IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index › Security operations › September 2026 Edition

SOAR platforms

Asked as “SOAR platform”, and as “security orchestration and automated response tool”, on behalf of a mid-market B2B company. 47 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Tines
Clear leader
47% of first choices, clear leader.
ShowinginAll 67 categories in the September 2026 Edition →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessTines49%Clear leaderStanding →Mid-marketTines47%Clear leaderThis pageEnterpriseCortex XSOAR40%ContestedStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Tines47%0%48endorsed leader
02Rapid7 InsightConnect15%8%25accepted challenger
03Shuffle11%0%10accepted challenger
04Torq4%10%29accepted challenger
05Swimlane Turbine4%0%14accepted challenger
06Microsoft Sentinel2%11%28accepted challenger
07FortiSOAR2%6%18accepted challenger
08Cortex XSOAR2%47%47criticized challenger
09Splunk SOAR2%43%54criticized challenger
Show the three products at 0%, ordered by negative rate
12Google Security Operations SOAR0%29%14criticized challenger
11IBM QRadar SOAR0%25%20criticized challenger
10Swimlane0%11%18accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.
Head to head
Tines vs Rapid7 InsightConnectTines vs ShuffleRapid7 InsightConnect vs Shuffle

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
12
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative60%
Key
01Tines47%
02Rapid7 InsightConnect15%
03Shuffle11%
04Torq4%
05Swimlane Turbine4%
06Microsoft Sentinel2%
07FortiSOAR2%
08Cortex XSOAR2%
09Splunk SOAR2%
10Swimlane0%
11IBM QRadar SOAR0%
12Google Security Operations SOAR0%

02What they warned about

Two of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Splunk SOAR
43%
23 of 54 labels negative · 11 of 12 models · 2 hard negative
“Acquired, not native; integration with Splunk ES is described as "hacky" and problematic” Kimi K2, negative prompt
Cortex XSOAR
47%
22 of 47 labels negative · 10 of 12 models · 4 hard negative
“What to Avoid for a Mid-Size B2B Company - **Palo Alto Cortex XSOAR** — Excellent but enterprise/multi-team focused, with premium pricing” DeepSeek V4 Flash, paraphrase prompt
IBM QRadar SOAR
25%
5 of 20 labels negative · 5 of 12 models · 3 hard negative
“This is arguably the biggest "avoid" right now, primarily due to **lifecycle/roadmap risk**” DeepSeek V4 Flash, negative prompt
Google Security Operations SOAR
29%
4 of 14 labels negative · 4 of 12 models
“**High vendor lock-in**. Bundled SOAR platforms naturally optimize for their parent vendor's ecosystem.” Gemini 3.5 Flash, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

65 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 869 links across 163 sites, every framing counted. Ranked by the number of answers carrying the site or page.

paloaltonetworks.com
vendor site · Palo Alto Networks39 answers · 45 citations · 11 models
blinkops.com
vendor site · BlinkOps31 answers · 33 citations · 9 models
gartner.com
30 answers · 44 citations · 11 models
expertinsights.com
vendor site · Expert Insights21 answers · 21 citations · 10 models
strike48.com
vendor site · Strike4819 answers · 21 citations · 8 models
comparitech.com
18 answers · 18 citations · 8 models
eastbaycyber.com
17 answers · 17 citations · 9 models
aimultiple.com
16 answers · 18 citations · 8 models
checkthat.ai
15 answers · 16 citations · 8 models
solutionsreview.com
15 answers · 15 citations · 8 models
swimlane.com
vendor site · Swimlane14 answers · 24 citations · 8 models
getapp.com
14 answers · 19 citations · 8 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

