and investigation, the base of the platform. SIEM with detection and investigation, the base of the platform, priced by quote. |
| Sekoia Intelligence | Not stated | Cyber threat intelligence included in the platform family. Cyber threat intelligence included in the platform family, available as a separate product. |
| Sekoia Elevate | Not stated | An agentic SOC analyst that can investigate and trigger response actions with analyst approval. An agentic SOC analyst that can investigate and trigger response actions after analyst approval. |
| Sekoia Self-Hosted | Not stated | A self-hosted edition of the platform for buyers who need it deployed in their own environment. |
Checked October 2026.
What Sekoia does
- Evolving playbooks
- Playbooks adapt workflows to real-time findings across the stack and coordinate response across tools and teams. This lets a response change course when the evidence changes mid-incident.
- Automated response with approval
- Agents can isolate hosts, disable credentials or block malicious activity, either automatically or with one-click analyst approval. Which actions run unattended is a setting the customer chooses.
- Detection and investigation agents
- Agents combine behavioral analytics, signatures and AI reasoning, and detection models update as threats change. Coverage is therefore not static between releases. Several signals feed one verdict.
- Ask-Anything Analysis
- Junior analysts can ask questions in plain language while senior analysts direct agent decisions. This spreads the load between junior and senior staff. Both groups work from one shared view.
- Decision logging
- All agent decisions and actions are logged for transparency and compliance, per the product page. That log is useful for audit and post-incident review. Auditors can read it later.
How Sekoia handles your data
The Sekoia trust center, hosted on SafeBase, lists ISO/IEC 27001:2022, PCI DSS, SOC 2 Type 1, GDPR, NIS2, DORA and ENS. It offers an AI transparency document, a subprocessors list, corporate and MSSP data processing agreements, a pentest report and SOC 2 and ISO reports. The footer mentions SecNumCloud, hosting regions, data residency and AI data use, but the page does not detail them, so those points were not verified. Sekoia Self-Hosted is available for customers who need their own deployment.
Where Sekoia falls short in practice
- No published pricing. The product pages state no price or pricing model, and the vendor sells through demos. Budgeting therefore starts with a demo call and a sizing discussion.
- SOAR sits inside a platform. Response is delivered by playbooks and agents inside the SIEM platform, so teams that run a third-party SIEM and want a standalone orchestration tool may find it too coupled.
- SOC 2 is Type 1. The trust center lists SOC 2 Type 1, which describes control design at a point in time, so buyers who need Type 2 should ask for it.
Works with
Alternatives to Sekoia
Sekoia: common questions
Is Sekoia a SOAR or a SIEM?
Sekoia is a platform that includes a SIEM called Defend and playbook-based response. Response sits inside the platform, so teams that want only orchestration for another SIEM should compare it with standalone tools. Both views of the product are sold together.
Which certifications does Sekoia list?
The trust center lists ISO/IEC 27001:2022, PCI DSS, SOC 2 Type 1, GDPR, NIS2, DORA and ENS. SecNumCloud appears in the footer but not in the certification list, so ask about it directly. Ask for the reports under NDA. Check the scope of each.
Can Sekoia agents act without approval?
The product page says agents can isolate hosts, disable credentials or block activity automatically or with one-click analyst approval. Which actions run automatically is a setting to agree on before go-live. Teams should settle that list before go-live and review it after the first month of use.
Does Sekoia offer a self-hosted version?
Yes. The home page announces that Sekoia Self-Hosted is live, with a dedicated solutions page. Details on sizing, support and price are given by the sales team. Ask the sales team whether it suits your sizing and support needs. Support terms differ.
Where is Sekoia headquartered?
Sekoia.io SAS is a French company. The home page does not state the address, so check the legal notice for the registered office before drafting a contract. The legal notice of the vendor carries the formal address and registration details.