Top 10 SOAR platforms in 2026

Best SOAR platforms for AI-native security teams

Security orchestration, automation, and response (SOAR) platforms connect security tools and automate work such as alert triage, enrichment, investigation, and incident response. In 2026 most SOAR platforms also ship AI agents. Agentic SOAR is the term for platforms where those agents work cases and workflows alongside analysts. The table below compares the top 10 SOAR platforms across cases, AI agents, deployment, and free tiers.

This article ranks ten SOAR platforms, from agentic security automation to enterprise SOAR and the automation layers inside SIEM and XDR suites.

Our top 3 picks

• Best overall: Tracecat. Built for engineering-minded, AI-native security teams running agentic security operations. Agents, workflows, cases, and tables ship in one platform, open source under AGPL-3.0, with Enterprise Git sync to a repository your team owns. Tracecat deploys self-hosted, air-gapped, or in Tracecat Cloud.
• Best for Palo Alto Networks shops: Cortex XSOAR and AgentiX. Palo Alto calls Cortex AgentiX the next generation of XSOAR. XSOAR 8 has an on-prem appliance, but Palo Alto marks air-gapped installation as removed and recommends XSOAR 6 for disconnected deployments. AgentiX runs in Palo Alto's Cloud. Teams that want agentic automation while keeping the full platform on-prem or air-gapped should compare Tracecat.
• Best for a vendor-operated AI SOC: Torq. Torq packages investigation, cases, and response as an AI SOC run the vendor's way. Self-hosted step runners keep private execution inside your network.

What's the difference between SOAR, agentic SOAR, and AI SOC?

• SOAR. Security orchestration, automation, and response. A SOAR takes detections from the SIEM, EDR, cloud, identity provider, or email gateway and runs playbooks across those tools to enrich, triage, contain, notify, and track the work on a case. Classic SOAR playbooks are deterministic. Every branch is written in advance.
• Agentic SOAR. SOAR where AI agents work cases and workflows alongside analysts. Deterministic workflows still handle the repeatable paths. Agents take on the investigation steps that used to need a person, such as finding the owner of a resource or pivoting across logs, with human approval in front of sensitive actions. The team still builds, reviews, and versions the automation.
• AI SOC. A closed product that sells pre-built AI analysts. The vendor decides how alerts are investigated. The customer tunes settings instead of building workflows, agents, or cases.
• SIEM. A security information and event management system collects and correlates logs to produce detections. The SIEM says that something happened. The SOAR decides what to do about it and does it.

SOAR is not dead. A 2024 Gartner Hype Cycle placed SOAR at "obsolete before plateau", as Dark Reading reported. That criticism targeted brittle playbooks that broke whenever a tool or an alert format changed. But the work itself has not gone away. A security team still needs orchestration across the SIEM, EDR, identity, and cloud tools, a case record for every incident, and an audit trail of what ran. Agentic SOAR keeps all three and gives agents the steps that hand-written branches could not cover. The result is an agentic SOC: a security operations center where AI agents work alongside human analysts on the same cases.

How we evaluated these platforms

• Agent model. Whether the platform ships an agent builder, how agents get tools and skills, whether one agent definition works across workflows, cases, and chat, and whether sensitive tool calls can wait for a person's approval.
• Cases and tables. Whether case management and structured tables ship with the platform and in which edition. Whether agents read case context and table rows during an investigation.
• Automation as code and Git. Whether workflows, agents, and case configuration sync in both directions with a repository the customer owns.
• Integrations and customization. What adding an integration takes: a Python package in your own Git repository, a vendor-specific script, or a low-code component.
• Execution engine and scale. How actions run, whether a run survives a crash or a restart, and how the platform handles a burst of alerts.
• Deployment. Whether the customer can run the full control plane or only execution runners, and whether air-gapped deployment has a public guide.
• Open source and free tier. Whether the code is under an OSI-approved license and what a team can run without a contract.
• Pricing transparency. Whether prices are public and whether cases, agents, or AI usage are metered or sold separately.

1. Tracecat: agentic automation platform for security teams

Tracecat is the agentic automation platform for security teams. Agents, workflows, cases, tables, 500+ integrations, and 50+ hosted MCP servers ship in one platform that teams use as a SOAR replacement.

