SOAR platforms connect a security team's tools, run playbooks on incoming alerts and keep a case record of what was done. This guide ranks eleven, from open-source engines to vendor-suite modules.
Order follows set-up effort, the bill once users and alert volume grow, how playbooks leave, reliance on a partner and buyer fit; each entry names its limits.
Visibility here may be paid for by a vendor, but what we write about its product is not, and following a link to the vendor earns us nothing. How that works.
In short
What SOAR platforms do
SOAR (security orchestration, automation and response) software connects security tools through APIs, executes playbooks on alerts, and records cases, so analysts handle exceptions instead of repeating enrichment and containment steps.
Our order comes from five tests, taken in turn: effort to set up, what you really pay, what happens to your data on the way out, how locked in you are, and the intended customer. Vendors outside the best-known names fill places 1 to 3 when they exist, and the big brands rank from place 4. Why those five, and why there is no score out of ten, is on the how we work page.
Open-source SOAR engine you can run yourself or use hosted
Ranked #1 of 11 in Best SOAR Platforms in 2026.
Open sourceSelf-hostablePricing on requestEurope
Start with the docker-compose file on a test host and rebuild one phishing playbook there before comparing anything else. The AGPL-3.0 backend means changes you ship as a hosted service must be shared, so ask counsel before building a resale product.
Hybrid mode lets a local execution environment reach Shuffle's cloud, which suits a split estate. Budget engineer time for patching, because the work saved on licences moves to operations.
What stands out
Open source AGPL-3.0
Docker Compose install
Hybrid execution
Where it costs you
Self-hosting means you handle upgrades, scaling and backups, and the repository states no support commitment.
Hosted-cloud rates and paid support terms are not stated in the repository or its README.
Right for
Small teams with engineers who want full control of playbooks and code
Wrong for
Buyers needing a vendor service agreement and a price list upfront
NorwayOpen source core, self-hosted or hosted cloud; paid terms not stated in the repository
No-code workflow builder that began in security operations
Ranked #2 of 11 in Best SOAR Platforms in 2026.
Free tierPublished pricingEurope
Use the free edition for one real intake flow, such as reported phishing, and see how far three live workflows go before touching a quote.
Tines puts case management inside the same builder, so ask whether your analysts will maintain stories or whether engineers will. Check how the paid editions treat extra workflows, since pricing is not shown, and ask what data leaves your network when the AI steps run.
What stands out
Free edition
No-code stories
Cases module
Where it costs you
The free edition is limited to three live workflows, so a working SOC moves to a quoted edition quickly.
Self-serve terms cover cloud hosting only; any other deployment is a negotiated route.
Right for
Security teams wanting analysts to build their own automations without scripting
Wrong for
Organisations that need air-gapped or purely local execution by default
IrelandFree edition with 3 live workflows; paid editions quoted per organisation
SOAR migration specialist whose product is now an AI SOC platform
Ranked #3 of 11 in Best SOAR Platforms in 2026.
Pricing on requestNorth America
Count your real alerts a day over a month, then ask D3 which tier that lands in and what the flat per-alert rate is above it. The migration programme claims playbooks are converted and billing starts when your old contract ends, so have that written into the quote.
Compliance pages mention NIS2 and DORA, so ask what audit record each action leaves, and request the threat hunting module separately.
What stands out
Alert-tier pricing
XSOAR exit programme
800+ apps
Where it costs you
Volume above the chosen daily alert tier is charged per alert, so a noisy month changes the invoice.
The site now leads with an AI SOC pitch, and the orchestration product is one module among several.
Right for
Teams leaving a legacy SOAR who want a fixed annual fee
Wrong for
Buyers who want an alert-agnostic, user-based price or a free tier
CanadaQuoted per organisation; fixed annual fee by daily alert tier
Response layer of a Danish SIEM, with playbooks that run locally
Ranked #4 of 11 in Best SOAR Platforms in 2026.
Self-hostablePricing on requestEurope
Logpoint became Guardsix in March 2026, with a Copenhagen address. Its SOAR page calls the product the response layer of Guardsix SIEM, with playbooks executed in your own self-hosted environment and alerts arriving with context from SIEM and NDR.
The pricing page lists SOAR only in the fourth tier, beside SIEM and NDR, so a SOAR-only purchase is not shown.
