A security firm can license closed case files it controls: the alert, the analyst's triage and investigation, the actions taken and the outcome. Cases from client environments usually belong to, or are restricted by, the client's services agreement and data processing terms, so they need the client's written consent or must stay out. AI developers are hiring to build defensive security training environments, but no closed price for incident data is public.
- The unit is the closed case, from first alert to verdict, including false positives and benign closures.
- Cases from your own environment are the cleanest; client cases need the client's written consent.
- As a processor under GDPR, a provider acts only on the client's documented instructions.
- Incident response reports often belong to the client or sit under counsel's privilege claim.
- Start with a description: case counts by year, tools and who owns each environment. No files needed.
Which security firms hold case data, and whose is it?
Every security firm keeps case records, but who controls them depends on whose environment the case came from. The table is the usual position; your contracts decide the real one. The record types, redaction steps and other legal limits are covered in the guide to licensing security incident data.
| Firm type | Cases it holds | Who usually controls the content | Licensable without client consent? |
|---|---|---|---|
| Company with an in-house SOC | Alerts and incidents in its own environment | The company | Usually yes, after employee notice, secrets and personal data are handled |
| MSSP or MDR provider | Alerts, triage and cases from many client environments | Each client, under the services agreement and data processing terms | Only cases from the provider's own environment, or with written client consent |
| Incident response firm | Engagement notes, timelines and final reports | The client; reports are often commissioned through the client's counsel | Rarely; the firm's own methods, playbooks and anonymous statistics are separate |
| Penetration testing firm | Findings and reports from client tests | The client, under the engagement terms | Only with consent; unfixed findings stay out regardless |
| Security product company | Detections, rules and telemetry from its product | Split between the vendor and its customers, by contract | Its own rules, code and research; customer telemetry per the contract |
What client contracts and processor terms say
General information, not legal advice: the GDPR text below was read on 14 November 2026, and your counsel reads your own client agreements and data processing terms before any case leaves the firm.
When a provider handles a client's personal data under GDPR, the contract must say that the processor "processes the personal data only on documented instructions from the controller" (GDPR Article 28(3)(a)), and a processor that infringes the Regulation by determining the purposes and means of processing "shall be considered to be a controller in respect of that processing" (GDPR Article 28(10)). IP addresses, usernames and email addresses in logs are usually personal data, so using a client's cases to train or test someone else's model is a new purpose the client has to instruct or consent to.
US service agreements usually reach the same place through confidentiality and data-use clauses. A security trade publication put it this way on 6 November 2026: "A vendor's use of customer security records to provide a service does not by itself authorize their use for model improvement" (Dark Reading, opinion). In Origin's view, the safe default for an MSSP is to start with cases from its own environment and with clients who opt in in writing.
Who is asking for security case data?
Each row is public evidence read on 14 November 2026, graded by its source. None of it is a price for case data.
| Evidence | What it says | Grade |
|---|---|---|
| Anthropic, Cybersecurity RL job post | The role covers "secure coding, vulnerability remediation, and other areas of defensive cybersecurity" and includes "designing and implementing RL environments" (Anthropic) | Company claim (job post); shows demand for defensive security training environments, not a purchase of case data |
| Dark Reading, opinion by a researcher and a CISO | "Security records are increasingly being used by vendors to train their models, creating new risks for enterprises." (Dark Reading) | Trade press opinion |
| Epoch AI interviews on RL environments | Contract sizes for environments and tasks "are often six to seven figures per quarter" (Epoch AI) | Independent research based on interviews; covers all domains, not security alone |
Read together: AI developers are building defensive security training and evaluation environments, and real cases with known outcomes are what such environments are tested against. No closed price for incident or SOC case data had been published as of 14 November 2026, so any figure you see quoted for it is an offer or an estimate.
What goes on a case data card?
A data card lets a buyer judge a set without opening a case. One row per case:
| Field | What to record |
|---|---|
| case_id, opened_at, closed_at | A stable ID and timestamps with time zone |
| source_environment | Own environment, or client environment with the consent basis |
| detection_source | SIEM, EDR, email security, cloud, identity or user report |
| severity, attack_techniques | Severity and MITRE ATT&CK technique IDs where tagged |
| triage_steps | Queries run and evidence checked, in order, redacted |
| actions | Containment and remediation actions, manual or SOAR |
| verdict, verdict_source | True positive, false positive or benign, and who confirmed it |
| report | Whether a write-up exists, and whether counsel commissioned it |
| redaction_log | Entity types replaced, method, counts and reviewer |
Checklist before a first conversation
Write these down. None of them needs a case to leave the firm.
| Check | What to write down |
|---|---|
| Tools and years | SIEM, case or ticket system, SOAR and EDR, and the years each holds |
| Case counts | Closed cases per year, with the share of false positives and benign closures |
| Ownership | Cases from your own environment versus client environments, and what each services agreement says about data use |
| Reports | Which reports were written for clients or commissioned through counsel |
| Sensitive content | Credentials, unpatched vulnerabilities, malware samples, threat intelligence received under TLP |
| Employees | Analyst names and notes in cases, and whether staff have been told about any reuse |
What happens next: three steps
A first conversation needs no case files. You can stop after any step.
- Describe your cases: tools, years, counts and whose environments they come from (describe your closed security cases).
- Rights and redaction plan: Origin works through client contracts, processor terms and privilege with you and your counsel, then the redaction plan and the case data card. You approve a small redacted sample before anything leaves the firm.
- Buyer review and terms: Origin works with buyers, the AI developers and data companies that license case data like this. Only buyers you approve see the case data card, and you approve scope, use, price and delivery and sign the licence yourself.
- Origin does not charge data owners; a buyer may pay Origin when a deal closes (how Origin is paid).
Guides for the security team
The detailed pages behind this hub:
- Licensing security incident data: record types, legal limits, redaction and packaging
- Data for AI evaluation: training, testing and holdouts
- RL environments built from company data
- Licensing agent traces from production, for security teams that already run AI agents on their own alerts
- Licensing evaluations, tasks and corrections beyond an archive
- How to de-identify company data before licensing
Run a SOC, MDR or incident response practice? Describe your closed cases. No case files or system access needed.
Origin Data Partners works with companies that own data and helps get it bought. We are independent of the services on this page, and a buyer may pay us when a deal closes (how Origin is paid). See what your data is worth.
Common questions
Who owns an incident response report: the IR firm or its client?
Usually the client. Reports are written for the client under the engagement terms, and many are commissioned through the client's counsel to support a privilege claim. The IR firm keeps its own methods, playbooks and anonymous statistics, which it can describe separately.
Should false positives be included in a security case data set?
Yes. Triage is mostly deciding what is not an incident, so false positives and benign closures, with the reason each was closed, are as useful as confirmed incidents. Record the verdict and who confirmed it for every case.
Can an MSSP license cases from a client environment if it removes the client's name?
Not on that basis alone. Removing the name does not change who controls the data: services agreements and data processing terms usually limit use to providing the service, and under GDPR a processor acts only on the controller's documented instructions. Written client consent, or leaving those cases out, is the usual route.
Has anyone published a price for SOC or incident case data?
No closed price had been published as of 14 November 2026. Public evidence shows AI developers building defensive security training environments and paying for environments and tasks in general, but no price per case or per set.
What does Origin charge a security firm?
Nothing. Origin does not charge data owners; a buyer may pay Origin when a deal closes. You approve every step and sign any licence yourself.