• Agents that work your cases. A Tracecat agent is a reusable preset with versioned skills, tools, and MCP servers. The same preset runs in workflows, chat, and cases. Any tool can wait for a person's approval.
• Driven from your coding assistant. Tracecat MCP exposes more than 100 tools. Your team drives the entire platform through prompts in Claude Code or ChatGPT Codex.
• Automation as code. Tracecat Enterprise syncs workflows, agent presets, skills, table schemas, and case configuration with a GitHub, GitLab, or Bitbucket repository your team owns. A push opens a pull request.
• Custom registry. Integrations are Python packages or YAML templates in your own Git repository, pinned to a commit with promote and rollback. Included in open source.
• Durable execution. Every workflow and agent run is persisted step by step on Temporal. Mixed queues keep fast actions and long-running agents apart. Tracecat is sized for more than 22 million actions a day, with KEDA autoscaling on Kubernetes.
• Self-hosted, air-gapped, or Cloud. Tracecat is built on-prem first. The air-gapped deployment guide covers production Kubernetes, including self-hosted LLM inference. Every feature works air-gapped.
• Case management included. Open source includes cases with comments, attachments, tags, and custom fields. Workflows and agents update the same case record your analysts work in.
• Open source and Enterprise. The AGPL-3.0 edition has unlimited workflows, agents, and cases, plus SSO and audit logs. Enterprise adds multi-tenant workspaces, Git sync, SCIM, managed Cloud, and a forward deployed security engineer.

Best for: Enterprise and AI-native security teams that want to build their own security agents, workflows, and custom cases at production scale, with automation as code in a Git repository they own, self-hosted, air-gapped, or in a SOC 2 Type II Cloud.

2. Cortex XSOAR and AgentiX: Palo Alto Networks SOAR and its successor

Cortex XSOAR is the established enterprise SOAR from Palo Alto Networks. It offers content packs, Python and JavaScript automations, and integrated incident management. XSOAR 8 runs as SaaS or on-prem, with engines that reach remote networks. Its on-prem appliance uses a one- or three-node cluster rather than SaaS autoscaling. For change control, XSOAR supports a remote Git repository for dev and prod environments, plus CI/CD through demisto-sdk.

Palo Alto Networks announced Cortex AgentiX in October 2025 as "the next generation of Cortex XSOAR". Agent features live in AgentiX, not in classic XSOAR. AgentiX shipped first inside Cortex Cloud and Cortex XSIAM and runs as a Cloud tenant. We found no documentation for running AgentiX on-prem and no confirmation that standalone AgentiX is generally available. XSOAR 6.12 and 6.13 on-prem reached end of life on June 30, 2026, but 6.14 remains supported. Palo Alto recommends XSOAR 6 for air-gapped deployments. XSOAR 8 is available on-prem, but its feature comparison marks air-gapped installation and live backup as removed. Customers who want Palo Alto's agentic features face a Cloud path; customers who must stay disconnected remain on the XSOAR 6 line or evaluate another platform. Pricing is not public. See the migration section below.

Best for: Palo Alto Networks shops already on Cortex Cloud or XSIAM that want the content pack library and the AgentiX upgrade path.

3. Torq: out-of-the-box AI SOC operated by the vendor

Torq positions itself as an AI SOC platform. Socrates, its AI analyst, ships system agents such as an Investigator and a Builder. Teams can add custom agents alongside them. AI credits are shared across Socrates, AI Agents, and AI Tasks. Torq includes native case management. Self-hosted step runners on Docker, Kubernetes, or Podman keep private-step execution inside your network. In our assessment, Torq is an opinionated, out-of-the-box AI SOC for teams that want to adopt the vendor's way of running investigation, cases, and response.

The tradeoff is ownership. Torq is less suited to engineering-minded teams that want to build their own security agents, workflows, and custom cases. The control plane, automation logic, and agent definitions stay inside Torq. Runners can self-host, but no customer-hosted control plane is documented. There is no verified model for customer-owned Git. Pricing is not public. We found no free tier.

Best for: Teams that want an out-of-the-box AI SOC operated by the vendor, with self-hosted runners for private execution.

4. Tines: intelligent workflows for security and IT

Tines describes its product as intelligent workflows. Stories, its visual workflow builder, serves security and IT teams. The free edition includes unlimited users, spaces, and connectors, with 3 live workflows and a one-time $50 AI allowance. Paid prices are not public. Tines shipped an MCP server for authoring stories in June 2026.