What stands out
Danish vendor
Self-hosted playbooks
Tier 4 only
DenmarkQuoted by nodes, devices or entities; SOAR sits in the top tier
Low-code security automation with an alert-routing layer for AI
Ranked #5 of 11 in Best SOAR Platforms in 2026.
Self-hostablePricing on requestNorth America
Ask Swimlane to route a week of your real alerts and show which went to fixed playbooks, which to AI-assisted review and which to the agentic path.
The routing decision is automatic per alert, so you want to see the criteria and an override. Plans are tiered for enterprises and MSSPs and can be user-based, so confirm whether analysts, builders or service tenants count as billable seats.
What stands out
Turbine platform
Low-code canvas
MSSP plan
Where it costs you
No price or trial appears on the pages, so evaluation starts with a sales demo.
The platform page describes cloud-native delivery and does not mention self-hosting.
Right for
Enterprise or MSSP teams wanting low-code playbooks with AI routing
Wrong for
Teams requiring a self-service trial or an on-site install
United StatesTiered Enterprise and MSSP plans; user-based or custom, via sales
Hyperautomation workflows beneath an agentic layer for triage and response
Ranked #6 of 11 in Best SOAR Platforms in 2026.
Pricing on requestMiddle East
Ask for a sandbox run where you describe a response workflow in plain language and inspect the steps it generates before approving them.
Torq offers both deterministic and agentic modes, so decide which actions may run unattended, such as account disablement, and which wait for a person. Its pages describe a cloud-native design, so raise data residency early if your regulator cares where execution happens.
What stands out
Hyperautomation
HyperAgents
Tel Aviv HQ
Where it costs you
No price list is shown; the /pricing page returns not found and quotes begin with a demo.
The site presents the product as an AI SOC platform, so plain playbook buyers pay for a wider pitch.
Right for
Security teams wanting workflows drafted from plain descriptions and agentic triage
Wrong for
Buyers who need published rates or a trial before talking to sales
IsraelQuoted after a demo; no price list on the site
Fortinet's orchestration product, as SaaS or self-managed software
Ranked #7 of 11 in Best SOAR Platforms in 2026.
Pricing on requestNorth America
Begin with the tenancy question: the page offers shared tenancy, dedicated tenants and customer-housed tenants, and each changes how you onboard clients. Request the ordering guide before a demo, then price the SaaS and self-managed routes side by side.
Test the connectors for non-Fortinet tools against your own EDR and ticketing, because the FortiSOAR page counts generic API connections as part of its total.
What stands out
SaaS or self-managed
Multi-tenant
700+ API connections
Where it costs you
The product page shows no price; costs sit in an ordering guide.
The 700+ figure counts API connections, not Fortinet-built certified connectors, so check the ones you depend on.
Right for
MSSPs and Fortinet estates that need shared and dedicated tenant models
Wrong for
Small teams wanting a public price and a quick self-serve start
United StatesNot stated on the product page; ordering guide linked
Content-pack marketplace and a war room for incident work
Ranked #8 of 11 in Best SOAR Platforms in 2026.
Pricing on requestNorth America
Install two packs for tools you actually run and see how many playbook tasks need editing before they work on your data. The war room gives analysts one workspace with ChatOps, so check how its records export if you later leave.
Unit 42 intelligence is described as high-fidelity on the page, so ask what is bundled and what needs a separate licence. Ask for the price in writing.
What stands out
900+ packs
War room
Marketplace content
Where it costs you
The page shows no price or trial, so costs only emerge through sales.
Content packs speed set-up but add maintenance, because each pack changes on its own schedule.
Right for
SOCs wanting ready-made integration packs and a shared war room
Wrong for
Small teams wanting a quick start with no content to maintain
United StatesNot stated on the product page; sales contact
Unlimited cases and playbooks, sold per authorised user
Ranked #9 of 11 in Best SOAR Platforms in 2026.
Self-hostablePricing on requestNorth America
Count the people who will log in, because the metric is the authorised user and usage itself is unlimited. Playbook Designer rebuilds the plan as an investigation develops, so run a ransomware scenario and note what it re-enriches.
Privacy-breach response tasks suit data-protection officers, so decide whether they need seats. Ask IBM whether the cloud route exists, since the pricing FAQ lists VM and OpenShift only.
