← All Business solutions
AICost Business Solutions

Security operations (SOC)

3 AI automations this team runs today, each with the process, the AICost engine chain that prices and governs it, and the evidence behind it.

Cost engine Governance engine Each step priced and controlled. Click any engine to open its calculator or playground.
Alert triage and investigation agent (AI Tier-1 analyst)User-reported phishing triageDetection tuning and threat hunting assistant

Alert triage and investigation agent (AI Tier-1 analyst)

Owner: SOC manager / detection and response team

See a chain run live Build this chain for our stack
Scale: About 960 alerts/day on average, 3,000+ at large enterprises; 40% never investigated (Prophet Security survey, Sept 2025, vendor-sponsored)

How the work runs

  1. Alert arrives from SIEM, EDR or cloud tools
  2. Agent gathers context (user, host, threat intel, related alerts)
  3. Agent investigates and gives a verdict with evidence
  4. Benign alerts closed and real threats escalated
  5. Analyst confirms and starts the response

AICost engine chain

4 cost engines 3 governance engines

Each step priced and controlled. Click any engine to open its calculator or playground.

Where cost leaks

  • Full investigation run on every alert during alert storms
  • Large log queries pulled into the model context
  • Per-alert or per-investigation pricing

Where risk sits

  • Real attack closed as benign
  • Agent containment actions (isolate host, disable user) causing outages
  • Sensitive security data sent to outside models

Runs on

  • Splunk
  • Microsoft Sentinel / Defender
  • CrowdStrike
  • Palo Alto Cortex XSIAM
  • Google SecOps
  • Prophet Security
  • Dropzone

Evidence

thehackernews.com ↗prophetsecurity.ai ↗

User-reported phishing triage

Owner: SOC / email security team

See a chain run live Build this chain for our stack
Scale: Hundreds to thousands of user-reported phishing emails per week at large enterprises, mostly benign (Microsoft RCT paper, Nov 2025)

How the work runs

  1. Employee reports a suspicious email
  2. Agent analyzes headers, links and attachments
  3. Agent gives a verdict with an explanation
  4. Benign emails resolved automatically
  5. Malicious emails purged from all mailboxes and escalated

AICost engine chain

4 cost engines 2 governance engines

Each step priced and controlled. Click any engine to open its calculator or playground.

Where cost leaks

  • Every reported email analyzed, including obvious newsletters
  • Repeat analysis of the same campaign
  • Security Copilot compute-unit consumption

Where risk sits

  • Phishing marked benign and left in inboxes
  • Analysts over-trusting AI verdicts
  • Email contents processed outside policy

Runs on

  • Microsoft Defender / Security Copilot
  • Proofpoint
  • Abnormal Security
  • Google Workspace

Evidence

arxiv.org ↗microsoft.com ↗

Detection tuning and threat hunting assistant

Owner: Detection engineering / threat hunting

See a chain run live Build this chain for our stack
Scale: use rates: triage 67%, detection tuning 65%, threat hunting 64%, Prophet survey

How the work runs

  1. Analyst asks a question in plain language
  2. AI writes the hunt query (KQL, SPL)
  3. AI runs it and summarizes findings
  4. AI suggests rule changes to cut false positives
  5. Engineer reviews and deploys the rule

AICost engine chain

3 cost engines 2 governance engines

Each step priced and controlled. Click any engine to open its calculator or playground.

Where cost leaks

  • Broad queries over large data volumes (SIEM ingest and query costs plus model costs)
  • Iterative query rewriting loops
  • Capacity units bought ahead of use

Where risk sits

  • Rule changes that silence real detections
  • Wrong queries giving false all-clear
  • Over-broad data access for the assistant

Runs on

  • Splunk
  • Microsoft Sentinel
  • Google SecOps
  • CrowdStrike
  • Elastic

Evidence

thehackernews.com ↗microsoft.com ↗

Reference chains are a starting point. Your volumes, models and vendors change the numbers; the engines recompute them from live prices.

Your process is not on the list, or runs differently? These chains are a starting point. We assemble the right engines for your workflow, your models and your vendors, and you run it over MCP or in the calculators.

Industry solutions → Build my chain
📖 Data sources & methodology 172 text models · 9 embeddings · 44 vision · 62 audio · 8 vector DBs across 10 vendor pages · last verified 2026-10-15

Methodology

  • All prices are USD per 1 million tokens, current as of 2026-10-15.
  • Vendor-published values have no mark. Inferred/extrapolated values are marked with * and listed below.
  • Batch API discounts are 50% off standard rates across providers that offer Batch mode.
  • Prompt caching discounts vary by provider (typically 80-90% off cached input tokens).
  • Regional data-residency surcharges (Anthropic 1.1x, OpenAI 1.1x, Google regional tiers) are NOT included in base rates.
  • Long-context pricing tiers apply when input exceeds model threshold.
  • Embedding prices are input-only (no output tokens generated).

