Skip to content
SPECIFICTION
Get listed

Panther

panther.com

Free trial WebAPISelf-hosted
Visit panther.com
Spec score 8.0 #9 of 29 in Threat Hunting Software

What it is

Panther is an AI SOC platform for security teams that ingests and normalizes security logs, detects threats, and supports alert investigation and response. Panther AI can query a data lake, review detection logic and alert history, gather context from connected tools, resolve noisy alerts, and escalate high-confidence threats. Its AI Detection Builder turns plain-language threat descriptions into Python detections. Teams can write, test, and version custom rules through CI/CD and GitHub code review, using PantherFlow and SQL. Snowflake or Databricks can serve as the security data lake while data remains in the customer’s warehouse. Integrations include AWS CloudTrail, Okta, GitHub, Slack, CrowdStrike, Databricks, and PagerDuty; MCP connections include Slack, PagerDuty, Notion, GitHub, and Atlassian. Deployment is available as managed SaaS or Cloud Connected. Panther provides a REST API and states that data is isolated in dedicated instances with 99.9% SLA-backed uptime.

Spec sheet

What it does
Panther describes itself as an AI SOC platform that ingests and normalizes security logs, detects threats, and supports investigation and response.Read 9 Oct 2026 · panther.com
Product
Panther is an AI SOC platform for ingesting and normalizing security logs, detecting threats, and investigating alerts.Read 10 Oct 2026 · panther.com
Intended users
Panther presents its platform for security teams seeking to automate SOC workflows and shift effort toward threat hunting and detection engineering.Read 9 Oct 2026 · panther.com
Deployment
Panther offers a managed cloud deployment and a deployment in the customer’s AWS environment using the customer’s Snowflake or Databricks account.Read 10 Oct 2026 · panther.com
API
Panther provides a REST API for interacting with alerts, users, rules, log sources, and other supported entities.Read 10 Oct 2026 · docs.panther.com
Integrations
Panther lists integrations for log sources, alert destinations, enrichment, data lakes, cloud resources, and MCP servers.Read 10 Oct 2026 · panther.com
Support
Panther offers technical support 20 hours a day, five days a week, and 24/7 on-call emergency support for customers.Read 10 Oct 2026 · panther.com
Headquarters
A Panther platform overview identifies San Francisco as the company’s headquarters.Read 10 Oct 2026 · panther.com
Founded
2018Read 28 Sep 2026 · panther.com
AI investigations
Panther AI investigates alerts by querying the data lake, reviewing detection logic and alert history, and gathering context from connected tools.Read 10 Oct 2026 · panther.com
Alert triage
Panther AI autonomously investigates alerts and resolves noise, escalating high-confidence threats.Read 9 Oct 2026 · panther.com
Audit trails
Panther says every AI action is visible, logged, and auditable.Read 9 Oct 2026 · panther.com
Availability
Panther states that it maintains 99.9% uptime through an SLA-backed availability commitment.Read 10 Oct 2026 · panther.com
Company history
Panther says it was built cloud-native in 2018.Read 10 Oct 2026 · panther.com
Data lake
Panther supports using Snowflake or Databricks for the security data lake, with data remaining in the customer’s chosen warehouse.Read 10 Oct 2026 · panther.com
Data visibility
Panther says it ingests log sources and attaches context automatically to support investigations.Read 9 Oct 2026 · panther.com
Detection builder
The AI Detection Builder turns plain-language threat descriptions into production-ready Python detections.Read 9 Oct 2026 · panther.com
Detection engineering
Teams can write, test, and version detection rules in Python and manage them through CI/CD and GitHub code review.Read 10 Oct 2026 · panther.com
MCP integrations
Panther AI can connect to MCP servers including Slack, PagerDuty, Notion, GitHub, and Atlassian.Read 9 Oct 2026 · panther.com
Security certifications
Panther states that it is SOC 2 Type 2 compliant, PCI compliant, and ISO 27001 certified.Read 10 Oct 2026 · panther.com
Tenant isolation
Panther says its customer data is isolated in dedicated instances.Read 10 Oct 2026 · panther.com
Tenant isolation and availability
Panther states that customer data is isolated in dedicated instances and that it maintains 99.9% uptime under an SLA-backed commitment.Read 9 Oct 2026 · panther.com

Plans and prices

Panther Priced on request Pricing is not listed; contact Panther for pricing. Read 10 Oct 2026 · panther.com

Every Panther plan and price →

Strong points and limits

Strong points

  • AI investigates alerts and resolves noise
  • Plain language can generate Python detections
  • Supports Snowflake and Databricks data lakes
  • REST API for supported entities
  • Managed SaaS and Cloud Connected deployment

Limits

  • Pricing requires contacting Panther
  • Cloud Connected setup requires support-provided values
  • Platform is focused on security operations teams

Who it suits

Panther is aimed at security teams automating SOC workflows and shifting effort toward threat hunting and detection engineering. It fits organizations using cloud data warehouses and connected security tools.

Verdict

Panther brings AI investigation, Python detection engineering, and warehouse-based log analysis into one SOC platform. Its deployment choices, integrations, audit trails, and stated 99.9% availability target suit teams with defined security operations infrastructure.

Where Specifiction places it

Alternatives to PantherAll alternatives →