What is a cybersecurity company's data worth to an AI buyer?

Mercor's listing for cybersecurity companies puts a deal at $20,000 to $750,000 ("Depends on case volume and rights"). It asks for 20–2,000 employees (Anywhere). What moves an offer within the range is what the listing names: how complete the records are, how far back they go and whether you can license them.

What exactly does the buyer ask for?

Mercor's listing asks for "Alert-to-resolution records the company owns, or private security software", "The right to license them; customer data only with customer agreement". It would also like "SOAR and containment logs", "Detection rules", "Penetration test reports", "Repositories already scrubbed of secrets". It rules out "Logs without case context", "Customer data the company can't share".

What will a buyer ask us first?

Mercor's listing names its first questions: "Do you keep case write-ups together with the alerts behind them?", "Is the data your own or your customers'?", "Which SIEM and EDR tools do you run?", "Do you have private security software?". Have the answers before you start.

How do we sell through you?

Start with the valuation. It reads what you hold against public prices and against the rules each buyer publishes; then either we run the sale for you, describing your records without your name to every buyer whose rules they meet, or, where a buyer's own programme fits you better, we introduce you to it, free for you. The holder pays us a fee fixed in the mandate, and only if a sale closes. In a sale we run no buyer pays us, so our fee depends on what you are paid, not on which buyer pays it. A buyer pays us only if you choose to apply to it through its own referral programme, and you see that amount in writing before you choose.

The trail from alert to resolution is what AI data buyers ask security teams for.

Managed security and MDR providers, in-house SOCs, penetration-testing firms and security product companies: founders and heads of security operations deciding whether case records or code can be licensed.

Mercor's listing for cybersecurity companies puts a deal at $20,000 to $750,000 ("Depends on case volume and rights").

AIData.Broker represents you in selling it: we value your data against public prices, describe it without your name to every buyer whose published rules it meets, at the same time, and help you negotiate the terms, for holders based in the United States, the United Kingdom and Canada. Our fee is 12% of the first $250,000 a sale pays you, and nothing if no sale closes.

buyers quoted below on what they want from companies like yours

4 of 4

kinds of record below that the valuation measures or values

rights questions to settle before a buyer sees a record

What companies like yours hold

What you typically have, where it sits, and whether the valuation can measure or value it. Buyers price what exists together, over how many years, and how well it links.

What cybersecurity companies typically hold
Record	Where it sits, and what the evidence shows	How the valuation reads it
Alert-to-resolution cases	SIEM and endpoint alerts with the triage decision, investigation notes and case write-up, in Splunk, Sentinel, CrowdStrike, ServiceNow or similar.	Measured from your tickets exportCounted with tickets and projects
Detection rules and playbooks	The rules the team wrote and the SOAR playbooks that acted on them.	Measured from your documents exportCounted with documents and knowledge
Penetration test reports	Findings with the steps that proved them.	Measured from your documents exportCounted with documents and knowledge
Private security code	The company's own tools and products, scrubbed of secrets.	Measured from your code history exportCounted with code with its historyValue a codebasepriced on its own, per repository

Alert-to-resolution cases
Where it sits, and what the evidence shows
SIEM and endpoint alerts with the triage decision, investigation notes and case write-up, in Splunk, Sentinel, CrowdStrike, ServiceNow or similar.
How the valuation reads it
Measured from your tickets exportCounted with tickets and projects
Detection rules and playbooks
Where it sits, and what the evidence shows
The rules the team wrote and the SOAR playbooks that acted on them.
How the valuation reads it
Measured from your documents exportCounted with documents and knowledge
Penetration test reports
Where it sits, and what the evidence shows
Findings with the steps that proved them.
How the valuation reads it
Measured from your documents exportCounted with documents and knowledge
Private security code
Where it sits, and what the evidence shows
The company's own tools and products, scrubbed of secrets.
How the valuation reads it
Measured from your code history exportCounted with code with its historyValue a codebasepriced on its own, per repository

What buyers say they want from companies like you

In their own words, from their own pages or from reporting on what they bought. Each opens its source.