Tines started in security, but its focus has broadened. It calls 3B "the next generation of Tines", a code-first builder aimed at work across the company. For a security buyer, the packaging also matters. Cases are an add-on for paid plans. The Stories AI agent action is metered by credits. Stories is a Rails application that queues tasks in Redis for Sidekiq workers. It has no native Git sync from the platform; storing stories in Git means adopting a Terraform provider that Tines labels Enterprise. Self-hosting requires a Business or Enterprise edition. The Tracecat vs Tines comparison covers the differences row by row.

Best for: Security and IT teams keeping existing visual Stories workflows.

5. Splunk SOAR: orchestration for the Splunk ecosystem

Splunk SOAR, formerly Phantom and now part of Cisco, provides the Visual Playbook Editor, Python playbooks, Git source control for playbooks, and integrated case management. It deploys in the Cloud, on-prem, or hybrid. The free Community Edition allows 100 actions a day, one tenant, and five open cases.

Since September 2025, Splunk has bundled SOAR into Enterprise Security Premier. The Essentials edition does not include it. Splunk's agentic features, including its AI SOC analyst, run only in Splunk Cloud and need a paired SOAR instance. The AI SOC analyst is limited to Premier. The Splunk MCP Server, generally available since February 2026, exposes Splunk platform data rather than SOAR playbooks. There is no standalone agent builder. The AI features are built to pair with Splunk as your SIEM.

Splunk SOAR Cloud shipped four releases in 2026, about one a quarter. That cadence is slow next to agent skills and MCP, which change month to month. By contrast, Tracecat ships several releases a week, and agent presets, skills, and Tracecat MCP update with them. Splunk SOAR teams planning a move can read the migration section below.

Best for: Splunk Enterprise Security customers that want orchestration and cases from the vendor they already run.

6. Google Security Operations SOAR (formerly Chronicle): SOAR inside Google SecOps

Google Security Operations, formerly Chronicle, includes the SOAR Google gained when it acquired Siemplify in 2022. SOAR is included in every SecOps package: Standard, Enterprise, and Enterprise Plus. Gemini comes with Enterprise and above. The Triage and Investigation Agent requires Enterprise Plus or Google Unified Security and is not FedRAMP compliant. Threat Hunting, Detection Engineering, and Third-Party Context agents entered preview in April 2026. GitSync pushes and pulls playbooks, integrations, and case settings, but its jobs do not open pull requests.

Google SecOps runs only as SaaS on Google Cloud. Remote Agents execute integrations near private systems, but they do not move the control plane. Data is normalized to Google's Unified Data Model (UDM). Agent filters use UDM fields too. Google's Triage and Investigation Agent investigates alerts automatically or on demand and adds findings to cases. It uses Google-provided tools; we found no customer-defined agent builder or skills registry in the reviewed materials. Pricing is not public. Google SecOps teams that want to build their own agents can read the migration section below.

Best for: Enterprises already on Google Security Operations or Google Cloud that want SIEM, cases, and response automation from one Google-managed platform.

7. Swimlane Turbine: low-code security automation

Swimlane Turbine is a low-code security automation platform with integrated case management. Swimlane announced Hero AI agents and an agent builder in January 2026. The agents run as steps inside playbooks. Turbine deploys in the Cloud or on-premises.

Swimlane sells five tiers priced by daily actions, starting at 50,000 actions a day, with Hero AI credits in every tier. Prices are not published. There is no free tier. Swimlane documents a Git integration for versioning low-code components. The logic stays in Swimlane's format rather than in code.

Best for: Enterprise SOCs standardized on low-code playbooks that want on-premises deployment from a commercial vendor.

8. BlinkOps: no-code agentic security operations

BlinkOps combines a no-code agent builder with workflows and cases from one hosted vendor. The control plane is SaaS. Self-hosted runners execute steps in your network and initiate outbound connections only.

There is no public pricing; a BlinkOps blog describes it as usage-based. There is no verified model for customer-owned Git. The no-code definitions live inside the platform.

Best for: Teams that only want a no-code builder and accept automation that stays inside a vendor-hosted platform.