Primary sources

Last-verified date is the most recent successful daily snapshot (aicost_pricing_snapshots) or, when no snapshot exists yet, the latest successful crawler run (aicost_crawler_runs). 10 of 10 vendors are currently verified. Aggregator services (TokenCost, AI Pricing Guru, etc.) are not listed.

Anthropic
2026-10-14
https://www.anthropic.com/pricing
Daily snapshot since Sep 2023 · 700 days captured
Anthropic Docs
2026-10-14
https://platform.claude.com/docs/en/about-claude/pricing
Daily snapshot since Sep 2023 · 700 days captured
OpenAI
2026-10-14
https://openai.com/api/pricing/
Daily snapshot since Sep 2023 · 701 days captured
Google AI
2026-10-14
https://ai.google.dev/gemini-api/docs/pricing
Daily snapshot since Dec 2023 · 676 days captured
Google Vertex
2026-10-14
https://cloud.google.com/vertex-ai/generative-ai/pricing
Daily snapshot since Dec 2023 · 676 days captured
DeepSeek
2026-10-14
https://api-docs.deepseek.com/quick_start/pricing
Daily snapshot since May 2024 · 615 days captured
xAI
2026-10-14
https://x.ai/api
Daily snapshot since Nov 2024 · 533 days captured
Mistral
2026-10-14
https://mistral.ai/pricing
Daily snapshot since Dec 2023 · 674 days captured
Cohere
2026-10-14
https://cohere.com/pricing
Daily snapshot since Sep 2023 · 700 days captured
Voyage AI
2026-10-15
https://docs.voyageai.com/docs/pricing

Inferred values (marked with * in calculator tables)

Derived from industry conventions, not directly published by the vendor. Typical conventions: cached input = 10% of base (90% off), Batch API = 50% of base (50% off).

Vendor / Model Field Why it’s inferred
Anthropic — Claude Sonnet 4.6 cachedInput Derived at 10% of input rate — Anthropic publishes 90% cache-hit discount on this tier.
Anthropic — Claude Sonnet 4.5 cachedInput Derived at 10% of input rate; same 90% cache-hit convention as Sonnet 4.6.
Anthropic — Claude Sonnet 4.5 batchInput Derived at 50% of standard input — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Sonnet 4.5 batchOutput Derived at 50% of standard output — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Haiku 4.5 cachedInput Derived at 10% of input rate — Anthropic 90% cache-hit discount convention.
OpenAI — GPT-5.4 Mini cachedInput Derived at 10% of input — OpenAI documents automatic 90% discount on cache hits across GPT-5.x tier.
OpenAI — GPT-5.4 Nano cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Nano batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Nano batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Pro batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.2 cachedInput Derived at 10% of input; no residency uplift.
OpenAI — GPT-5.2 batchInput Derived at 50% of input.
OpenAI — GPT-5.2 batchOutput Derived at 50% of output.
OpenAI — GPT-5 cachedInput Derived at 10% of input.
OpenAI — GPT-5 batchInput Derived at 50% of input.
OpenAI — GPT-5 batchOutput Derived at 50% of output.
OpenAI — GPT-5.5 Pro cachedInput Derived at 10% of input — OpenAI does not publish a cached rate for *-pro models; using the family convention.
OpenAI — GPT-5.5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.2 Pro cachedInput Derived at 10% of input — pro-tier convention.
OpenAI — GPT-5.2 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.2 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.1 batchInput Derived at 50% of input.
OpenAI — GPT-5.1 batchOutput Derived at 50% of output.
OpenAI — GPT-5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5 Nano cachedInput Derived at 10% of input.
OpenAI — GPT-5 Nano batchInput Derived at 50% of input.
OpenAI — GPT-5 Nano batchOutput Derived at 50% of output.
Google — Gemini 3 Flash cachedInput Derived at 10% of input — Google caching discount convention ~90%.
Google — Gemini 3.1 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 3.1 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 3.1 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Pro cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 2.5 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
xAI — Grok 4 (legacy) cachedInput Extrapolated at 25% of base.

Pricing is cross-verified against the LiteLLM community registry when available. Daily snapshots are kept in aicost_pricing_snapshots; every change is logged to aicost_price_changelog with old & new values for full audit trail. Read the full methodology →