D3 Security

D3 Security sells Morpheus, an AI security operations platform that keeps a deterministic playbook engine and case management and offers four autonomy modes. Its Legacy SOAR Migration Program names six source platforms and lists what does not port. Every figure on its pages is a vendor claim with no published method, including 800+ integrations.

What it is

D3 Security describes itself as employee-owned with no outside investors. Morpheus is described as a platform built from scratch over 24 months by a team of 60 and generally available since August 2025 (vendor claims, read 2026-11-03). The line moved from Smart SOAR to Morpheus, and D3 says Morpheus is not a rebrand of the older product. Four autonomy modes are named: Deterministic, AI-Assisted, AI-Led and Autonomous. Pricing is a fixed annual subscription by daily alert volume tier, from 500 to 10,000 alerts a day, with named-user licences and a flat per-alert rate above the tier. No amounts are published, and AI token costs are stated as included.

The playbook artefact on the D3 side is D3's own playbook file, encrypted XML by default. The 18.6 guide, read on 2026-11-04, says a saved version exports as encrypted XML, YAML or JSON and that Import Playbook takes all three. No export to another vendor's format is documented. For other vendors, D3 says converted playbooks arrive in Morpheus in Deterministic mode and that it accepts source-native formats without hand reformatting. Utility Commands can be Python or codeless playbooks.

The vendor describes itself this way: Morpheus is an AI security operations platform. It triages and investigates alerts, traces each alert across identities, endpoints, cloud and email, and recommends or runs responses. It keeps a deterministic playbook engine and case management, and it has an autonomy setting from fully deterministic to autonomous. d3security.com, read 2026-11-03 (vendor claim)

How D3 Security scores

Nine rows, weights summing to 100, each scored 0 to 10 from pages read on 2026-11-03. The part is score times weight divided by 100. How the scoring works.

Where D3 Security is strong

• The Legacy SOAR Migration Program names porting for XSOAR, Splunk SOAR, QRadar SOAR, Siemplify, Swimlane and FortiSOAR, three artifact types, a written list of what is not portable, a parity report from replayed incidents and a rollback path. All of it is vendor claim. d3security.com, read 2026-11-03
• D3 states 800+ integrations for Morpheus. It is a vendor claim, and the stated count names what it counts, which lets the criterion score 8.0. d3security.com, read 2026-11-03
• The pricing structure is public: tiers by daily alert volume, named-user licences and a flat per-alert rate above the tier. No amounts are shown. d3security.com, read 2026-11-03

Where D3 Security is behind

• Case management and hosting are not documented on the pages read. Morpheus is said to include case management, and no page describes case objects, deployment models or regions. Both rows are flagged for a re-read. d3security.com, read 2026-11-03
• The AI figures are unaudited: up to 95 percent of alerts investigated in under two minutes, 98 percent triage accuracy, USD 0.97 per investigated alert. The one comparison, 3 of 3 attack scenarios solved against 0 of 3 for a Microsoft Copilot run, is graded D. d3security.com, read 2026-11-03
• D3 sells the destination, so its migration page is written by the party that wants the migrating customer, and no third-party check was found. The line also changed name from Smart SOAR to Morpheus, a rename risk for existing customers. d3security.com, read 2026-11-03

A fact only D3 Security has

D3 says migrated playbooks arrive in Morpheus in Deterministic mode, that custom code and in-house connectors are flagged for human review, and that it guarantees no conversion percentage. d3security.com, read 2026-11-03

Pricing as published

Fixed annual subscription by daily alert volume tier (500 to 10,000 alerts per day, custom above). Named-user licences at a per-user annual rate. Flat per-alert rate for volume above the tier. Threat Hunting module licensed with the Morpheus tier. AI token costs stated as included. d3security.com, read 2026-11-03 (vendor claim)

Ownership and funding

Company describes itself as employee-owned with no outside investors setting its roadmap. One search for acquisition or rebrand news found none. Results were mostly D3's own pages. d3security.com, read 2026-11-03 (vendor claim)

Named customers

• PwC source, read 2026-11-03 (vendor claim)
• Scotia Bank source, read 2026-11-03 (vendor claim)
• S&P Global source, read 2026-11-03 (vendor claim)
• Cummins source, read 2026-11-03 (vendor claim)
• Disney source, read 2026-11-03 (vendor claim)
• London Stock Exchange Group source, read 2026-11-03 (vendor claim)
• Government of Ontario source, read 2026-11-03 (vendor claim)

Recent releases

• 2026-11 Planned target for Morpheus Threat Hunting module (early access open to existing customers). Module not yet released as of 2026-11-03. Date is a planned target. d3security.com, read 2026-11-03 (vendor claim)

Claims D3 Security makes about itself

These are vendor claims. They are not scored. Each carries an evidence grade: C means a vendor figure with no published method.

What the public pages did not say

• No published price amounts on the pricing page. Pricing is by tier and unit only.
• https://d3security.com/customers returned HTTP 404 on 2026-11-03. Customer names are taken from the home page and the llms-full text.
• https://d3security.com/news returned HTTP 404 on 2026-11-03. No dated press releases were read.
• Blog index shows no publication dates. The 2025-11-01 window could not be checked per post.
• The Morpheus Release History page is linked from llms-full.txt but was not read.
• No analyst report placement found on the pages read (Gartner, Forrester, Latio, GigaOm not checked).

Gaps recorded on 3 November 2026. A gap is an absence on the pages read, and it is scored that way.

Who should shortlist D3 Security

• You are leaving XSOAR, Splunk SOAR, QRadar SOAR, Siemplify, Swimlane or FortiSOAR and want a parity report and a rollback path written into the offer.
• You want a deterministic engine first and autonomy raised in steps from Deterministic to Autonomous.
• You can price by alert volume and want AI token costs included in the subscription.

Verdict. D3 Security is fourth of 14 scored at 6.67, in a band with Torq (6.77), Splunk SOAR (6.68) and Tines (6.42); it leads the migration row at 8.5 on its own claims, with no third-party check.

Moving playbooks out of D3 Security

D3 Security is a source row in the portability matrix: 7 of 70 cells have a documented path. Source format: Encrypted XML, YAML or JSON export and import (docs.d3security.com, read 2026-11-04). The switching guide is Leaving D3 Security.

D3 Security against the other eleven

• BlinkOps v D3 Security
• Cyware v D3 Security
• D3 Security v Google Security Operations
• D3 Security v Mate Security
• D3 Security v Microsoft Sentinel
• D3 Security v Palo Alto Cortex XSOAR
• D3 Security v ServiceNow Security Operations
• D3 Security v Splunk SOAR (Cisco)
• D3 Security v Swimlane (Turbine)
• D3 Security v Tines
• D3 Security v Torq

Alternatives to D3 Security, ordered by the rubric.