9. Microsoft Sentinel (Logic Apps): playbooks for Sentinel incidents

Microsoft Sentinel's SOAR is Azure Logic Apps. Sentinel playbooks are Logic Apps workflows that run against Sentinel incidents, alerts, and entities. Logic Apps is Azure's general-purpose integration service, with consumption billing per execution. Microsoft notes that "additional charges might apply" for playbooks. Stateless Standard workflows are not supported in Sentinel.

Incidents come from Sentinel itself rather than from a case system in Logic Apps. The Sentinel MCP server is generally available. Sentinel also moves out of the Azure portal after March 31, 2027 and into the Microsoft Defender portal. For anything beyond simple workflows, teams end up building on a general integration service that was not designed around security cases or agents.

Best for: Simple workflows inside Microsoft Sentinel and Defender.

10. CrowdStrike Charlotte Agentic SOAR: Falcon Fusion SOAR with agents

CrowdStrike announced Charlotte Agentic SOAR on November 5, 2025 at Fal.Con Europe, as an agent orchestration layer on top of Falcon Fusion SOAR. The announcement gave no general availability date. AgentWorks is its no-code agent builder.

The Essentials tier has a limited workflow engine with named connectors. The full tier adds Detection Triage and Response agents, premium third-party connectors, and bi-directional MCP. Pricing is credit-based, sold standalone or included with Falcon Next-Gen SIEM, and not published. Charlotte Agentic SOAR runs only in the Falcon Cloud.

Best for: CrowdStrike Falcon customers automating CrowdStrike workflows.

SOAR platforms compared

The matrix below compares the ten ranked platforms on what a buyer checks first. ✕ means the vendor's public pricing and documentation do not offer it. "Not documented" means we could not confirm it from first-party sources in October 2026.

Git sync is where Tracecat's review workflow stands out. Tracecat Enterprise syncs workflows, agent presets, skills, table schemas, and case configuration with a GitHub, GitLab, or Bitbucket repository your team owns. A push can open a pull request. A pull previews and applies a reviewed commit. Custom integrations live in the same kind of repository as Python packages and YAML templates, pinned to a commit with promote and rollback. Google SecOps GitSync also pushes and pulls playbooks, integrations, and case settings, but its jobs commit directly and do not create pull requests. Teams need a separate branch and review flow for protected main. Google's documented sync inventory does not include customer-defined agent presets or skills. Splunk SOAR's source control covers playbooks.

The last table sets the common pattern in SOAR platforms built before agents against Tracecat. Individual products differ, as the entries above note.

Migrating from Cortex XSOAR, Splunk SOAR, or Google SecOps

Legacy SOAR customers face a platform decision in 2026. Cortex XSOAR 6.12 and 6.13 on-prem reached end of life on June 30, 2026; 6.14 remains supported for disconnected deployments. XSOAR 8 has an on-prem upgrade path, but Palo Alto marks air-gapped installation and live backup as removed, and its appliance uses a one- or three-node cluster rather than SaaS autoscaling. AgentiX, which Palo Alto calls the next generation of XSOAR, runs in its Cloud offerings. Teams that need agentic automation on-prem or air-gapped can evaluate Tracecat, which runs agents, workflows, cases, and tables in those deployments. Splunk SOAR and Google SecOps teams face a different limit: agents arrive as vendor features rather than as presets and skills the team builds and owns. Google's Triage and Investigation Agent investigates SIEM alerts, but is not a customer-defined preset with reusable skills.

Migrating to Tracecat is straightforward with prompts and Tracecat MCP. First, export the playbooks from the current platform: YAML playbooks and content from XSOAR, Python playbooks from Splunk SOAR, or playbook JSON from Google SecOps. Then have Claude Code or ChatGPT Codex rebuild the logic as Tracecat workflows, skills, and agent presets through Tracecat MCP. Review and test every rebuilt workflow before enabling it. Migrate playbook by playbook, starting with the highest-volume alert paths.

A migration also adds agents and skills that the old playbooks could not express. For example, our GuardDuty alert post estimates that deterministically mapping every GuardDuty finding type to an owner took about 634 engineer hours before AI, or 21 engineer-weeks. Across the roughly ten detection sources a mid-size team runs, that becomes 6,340 hours. On Tracecat, the same job is one agent, six skills, and a 12-action workflow.

Tracecat helps teams migrate from an existing SOAR at no extra cost. That help is part of the forward deployed security engineer engagement included with Tracecat Enterprise.

