Optro
Workiva
Diligent
MetricStream
JupiterOne
What is Cotool?
Founded in 2025 and based in San Francisco, Cotool builds AI agents and infrastructure for security operations teams. Its YC profile lists an active Spring 2025 company.
Cotool is an AI SOC and agent-native SIEM for blue teams. Agents receive alerts, gather context across connected tools, investigate evidence, and close or escalate work with a record of their reasoning. Teams can build agents in natural language, attach playbooks as skills, edit prompts and detection logic, and require approval for state-changing actions. Cotool can operate on alerts from other systems, while its own log storage and search provide an optional SIEM foundation.
The product spans detection, response, threat hunting, investigation, and agent operations. Detection rules are readable Python code; agents tune detections, hunt against centralized or federated data, and propose coverage for relevant threat intelligence. Hunt ingests built-in and custom intelligence sources, assesses relevance and exposure, and opens follow-up alerts. Sandboxed compute, model and tool choice, human-in-the-loop controls, multi-agent workflows, evaluations, and version control support governance. Cotool does not require replacing an existing SIEM.
Cotool is aimed at security engineers, analysts, and developers at organizations that need more investigation and detection capacity. Publicly named users include teams at Ramp, EliseAI, ClickHouse, and Legora, while the homepage also describes a crypto exchange and a security company without naming them. Cotool sells through a demo-led motion: its site asks buyers to book a demo, and Capterra lists no available free trial. Cotool’s March 2026 announcement says it raised a $7.4 million seed round led by Andreessen Horowitz.
Key features
Alert triage
Agents investigate alerts from any source, gather context across connected tools, and close or escalate them with evidence attached.
Detection engineering
Teams write readable Python detections, map coverage to their environment, and let agents tune false positives and propose new rules.
Threat hunting
Hunt ingests threat intelligence, assesses relevance and exposure, tracks coverage gaps, and creates follow-up alerts.
Agent automation
Users turn natural-language investigations and playbooks into always-on agents triggered by alerts, webhooks, API calls, or schedules.
Federated log search
Cotool stores selected security logs for fast search while agents can query legacy SIEMs, data lakes, and APIs where data already resides.
Governed response
Agents support sandboxed compute, configurable tools and models, human approval for state-changing actions, and read-only operation.
Agent evaluation
An evaluation harness measures runs over time, while version control, memory, and suggested fixes support monitoring and improvement.
Cotool pricing
Cotool does not publish plan prices on its website. The homepage directs prospective buyers to book a demo, and Capterra lists no free trial.
| Plan | Price | What's included |
|---|---|---|
| Custom engagement | CustomScope and fees are agreed with sales; no public named pricing tiers. | AI SOC agents, detection and response workflows, threat hunting, integrations, and optional log storage |
Free trial: Request a demo or consultation.
Pros & cons
Pros
- Works with alerts and data in existing systems, so adoption does not require replacing the SIEM.
- Combines response automation with detection tuning and proactive threat hunting.
- Provides inspectable evidence, editable prompts and code, approvals, and evaluation controls.
- Supports federated searches and optional log storage instead of forcing every log into one platform.
Cons
- Public pricing and plan detail are unavailable, requiring a sales-led evaluation.
- The public Capterra profile has zero reviews, leaving limited independent buyer feedback.
- Model-driven agents require careful permissions, approvals, and evaluation for reliable state-changing actions.
- The product is positioned for security operations rather than conventional audit-management workflows.
Who is Cotool best for?
- Security teams that need autonomous alert triage and investigation across an existing tool stack.
- Blue teams that want detection logic represented as editable Python code rather than opaque rules.
- Organizations building threat-intelligence workflows that assess exposure and create follow-up coverage.
- Security engineering teams comfortable governing model-driven agents with approvals, evaluations, and scoped tools.
Use cases
Integrations
Notable customers
Frequently asked questions
How much does Cotool cost?
+
Cotool does not publish paid plan prices. Its website directs buyers to book a demo, and Capterra lists no free trial, so a verified entry price is unavailable.
How does Cotool work, and how long does setup take?
+
Cotool connects alert sources, tools, and data, then runs built-in or customized agents that investigate, enrich, and respond. Its documentation says users can set up a first agent in under 15 minutes, but production deployment time depends on integrations, permissions, and playbooks.
How should Cotool be compared with JupiterOne?
+
Cotool centers on detection, response and threat-hunting agents across a security stack. A useful evaluation should test alert investigation, permission controls and coverage of existing tools against the team’s specific security workflows.
What integrations does Cotool support?
+
Public materials name Slack, Jira, Linear, Okta, CrowdStrike Falcon, Google Workspace, GCP Security Command Center, and Microsoft Defender, alongside webhooks, email, and an API. The platform also supports custom tools and MCP servers, so the full integration surface is broader than the named examples.
Who is Cotool for?
+
Cotool is built for security engineers, analysts, and developers on blue teams that need to scale detection, investigation, response, or threat hunting. It is best suited to organizations with existing security tools and the governance capacity to approve and evaluate agent actions.
How does Cotool address security and agent accuracy?
+
Agents can run in isolated Linux sandboxes, use read-only mode, and require human approval for state-changing actions. Cotool also attaches evidence and reasoning to verdicts and evaluates every run, while detection changes can be tested before application; buyers should still validate performance against their own acceptance criteria.
Sources
Facts and pricing verified on October 19, 2026. Vendors change pricing often, so confirm with Cotool before buying. How we research