paloaltonetworks.com/cyberpedia/soar-tools-comparison
37 answers · 11 models
gartner.com/reviews/market/security-orchestration-automation-and-response-s…
29 answers · 10 models
blinkops.com/blog/soar-platforms
28 answers · 9 models
expertinsights.com/network-security/the-top-soar-solutions
20 answers · 10 models
comparitech.com/net-admin/best-soar-software
18 answers · 8 models
eastbaycyber.com/content/compare-best-soar-platforms-compared-2026
17 answers · 9 models
strike48.com/post/top-soar-platforms
15 answers · 7 models
aimultiple.com/top-soar-platforms
14 answers · 8 models
getapp.com/all-software/security-orchestration-automation-and-response-soar…
13 answers · 8 models
simbian.ai/blog/top-5-soar-platforms-2026
13 answers · 8 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best SOAR platform for a mid-market B2B company?”Paraphrase“Which security orchestration and automated response tool would you recommend to a mid-sized B2B company?”Comparative“What are the top SOAR platforms and how do they differ?”Budget-constrained“What is the best SOAR platform for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a SOAR platform. What should we look at?”Negative“Which SOAR platforms should I avoid or be cautious about?”
Claude Haiku 4.5Rapid7 InsightConnect, Swimlane Turbine
Six alternativesCortex XSOAR, Google Security Operations SOAR, Microsoft Sentinel, Splunk SOAR, Tines, Torq
FortiSOARChanged
Two alternativesSplunk SOAR, Swimlane Turbine
Cortex XSOAR
Four alternativesMicrosoft Sentinel, Swimlane Turbine, Tines, Torq
Cortex XSOAR, Shuffleno first choicenothing named
GPT-5.4 miniSwimlane Turbine
One alternativeMicrosoft Sentinel
against: Cortex XSOAR, Splunk SOARMicrosoft SentinelChanged
One alternativeSplunk SOAR
Cortex XSOAR
Six alternativesFortiSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR, Swimlane, Tines
TheHive + Cortex
Two alternativesShuffle, Tines
against: Splunk SOARno first choicenothing named
Gemini 3.5 FlashTines
Four alternativesBlinkOps, Microsoft Sentinel, Swimlane Turbine, Torq
against: Cortex XSOAR, Splunk SOARTines, TorqChanged
Three alternativesMicrosoft Sentinel, Rapid7 InsightConnect, Swimlane Turbine
against: Cortex XSOAR, Splunk SOARTines, Torq
Seven alternativesBlinkOps, Cortex XSOAR, IBM QRadar SOAR, Prophet Security, Simbian, Splunk SOAR, Swimlane Turbine
Tines
Three alternativesLimaCharlie, Shuffle, Tracecat
against: Cortex XSOAR, Splunk SOAR, Torq, n8nTines
Seven alternativesFortiSOAR, Microsoft Sentinel, Prophet Security, Simbian, Strike48, Swimlane Turbine, Torq
against: Cortex XSOAR, Splunk SOARagainst: Cortex XSOAR, FortiSOAR, Google Security Operations SOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR
Perplexity SonarTines
Three alternativesCortex XSOAR, Splunk SOAR, Swimlane
Rapid7 InsightConnectChanged
Five alternativesCortex XSOAR, Microsoft Sentinel, Splunk SOAR, Tines, Torq
no first choiceManageEngine Log360, Tines
One alternativeShuffle + IRIS
no first choiceagainst: Cortex XSOAR, Exabeam Incident Responder, IBM QRadar SOAR, Rapid7 InsightConnect, Securonix SOAR, Splunk SOAR
Grok 4.1 FastTines
Four alternativesMicrosoft Sentinel, Rapid7 InsightConnect, Swimlane Turbine, Torq
against: Cortex XSOAR, Splunk SOARRapid7 InsightConnectChanged
Four alternativesCortex XSOAR, Microsoft Sentinel, Tines, Torq
