Mate Security vs Sekoia.io
Mate Security totals 3.98 and Sekoia totals 3.46 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). Mate Security leads by 0.52 points. The pair turns on rule languages: Sekoia documents it in full, and Mate Security publishes nothing on it. Neither publishes anything on pricing. Mate Security ranks eleventh of fourteen on the proposed scores.
The difference that decides this pair
The largest weighted gap on the rubric is rule health: Mate Security scores 6.0 against 3.0 for Sekoia.io, which is 0.54 of the 10 point total.
On rule languages, Sekoia runs native Sigma YAML, including event_count, value_count and temporal correlation, alongside its own SOL queries, while Mate Security does not say which rule language its agents write. docs.sekoia.com read 2026-11-03 mate.security read 2026-11-04
Rubric side by side
Mate Security totals 3.98 and Sekoia.io totals 3.46 out of 10.
Rubric criteria for Mate Security and Sekoia.io, scores out of 10. A plus marks a criterion where Sekoia.io scores higher, a minus where Mate Security does.
| Marker | Criterion | Weight | Mate Security | Sekoia.io |
|---|---|---|---|---|
| + | Rule languages and conversion paths | 15 | 3.0 | 4.0 |
| + | Git-native workflow and CI/CD | 18 | 3.0 | 3.5 |
| + | Testing | 15 | 3.0 | 3.5 |
| - | Coverage analytics | 12 | 6.0 | 3.5 |
| - | Rule health | 18 | 6.0 | 3.0 |
| Versioning and rollback | 8 | 3.0 | 3.0 | |
| Content library size and freshness | 8 | 4.0 | 4.0 | |
| Pricing transparency | 6 | 3.0 | 3.0 | |
| Total | 100 | 3.98 | 3.46 |
The 33 capabilities as a diff
Read it as a diff from Mate Security to Sekoia.io: 12 of 33 rows differ. A plus marks a row where Sekoia.io documents more (12 rows), a minus a row where Mate Security documents more (0 rows). Rows with no marker match.
Capability rows for Mate Security and Sekoia.io, grouped. Changed rows are shaded and carry a marker.
| Marker | Capability | Mate Security | Sekoia.io |
|---|---|---|---|
| Languages | |||
| Sekoia.io documents more | Sigma native | not documented | documented |
| Sigma conversion | not documented | not documented | |
| YARA-L | not documented | not documented | |
| SPL | not documented | not documented | |
| KQL | not documented | not documented | |
| EQL or ES|QL | not documented | not documented | |
| Python | not documented | not documented | |
| Visual builder | not documented | not documented | |
| YARA | not documented | not documented | |
| Sekoia.io documents more | Lucene or KQL-like | not documented | partial |
| Source control and CI | |||
| Git sync | not documented | not documented | |
| PR deploy | not documented | not documented | |
| CLI | not documented | not documented | |
| Sekoia.io documents more | Rule API | not documented | documented |
| CI examples | not documented | not documented | |
| Env promotion | not documented | not documented | |
| Testing | |||
| Sekoia.io documents more | Unit tests | not documented | partial |
| Sekoia.io documents more | Replay | not documented | documented |
| Synthetic events | not documented | not documented | |
| Sekoia.io documents more | Backtest reports | not documented | partial |
| Test coverage | not documented | not documented | |
| Coverage analytics | |||
| Sekoia.io documents more | ATT&CK map | partial | documented |
| Gap view | partial | partial | |
| Sekoia.io documents more | Data sources | not documented | partial |
| Log source health | partial | partial | |
| Rule health | |||
| Noisy rules | partial | partial | |
| Broken rules | partial | partial | |
| Field drift | not documented | not documented | |
| Sekoia.io documents more | Rule cost | not documented | partial |
| Sekoia.io documents more | Lifecycle | partial | documented |
| Library | |||
| Sekoia.io documents more | Library count | partial | documented |
| Community | not documented | not documented | |
| Sekoia.io documents more | Cadence | not documented | partial |
documentedpartialnot documented
Sources for the rows that differ
- Sigma native (Sekoia.io documents more). Mate Security: not documented, Product pages read do not name this feature; no documentation portal was readable mate.security read 2026-11-03. Sekoia.io: documented, 'Sigma Rules' page: native Sigma YAML, including event_count, value_count and temporal correlation docs.sekoia.com read 2026-11-03.
