Vectra AI sells a network detection and response platform that uses machine learning models, branded the Attack Signal Intelligence engine, to autonomously detect and prioritize signs of active attacker behavior across cloud, identity, and network environments.
Vectra AI is a network detection and response (NDR) vendor whose platform, marketed as the Vectra AI Platform, applies machine learning and behavioral analytics to network, identity, and cloud telemetry to detect and prioritize signs of active attacks. The core engine, called Attack Signal Intelligence, generates prioritized alerts intended to reduce the volume of security events that human analysts must triage manually. The platform integrates with security operations center (SOC) workflows, extended detection and response (XDR) tooling, and third-party SIEM and SOAR products.
The company is privately held and has raised venture and growth capital over multiple rounds, including a Series F reported at a valuation near 1.2 billion dollars in 2020. Vectra has not disclosed an IPO and remains venture backed as of the research cutoff. It reports customers across enterprise, government, and mid-market segments, with public case studies spanning financial services, healthcare, and higher education sectors.
Documented from public materials · these are the products the AMS scores
Vectra AI Platform
Shipping since 2016
The core platform ingests network, identity, and cloud metadata and applies the Attack Signal Intelligence machine learning engine to detect attacker behaviors such as lateral movement, command and control activity, and privilege escalation, then prioritizes alerts by risk score for SOC analysts.
Vectra AI for Network Detection and Response (NDR)
Shipping since 2016
Network-focused detection module that monitors east-west and north-south traffic, including encrypted traffic, without requiring decryption, to identify anomalous behavior patterns associated with active intrusions.
Vectra AI for Identity and Cloud
Vectra AI for Identity and Cloud
Extends detection coverage to identity infrastructure (including Microsoft Entra ID and Active Directory) and public cloud environments such as AWS and Microsoft Azure, correlating identity-based signals with network detections inside the same platform.
2024 - 2026 ·gold = a monetization move· grey = product or capital
Vectra AI continued expanding Attack Signal Intelligence coverage into identity and cloud detection, integrating these signals with existing network detection capabilities inside a unified platform. Source: Vectra AI newsroom.
Vectra AI expanded partner integrations with SIEM and SOAR vendors to embed Attack Signal Intelligence outputs into broader SOC workflows, reflecting continued platform consolidation rather than a new pricing structure. Source: Vectra AI newsroom.
Vectra AI does not publish list prices. Public procurement and reseller listings indicate the platform is sold primarily as an annual subscription, typically scoped by network bandwidth or by the number of hosts, workloads, and identities monitored, rather than by per-seat licensing. Packaging separates network detection, identity detection, and cloud detection as modules that can be purchased individually or combined within a single platform subscription.
Contracts are negotiated directly with Vectra AI or through channel partners and managed security service provider (MSSP) resellers, with multi-year terms common in enterprise and public sector deals based on publicly available procurement records. No evidence was found of a separate usage-based meter tied specifically to AI or machine learning processing; the detection engine is bundled into the core subscription rather than billed as a discrete add-on.
Pricing not public. No official price list, per-unit rate card, or standard discount schedule was located in company documentation as of the research cutoff.
Analyst layer · placement follows the documented capability above
Independence. Vectra AI's Attack Signal Intelligence engine automates detection and prioritization of security events, but human SOC analysts remain responsible for investigation, containment, and remediation decisions. Published product documentation describes the platform as an analyst force multiplier rather than an autonomous responder, consistent with a moderate independence rating.
Job width. The platform covers a full detection workflow, spanning data ingestion, behavioral analysis, alert prioritization, and integration with SOC case management, within the security operations function. It does not extend into adjacent functions such as IT operations or compliance reporting as a primary capability, placing job width at the workflow level within one function.
Output versus cost. By automating triage across large volumes of network and identity telemetry that would otherwise require manual log review, the platform materially reduces analyst hours per detected incident. Public case studies describe reduced alert volumes and faster investigation times, consistent with an inflecting output-to-cost ratio rather than a linear or exponential one, based on available customer testimonials.
Monetization pattern. Vectra AI monetizes through platform subscription licensing scoped to network, identity, and cloud coverage rather than through a distinct per-agent or per-action usage meter. No public evidence indicates a separate charge tied to AI model invocations or automated actions; the detection engine is treated as a bundled platform capability rather than a metered agentic product.
| Edition | AMS score | Metric on record | Change |
|---|---|---|---|
| Aug 2026 | M · M · Infl | Provisional AMS score calculated from public product documentation, August 2026 | Baseline, first edition |
Future editions add a row whenever the score or the metric moves, with the evidence that moved it.
About this data
Everything on this page is a synthesis of public information: published reporting, vendor documentation, and procurement data that anyone can access. We link to those sources throughout. Nothing on this page draws on private or confidential information, and the positions are Monetizely's analysis of that public record, refreshed monthly.