“License security alerts, investigations and case write-ups, or security software.”
Mercor, its listing "Cybersecurity Company"Its own page, 27 Oct 2026
“Alert-to-resolution records the company owns, or private security software. The right to license them; customer data only with customer agreement”
Mercor, what the listing asks forIts own page, 27 Oct 2026
“SOAR and containment logs. Detection rules. Penetration test reports. Repositories already scrubbed of secrets”
Mercor, what it would also likeIts own page, 27 Oct 2026

What raises the value

Every case kept whole: the alert, what the analyst decided and why, and how it ended.
Several years of cases, false positives included.
Data the company owns rather than its customers'.
History the listing measures in its own words: "Several years of cases".

What lowers the value

What the listing rules out: "Logs without case context", "Customer data the company can't share".
Raw logs with no case around them.
Repositories that still hold keys or credentials.

A line that quotes a buyer names it. The others are our checklist, drawn from the factors buyers state in general: no buyer publishes how much each one moves a price. How often each factor matters across 156 kinds of data.

The rights to settle first

These stop a sale more often than price does. Each can be settled before any buyer sees a record.

The full rights checklist

An MSSP's case data is mostly about its customers' systems: their contracts decide whether any of it can leave, and most need each customer's agreement.
Penetration test reports describe a client's weaknesses: licensable only with the client's agreement and with every identifying detail removed.

What is already on offer from companies like you

Read this morning from the brokers' and marketplaces' own catalogues. A buyer compares your records with these; settled rights, more years and more linked systems are what set one apart.

Every lot on offer

184

lots on offer like yours

4.2 years

of history in the middle of them

11 of 47

say the rights are settled

Legacy-language toolchain: ~3.9M lines of parser, grammar and rewrite code covering ~90 legacy languages31 years · Grepped marketplace
Quality-engineering services firm: ~9 TB of email, files, CRM and accounting since 201214 years · Grepped marketplace
Media entertainment codebase no. 111 years · Appen data catalog
AR VR app no. 910.1 years · Appen data catalog
Graded coding submissions at scale10 years · Grepped marketplace
Indian blockchain and AI services firm: 10-year company archive10 years · Grepped marketplace
Local commerce platform no. 110 years · Appen data catalog
Crm martech codebase no. 29.8 years · Appen data catalog

What holders like you ask

What is a cybersecurity company's data worth to an AI buyer?: Mercor's listing for cybersecurity companies puts a deal at $20,000 to $750,000 ("Depends on case volume and rights"). It asks for 20–2,000 employees (Anywhere). What moves an offer within the range is what the listing names: how complete the records are, how far back they go and whether you can license them.
What exactly does the buyer ask for?: Mercor's listing asks for "Alert-to-resolution records the company owns, or private security software", "The right to license them; customer data only with customer agreement". It would also like "SOAR and containment logs", "Detection rules", "Penetration test reports", "Repositories already scrubbed of secrets". It rules out "Logs without case context", "Customer data the company can't share".
What will a buyer ask us first?: Mercor's listing names its first questions: "Do you keep case write-ups together with the alerts behind them?", "Is the data your own or your customers'?", "Which SIEM and EDR tools do you run?", "Do you have private security software?". Have the answers before you start.
How do we sell through you?: Start with the valuation. It reads what you hold against public prices and against the rules each buyer publishes; then either we run the sale for you, describing your records without your name to every buyer whose rules they meet, or, where a buyer's own programme fits you better, we introduce you to it, free for you. The holder pays us a fee fixed in the mandate, and only if a sale closes. In a sale we run no buyer pays us, so our fee depends on what you are paid, not on which buyer pays it. A buyer pays us only if you choose to apply to it through its own referral programme, and you see that amount in writing before you choose.

In this topic

What sells

See what you hold, measured on your own computer. Only the counts leave it.

Value your company's records Check an offer you have