Unified SOAR Platform with AI-Powered Automation

D3 Security is a Vancouver, Canada-based security automation company whose origins trace back to 2015, when founder Gordon Benoit built what the company describes as the first incident response automation solution, complete with dynamic incident forms, alert grouping, and link analysis.

At RSA 2016, D3 demonstrated integrations with ArcSight, QRadar, and Splunk, establishing itself as a security automation pioneer before Gartner coined the term SOAR to describe the category it had helped create. Over the following years the company scaled to meet enterprise demand, adding NIST- and SANS-based playbook libraries, a codeless playbook editor, and content built around the MITRE ATT&CK and D3FEND frameworks.

In 2022, D3 introduced the Event Pipeline to confront the industry’s chronic alert-volume problem. By deduplicating, enriching, and normalizing incoming alerts before they ever reach an analyst, the pipeline reduces alert assignments by up to 99%, filtering out noise so teams can focus on what matters. In 2023, D3 brought this together in Smart SOAR, pairing the Event Pipeline with drag-and-drop playbooks, vendor-maintained integrations, and multi-level automation.

D3’s flagship platform, Morpheus, answers customer demand for truly autonomous investigation. Built over 24 months by roughly 60 specialists, Morpheus performs full L2-depth Attack Path Discovery on every alert before an analyst reviews it, generates response playbooks at runtime, and maintains self-healing integrations across a library of more than 800 apps. The result is 100% alert coverage, with up to 95% of alerts triaged and L2-investigated in under two minutes.

Trusted by enterprise and MSSP customers including Scotiabank, S&P Global, Cummins, Cybereason, and Microsoft, D3 holds SOC 2 Type II certification, is MITRE ATT&CK and D3FEND compatible, and is a member of the Microsoft Intelligent Security Association.