Yes, where the company owns the records or has its customers' agreement. Published buyer ranges run $20K to $750K for companies with 20 to 2,000 employees, in any country. Buyers want the full trail from alert to resolution: SIEM and endpoint alerts, triage decisions, investigation notes and case write-ups. Security product companies can license private code instead. Raw logs without case context do not qualify.
- The valuable unit is a case: the alert, the analyst's decisions, the investigation and the outcome.
- MDR providers usually need customer agreement for anything drawn from customer environments.
- Remove credentials, unpatched vulnerability details and personal data before export.
What security records buyers want
Published buyer requirements name managed security and MDR providers, enterprises with an in-house SOC, security product companies and penetration-testing firms.
| Record | Why buyers want it |
|---|---|
| Alerts with triage decisions | Show how analysts separate real threats from noise. |
| Investigation notes and case write-ups | Capture reasoning from first signal to resolution. |
| SOAR and containment logs | Show which actions were taken and in what order. |
| Detection rules | Encode what the team learned to look for. |
| Private security code, scrubbed of secrets | An alternative route for product companies. |
Rights and safety checks
Security data needs more scrubbing than most record types.
- Customer contracts: MDR and SOC-as-a-service data usually needs customer agreement. Buyers exclude customer data the company cannot share.
- Credentials, keys and tokens found in logs or code must be removed.
- Details of vulnerabilities that are still unpatched should stay out.
- IP addresses, usernames and email addresses in logs are personal data under GDPR and similar laws.
- Some intrusion software and exploit code is subject to export controls under the US Export Administration Regulations.
What rules a company out
Buyers list logs without case context and customer data the company cannot share as not a fit.
Can companies outside the US license these records?
Buyers of these records accept companies anywhere.
The privacy law that applies to any personal data left in the records:
| Country | Main rule to check | Country guide |
|---|---|---|
| United States | Customer contracts; state privacy laws | US guide |
| United Kingdom | UK GDPR | UK guide |
| Ireland | GDPR | Ireland guide |
| Germany | GDPR, BDSG and works council rules | Germany guide |
| Canada | PIPEDA | Canada guide |
| India | DPDP Act 2023 | India guide |
| Singapore | PDPA 2012 | Singapore guide |
Next step
For code-only deals, see selling source code to AI companies. Start with a company-level description: which systems hold the records, how many years they cover and who owns them. No files are needed. Request a free review.
Origin Data Partners is independent and is not affiliated with any AI data buyer. We help owners compare buyers and find the best fit for their records. See what your data is worth.
Common questions
Can an MDR provider sell security data to AI companies?
Only records it owns or has customer agreement to share. Alerts and investigations from customer environments usually belong to, or are restricted by, the customer contract. Internal playbooks, detection rules and anonymized case patterns are easier to license.
How much do AI companies pay for cybersecurity data?
Published buyer ranges run $20K to $750K, depending on case volume and the rights the company holds.
Which tools do buyers expect?
Buyers name Splunk, Microsoft Sentinel, Google SecOps, CrowdStrike, Defender, SentinelOne, Okta and ServiceNow SecOps.
Can a penetration testing firm license its reports?
Buyers list penetration test reports as nice to have. Client engagement letters usually make reports confidential to the client, so anonymization and client consent are normally needed.
Sources and further reading
Origin Data Partners is independent and not affiliated with any buyer named on this page.