Legion is a browser-based AI assistant for security operations that observes analysts' actions in browser-accessed tools, captures those workflows, and converts them into repeatable playbooks to guide and automate alert triage and investigations.
Published Oct 15, 2026
The vendor has reported funding and received press coverage in recent coverage. Publicly verifiable adoption metrics (for example, customer logos or counts) are limited in public sources.
| Starting Price | Not publicly listed (demo/quote-led) | Community Edition available; paid plans are quote-based | Pricing is quote-based; capacity-based model described |
| Primary Use Case | SOCs using multiple browser consoles that want workflow capture and phased automation with minimal API work | API-first orchestration for teams that will build and maintain workflows | AI-driven investigations/triage with a capacity-based model |
| Key Strength | Trains on customer analysts’ workflows and operates via browser interactions to reduce initial integration work | Established workflow automation ecosystem; integrates with many APIs | Emphasis on AI-driven investigation capacity and predictable capacity models |
| Key Weakness | Potential fragility due to browser/UI automation; limited third-party review footprint; pricing opacity | Can require engineering investment to build and maintain stories | Requires validation of AI investigation quality in the buyer’s environment |