What stands out
Authorised-user pricing
Playbook Designer
On-prem VM or OpenShift
Where it costs you
The deployment answer on the pricing page lists only on-prem options, a VM or OpenShift.
No amount is shown, and the authorised-user count drives the bill.
Right for
Regulated teams wanting privacy-breach tasks and costs that follow a user count
Wrong for
Buyers who need a SaaS answer stated on the same page
United StatesPer authorised user, plus subscription and support; amounts not shown
Plugin-based automation now filed under Rapid7's security operations platform
Ranked #10 of 11 in Best SOAR Platforms in 2026.
Pricing on requestNorth America
List the plugins your stack needs against the 300+ in the documentation before talking to sales, since coverage decides value. Plan for the Orchestrator: it is installed on your own host, with AWS and Azure guides, and it carries network access you must secure.
The product is now documented as Automation (InsightConnect) within the Rapid7 platform, so confirm which licence name and module bundle appears on your quote.
What stands out
300+ plugins
Orchestrator install
Rapid7 platform
Where it costs you
Pricing and licensing are not covered in the documentation, so costs need a sales conversation.
Actions inside your network depend on installing the Rapid7 Orchestrator, which you must patch.
Right for
Teams already running other Rapid7 products that want plugin-based workflows
Wrong for
Buyers wanting a standalone product page and public price
United StatesNot covered in the documentation; sales quote
Splunk's automation product, documented for cloud and on-premises
Ranked #11 of 11 in Best SOAR Platforms in 2026.
Self-hostablePricing on requestNorth America
Decide first between Splunk SOAR (Cloud) and Splunk SOAR (On-premises), because the documentation treats them as separate libraries. Pilot one alert type from Splunk Enterprise Security end to end, including case closure, then measure how many steps analysts still do by hand.
The vendor groups SOAR beside SIEM and UEBA, so ask whether a bundle price changes the SOAR line. Keep export of playbooks on the checklist.
What stands out
Cloud edition
On-premises edition
Splunk Security
Where it costs you
The pages seen show no price, so a quote is the only route to costs.
Cloud and on-premises editions have separate manuals, so features and versions may differ between them.
Right for
Existing Splunk Enterprise Security teams automating their own alert queue
Wrong for
Buyers without Splunk who want a single independent automation tool
United StatesNot stated in the documentation; sales quote
SOAR (security orchestration, automation and response) software connects security tools through APIs, executes playbooks on alerts, and records cases, so analysts handle exceptions instead of repeating enrichment and containment steps. Compare on the following points, in this order, before you compare features.
01
Decide whether you need a published price
The split is 1 published against 10 quoted. If you want to compare numbers first, start with Tines.
02
Decide how much the jurisdiction matters
3 regions are represented (North America 7, Europe 3, Middle East 1). A vendor outside your own legal area is not a problem as such, but it changes who can compel it to hand over data.
03
Decide if open source matters
1 of these are open source: Shuffle. Hosting one yourself trades a subscription for maintenance.
Choose between playbook SOAR and an AI SOC pitch
Several vendors in this ranking now lead with AI. Torq calls itself an AI SOC platform built on Hyperautomation, D3 Security sells Morpheus as an agentic SOC, and Tines talks about a secure environment for AI agents. Shuffle and FortiSOAR still describe orchestration first. The difference matters for the bill and for who maintains the logic: a deterministic playbook does the same thing every time, an agentic path decides per alert.
Swimlane shows the middle route, routing each alert to a fixed playbook, an AI-assisted path or a fully agentic investigation. Before shortlisting, decide which actions may run without a person, such as disabling an account or isolating a host, and which must wait for approval. Then ask every vendor to show that boundary in the product, with the audit record it leaves behind for each decision.
Which response actions may run unattended?
Can a playbook run without AI steps entirely?
What audit record does each automated action leave?
Work out what each vendor counts
SOAR vendors meter different things, so quotes cannot be lined up directly. D3 Security sells an annual tier based on daily alerts, from 500 to 10,000, with named users and a flat per-alert rate above the tier. IBM QRadar SOAR counts authorised users and states that cases, actions and playbooks are unlimited.
