A security team receives thousands of alerts every day from endpoints, network, cloud and email. AI helps you sift through that flow, speed up investigations and write reports. The decision to intervene stays with the analyst. Since the Cyberbeveiligingswet, the Dutch implementation of NIS2, came into force on 15 August 2026, more than 8,000 organisations must demonstrably work on cybersecurity and report a significant incident within 24 hours (source: BarentsKrans). This guide shows which tools are in our index, what to look out for and what they cost. The full overview is at AI for cybersecurity.
Where AI helps in this field
Detection and triage
Darktrace learns the normal behaviour of your network, email, cloud, OT and identities and flags deviations. The Cyber AI Analyst investigates alerts independently, including those from third-party tools. WithSecure Elements from Helsinki combines XDR and exposure management, and the built-in assistant Luminen explains detections in plain language. Charlotte AI from CrowdStrike triages detections automatically within the Falcon platform, with approval flows before actions are carried out.
Investigation, response and automation
Microsoft Security Copilot works within Defender, Sentinel, Intune, Entra and Purview. You ask questions in plain language, have KQL queries generated and suspicious scripts analysed. ESET LiveAI sits in the XDR module of ESET PROTECT and, among other things, generates incident reports. Sekoia from Rennes is a SOC platform with SIEM, XDR and threat intelligence, with AI agents for detection, investigation and response. If you want to automate your own workflows, you build them with Tines, for example for alert triage, using AI agents and integrations.
Attack surface, code and pentests
Hadrian from Amsterdam uses Atlas to continuously map your assets reachable on the internet, and uses Nova to run AI-agent pentests. Aikido Security from Ghent scans code, dependencies, containers and cloud, and creates a pull request with the fix. If you build AI applications yourself, Mindgard attacks your models, agents and apps to find weak spots (AI red teaming).
Awareness and email
SoSafe from Cologne runs gamified training and phishing simulations, with the chatbot Sofie helping employees with security questions. 365 Total Protection from Hornetsecurity protects Microsoft 365; Plan 4 includes an AI Cyber Assistant that analyses reported emails.
Outsourcing is also an option: Eye Security from The Hague provides managed detection and response with a European 24/7 SOC, incident response and cyber insurance in a single contract. Analysts make the decisions, AI makes them faster. You can see all the tools for reporting side by side at AI for reporting in cybersecurity.
What to look out for: GDPR and data storage
A security tool sees everything: log files, emails, usernames and network traffic. That is personal data, so you need a data processing agreement and you need to know where the data is stored. The differences are significant:
- WithSecure Elements processes data for Luminen in AWS in Europe, according to its own statement, and does not train foundation models on customer data.
- SoSafe stores data in Germany or elsewhere in the EU/EEA and is ISO 27001-certified.
- Sekoia can run self-hosted, or in European regions.
- With Microsoft Security Copilot you choose the geo of your workspace, but sharing data with Microsoft is switched on by default. You can turn that off.
- For Charlotte AI, ESET LiveAI and Mindgard, the hosting location is not publicly stated.
Ask each provider whether your data is used to train models. For most tools in our index, this is not publicly stated.
Three starting scenarios
1. SMEs without their own security team
If you have no analysts in-house, outsourcing is the most realistic option. Eye Security provides 24/7 monitoring and incident response, with a free 5-minute NIST self-scan to get started. Combine that with SoSafe for staff training, because phishing remains a common entry point. If you work in Microsoft 365, also look at 365 Total Protection.
2. In-house SOC that does not keep track of alerts
If you already use Microsoft security tools, Microsoft Security Copilot connects to them directly. With Microsoft 365 E5, 400 SCUs per month are included per 1,000 user licences. If you are a CrowdStrike customer, qualifying packages get 50 AI credits per month for Charlotte AI. If you are looking for a European platform, compare Sekoia and WithSecure Elements. WithSecure offers a free trial of 30 days. Automate recurring steps with the free Free Edition of Tines.
3. Software company or SaaS provider
Start with Aikido Security: the Developer version is free for 2 users and 10 repos. Test your external attack surface with the free external scan from Hadrian and book a pentest if needed. If you build AI into your product, have it attacked with Mindgard. You will find more tools for development teams under AI for software development.
Common mistakes
- Letting agents act without approval. Never let an AI agent carry out actions in production systems without an analyst's sign-off.
- Pasting logs into a free chatbot. Consumer versions of Copilot and ChatGPT train on your input by default unless you switch that off. Use a business version, and check the GDPR check for Copilot to see what happens to your data.
- Not assigning the reporting obligation. Agree in advance who makes the 24-hour report under the Cybersecurity Act when an incident occurs.
- Not checking default settings. Data sharing, region and retention period are not always set the way you expect.
- Forwarding AI reports unchecked. Always review a summary for the board or regulator yourself first.
Cost overview
| Tool | Price |
|---|---|
| Aikido Security | Developer free (2 users, 10 repos); Basic $300/month and Pro $600/month (both incl. 10 users); Enterprise on request |
| Hadrian | Nova from €1,250 per test; Atlas on request |
| SoSafe | From €625/month (annual billing, incl. 50 seats); Advanced on request |
| Tines | Free Edition free (3 live workflows, one-time $50 AI credit); paid editions on request |
| Microsoft Security Copilot | Per SCU (example calculation Microsoft: $4 per provisioned SCU/hour, $6 per overage SCU); partly included with M365 E5 |
| Charlotte AI | 50 AI credits per month at no extra cost for qualifying customers; beyond that on request |
| WithSecure Elements | On request; Luminen at no extra cost for relevant Elements users |
| Darktrace, Sekoia, Eye Security, ESET LiveAI, 365 Total Protection, Mindgard | On request |
| General assistant (business) | Copilot Business from $20/seat, Claude Team from $20/seat, ChatGPT Business $21/seat, Mistral Team from $24.99/seat |
With Security Copilot, the bill depends on how many SCUs you provision: one SCU running for a month comes to roughly $2,900 according to the worked example. For platforms on request, always ask whether the AI features are included in the package or charged separately.
See the full overview of AI tools for cybersecurity, or the related sectors software development, education and banking. Terms such as data processing agreement and ISO 27001 are explained in explanations and terms.