Tools we excluded

• AI SOC products. Prophet Security and Dropzone AI sell pre-built AI analysts rather than workflow-first SOAR platforms. Prophet runs agent-driven investigations with "no playbooks" as dedicated single-tenant SaaS. We found no self-hosted option or custom workflow builder. Dropzone's analyst is pre-trained and uses no playbooks. Tuning goes through "Custom Strategies" admin settings. Its documentation says conditional workflows belong in another tool. Both are closed SaaS.
• SIEM-only products. A SIEM that detects but does not run playbooks or track cases is not a SOAR. Google, Splunk, Microsoft, CrowdStrike, and Elastic appear in this article for their automation layers, not their SIEMs.
• Open source projects. Shuffle, StackStorm, DFIR-IRIS, and similar projects are covered in the open source SOAR ranking.

Also considered

Elastic Workflows is the newest entrant. It entered technical preview in Elastic 9.3 and became generally available in Elastic 9.4 on May 5, 2026. Workflows are written in YAML. Steps include ai.agent and cases steps. In practice, a workflow can call an Elastic agent and work with Elastic Security cases. Natural-language authoring is in technical preview. A visual editor is planned but not shipped. Agent Builder exposes an MCP server. Workflows require an Enterprise license or Serverless Complete. They are not part of Elastic's free and open distribution.

Best for: Elastic Security Enterprise customers automating inside Elastic.

These platforms also appear in SOAR evaluations:

• FortiSOAR. Fortinet's SOAR. FortiSOAR 8.0 shipped in September 2026 with AI features Fortinet calls agentic, and new licensing that older licenses do not cover.
• Rapid7 InsightConnect. Rapid7's SOAR. It is still listed, with no announced end of life that we could find.
• IBM QRadar SOAR. IBM sold its QRadar SaaS assets to Palo Alto Networks in 2024, with SaaS customers moving to Cortex XSIAM. IBM still supports on-prem QRadar.
• ServiceNow Security Incident Response. Security incident workflows on the ServiceNow platform, with Now Assist agentic workflows. It fits organizations that already run ServiceNow.
• D3 Security Morpheus. D3 positions Morpheus as an AI SOC platform, including for MSSPs. D3 lists air-gapped deployment but publishes no deployment guide for it. Tracecat's air-gapped guide covers production Kubernetes with no runtime internet access.
• Cyware. Cyware announced agentic AI workflows for Cyware Quarterback AI in November 2025.
• Sumo Logic Cloud SOAR. Sumo Logic announced a SOC Analyst Agent and an MCP server in August 2026.

Choosing a SOAR platform

• AI-native and engineering-minded security teams: Tracecat. Agent presets with skills work your cases, workflows, and chat. The entire platform is driven from Claude Code or ChatGPT Codex, and Enterprise syncs it to a Git repository your team owns.
• Full self-hosting and air-gapped networks: Tracecat. You run the entire control plane, not only execution runners. Every feature works air-gapped, and the air-gapped deployment guide covers production Kubernetes.
• MSSPs: Tracecat Enterprise. Multi-tenant workspaces separate clients, with custom roles, SCIM, service accounts, and per-tenant Git sync.
• Palo Alto Networks shops: Cortex XSOAR and AgentiX. This fits SOCs already on Cortex Cloud or XSIAM. XSOAR 8 also runs on-prem, but its appliance uses fixed one- or three-node deployments and does not support air-gapped installation; AgentiX runs as a Cloud tenant, with no on-prem deployment documented. Teams that need agentic automation on-prem or air-gapped can move to Tracecat.
• Splunk Enterprise Security customers: Splunk SOAR. It comes bundled with Enterprise Security Premier. Its agentic features need Splunk Cloud.
• Google Security Operations customers: Google SecOps SOAR, if your investigations use Google's data model and Google-provided agents rather than customer-defined presets and skills.
• Microsoft Sentinel customers: Microsoft Sentinel (Logic Apps), for simple workflows on Sentinel incidents. Budget for Logic Apps execution charges on top of Sentinel.
• CrowdStrike Falcon customers: Charlotte Agentic SOAR, to automate CrowdStrike workflows inside Falcon. Agents and bi-directional MCP sit in the full tier.
• A vendor-operated AI SOC: Torq. If your team prefers an out-of-the-box AI SOC over building its own, Torq is the hosted alternative.