- Lucene or KQL-like (Sekoia.io documents more). Mate Security: not documented, Product pages read do not name this feature; no documentation portal was readable mate.security read 2026-11-03. Sekoia.io: partial, 'SOL' (Sekoia Operating Language) queries run as scheduled detection rules; syntax relation to KQL not stated docs.sekoia.com read 2026-11-03.
- Rule API (Sekoia.io documents more). Mate Security: not documented, Product pages read do not name this feature; no documentation portal was readable mate.security read 2026-11-03. Sekoia.io: documented, 'Create a SIGMA rule' tutorial: POST /v1/sic/conf/rules-catalog/rules; search rules tutorial docs.sekoia.com read 2026-11-03.
- Unit tests (Sekoia.io documents more). Mate Security: not documented, Product pages read do not name this feature; no documentation portal was readable mate.security read 2026-11-03. Sekoia.io: partial, 'Rule testing' with 'Test pattern' on historical data; no sample-event test cases docs.sekoia.com read 2026-11-03.
- Replay (Sekoia.io documents more). Mate Security: not documented, Product pages read do not name this feature; no documentation portal was readable mate.security read 2026-11-03. Sekoia.io: documented, 'Rule testing': evaluate a Sigma pattern against historical data docs.sekoia.com read 2026-11-03.
- Backtest reports (Sekoia.io documents more). Mate Security: not documented, Product pages read do not name this feature; no documentation portal was readable mate.security read 2026-11-03. Sekoia.io: partial, 'Test results visualization' shows detection frequency and event distribution; not saved as a report docs.sekoia.com read 2026-11-03.
- ATT&CK map (Sekoia.io documents more). Mate Security: partial, Platform page: 'Detection coverage scales across the MITRE ATT&CK Framework' (claim, no per-rule mapping shown) mate.security read 2026-11-03. Sekoia.io: documented, 'Security Profile (MITRE ATT&CK)' matrix built from rule tags docs.sekoia.com read 2026-11-03.
- Data sources (Sekoia.io documents more). Mate Security: not documented, Product pages read do not name this feature; no documentation portal was readable mate.security read 2026-11-03. Sekoia.io: partial, Rules list 'Compatible intake formats'; 'Asset connector health status' (Reveal module) docs.sekoia.com read 2026-11-03.
- Rule cost (Sekoia.io documents more). Mate Security: not documented, Product pages read do not name this feature; no documentation portal was readable mate.security read 2026-11-03. Sekoia.io: partial, 'Performance considerations' in testing best practices; no per-rule telemetry docs.sekoia.com read 2026-11-03.
- Lifecycle (Sekoia.io documents more). Mate Security: partial, Detections 'continuously created, tuned, or deprecated'; no states or handling documented mate.security read 2026-11-03. Sekoia.io: documented, 'Rule Lifecycle': Active, Scheduled for Deprecation, Deprecated, with valid-until date and notifications docs.sekoia.com read 2026-11-03.
- Library count (Sekoia.io documents more). Mate Security: partial, 'Adaptive Detection Engineering Library'; no count stated mate.security read 2026-11-03. Sekoia.io: documented, Sekoia Verified Rules: 'more than 1000 rules' docs.sekoia.com read 2026-11-03.
- Cadence (Sekoia.io documents more). Mate Security: not documented, Product pages read do not name this feature; no documentation portal was readable mate.security read 2026-11-03. Sekoia.io: partial, Verified rules 'continuously updated'; no cadence stated docs.sekoia.com read 2026-11-03.
Verdict by buyer type
Which of the two fits each kind of team.
| Buyer | Verdict |
|---|---|
| a team starting from scratch with Sigma | Sekoia is the better fit: it runs native Sigma YAML, correlation rules included, but documents no CI workflow; Mate Security does not say which rule language its agents write. |
| Microsoft Sentinel estate | Neither Mate Security nor Sekoia documents a path for this buyer, so it does not separate them. |
| Elastic estate | Neither Mate Security nor Sekoia documents a path for this buyer, so it does not separate them. |
When to pick each
Mate Security: Pick Mate Security when rule health matters more to you than testing, where Sekoia documents more: it says detections are tuned or deprecated from investigation outcomes (vendor claim) and publishes no definitions or thresholds.
Sekoia.io: Pick Sekoia when testing is the deciding need: it tests a Sigma pattern against historical data in a rule testing view, with results that are not saved as a report. It also leads on CI and deployment.
Profiles: Mate Security, Sekoia.io. Alternatives: to Mate Security, to Sekoia.io.