Tines limits its free edition to three live workflows, while Guardsix prices by nodes, devices or entities and puts SOAR in its top tier. Shuffle has an open source core with no licence count at all. Swimlane describes user-based or custom plans. Build a single sheet with your daily alert volume, analyst seats, number of workflows and sub-tenants, and give each vendor the same one so the quotes compare.
What is our daily alert count and its growth?
Do analysts, builders and clients all count as users?
Which module is only sold with a SIEM?
Decide where playbooks execute
Execution location decides data exposure and uptime. Shuffle can be run on your own host with docker-compose or used hosted, and its hybrid mode connects a local execution environment to its cloud. Guardsix says its playbooks run locally in a self-hosted environment under EU jurisdiction. FortiSOAR is offered as SaaS or as self-managed software, and IBM QRadar SOAR lists a virtual machine or OpenShift for on-prem.
Tines self-serve terms cover cloud hosting only, so other deployment is negotiated. Rapid7 InsightConnect needs an Orchestrator installed on your network for local actions. Ask each vendor which systems receive credentials, where case data is stored, what happens to running playbooks during a vendor outage, and whether a local runner can keep acting when the cloud is unreachable.
Where are credentials and case data stored?
What runs if the vendor cloud is unreachable?
Which host must we patch ourselves?
Plan the exit before the contract
Playbooks are the asset you build, so test how they leave. Cortex XSOAR ships over 900 prebuilt integration and automation packs and a war room, which tie content and records to its format. D3 Security advertises conversion of XSOAR playbooks and billing that starts when the old contract ends, which shows the move is possible but not automatic.
Splunk SOAR is documented as separate Cloud and On-premises editions, so even moving between them deserves a test. Shuffle's workflows are licensed MIT, which makes copying them simple. Ask each vendor for an export of one real playbook, one closed case and the audit log in a readable format, and read the contract for what happens to your data and content after the term ends.
Can we export playbooks and cases in a readable format?
Who converts playbooks when we switch vendors?
What happens to our data after contract end?
What goes wrong most often when buying SOAR platforms
Choosing on the connector count alone, when one missing or half-built connector for your EDR stalls the first playbook.
Comparing a per-alert tier, a per-user price and an open-source core without converting each to your own volume.
Letting agentic steps act on accounts or hosts before a person has approved the same action in a test.
Skipping the exit test, then finding playbooks and case history will not move to another platform.
07
Frequently asked questions
8 answers
What are the best SOAR platforms in 2026?
Our ranking of 11 puts Shuffle first. The backend is AGPL-3.0, while apps, workflows and documentation are MIT, and the repository ships a docker-compose file. The GitHub organisation lists Oslo.
A workflow editor, an OpenAPI app creator and sub-organisation control come with it. You carry the upgrades and uptime yourself, and the repository states no rates for hosted use or support.
Which SOAR platforms publish their pricing?
The ones that do, with the model each states:
Tines: Free edition with 3 live workflows; paid editions quoted per organisation.
The other 10 quote per organisation.
Is there a free SOAR platform?
Tines can be used for free, either as a free plan or a self-hosted edition.
Where are these SOAR platform vendors established?
In 6 countries across 3 regions: North America 7, Europe 3, Middle East 1.
Shuffle: Norway.
Tines: Ireland.
D3 Security: Canada.
Guardsix (formerly Logpoint): Denmark.
Swimlane: United States.
Torq: Israel.
FortiSOAR: United States.
Palo Alto Cortex XSOAR: United States.
IBM QRadar SOAR: United States.
Rapid7 InsightConnect: United States.
Splunk SOAR: United States.
Which SOAR platforms are open source?
Shuffle.
Which SOAR platforms can you host yourself?
Shuffle, Guardsix (formerly Logpoint), Swimlane, IBM QRadar SOAR, Splunk SOAR. The other 6 are hosted by the vendor only.
What should you use instead of Shuffle?
Tines and D3 Security are the next two on this page. Tines is for Security teams wanting analysts to build their own automations without scripting; D3 Security is for teams leaving a legacy SOAR who want a fixed annual fee.
Who should not buy Shuffle?
Buyers needing a vendor service agreement and a price list upfront. Self-hosting means you handle upgrades, scaling and backups, and the repository states no support commitment..
This list covers 11 SOAR platforms products. A product we left out can be put to us by its maker, with a short note on its purpose and its customers; we decide on inclusion ourselves. The rules are under software advice.