Cortex XSOAR
Four alternativesSplunk SOAR, Swimlane, Tines, Torq
Shuffle, Tines
One alternativeManageEngine Log360
against: Cortex XSOAR, Splunk SOAR, TheHive + Cortex Analyzer, Torqno first choiceagainst: Cortex XSOAR, D3 Security Smart SOAR, ManageEngine Log360, Splunk SOAR, Swimlane
Mistral SmallRapid7 InsightConnect, Tines
Two alternativesFortiSOAR, Swimlane
DTonomyChanged
Two alternativesCortex XSOAR, D3 Morpheus
Cortex XSOAR
Five alternativesD3 Security Smart SOAR, IBM QRadar SOAR, Splunk SOAR, Swimlane, Tines
Shuffle, Tracecat
One alternativen8n
against: Splunk SOARno first choiceagainst: Azure Logic Apps, Cortex XSOAR, Splunk SOAR
DeepSeek V4 FlashRapid7 InsightConnect, Tines
One alternativeSwimlane Turbine
against: Cortex XSOARTinesChanged
Three alternativesRapid7 InsightConnect, Splunk SOAR, Swimlane Turbine
against: Cortex XSOARCortex XSOAR
Eight alternativesCyware, D3 Security Smart SOAR, FortiSOAR, Google Security Operations SOAR, IBM QRadar SOAR, Splunk SOAR, Swimlane, Tines
Shuffle
Two alternativesTines, Tracecat
Tines, Torq
Two alternativesMicrosoft Sentinel, Splunk SOAR
against: Cortex XSOAR, IBM QRadar SOAR, LogRhythm, Splunk SOAR
Llama 4 MaverickTines
Three alternativesFortiSOAR, Rapid7 InsightConnect, Splunk SOAR
no first choiceChangedno first choiceWazuh
One alternativeCortex XSOAR
against: Google Security Operations SOAR, Splunk SOARno first choiceagainst: Exabeam Incident Responder, Rapid7 InsightConnect, Securonix SOAR
Qwen 3.7 FlashTines
Two alternativesFortiSOAR, Rapid7 InsightConnect
against: Splunk SOARRapid7 InsightConnectChanged
Three alternativesGoogle Security Operations SOAR, ORNA, Swimlane Turbine
Cortex XSOAR
Five alternativesDevo SOAR, FortiSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR
Tines
Four alternativesMicrosoft Defender, Microsoft Sentinel, Shuffle, Swimlane
against: Palo Alto Networks Cortex Cloud, Splunk SOARno first choiceagainst: Azure Logic Apps, Cortex XSOAR, Splunk SOAR
Kimi K2Tines
One alternativeRapid7 InsightConnect
against: Cortex XSOAR, Google Security Operations SOAR, Microsoft Sentinel, Splunk SOAR, TorqTinesHeld
One alternativeRapid7 InsightConnect
against: Cortex XSOAR, Splunk SOARCortex XSOAR
Four alternativesIBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR, Tines
Shuffle
Three alternativesTheHive, Tines, Tracecat
no first choice
Five alternativesMicrosoft Sentinel, Rapid7 InsightConnect, Splunk SOAR, Tines, Torq
against: Cortex XSOARagainst: Cortex XSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR
GLM 4.7 FlashXTines
Three alternativesFortiSOAR, Rapid7 InsightConnect, Torq
against: Cortex XSOAR, Splunk SOARTinesHeld
One alternativeCortex XSOAR
Cortex XSOAR
Nine alternativesCyware, Devo SOAR, FortiSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR, Swimlane Turbine, Tines, Torq
Splunk SOAR, Tines
One alternativeShuffle
against: Swimlaneno first choiceagainst: Cortex XSOAR, IBM QRadar SOAR
MiniMax M2.5Rapid7 InsightConnect, Tines
Two alternativesFortiSOAR, Swimlane
no first choiceChangedCortex XSOAR
Six alternativesFortiSOAR, Google Security Operations SOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR, Tines
Tines
Three alternativesMicrosoft Sentinel, Rapid7 InsightConnect, Shuffle
no first choiceagainst: Cortex XSOAR, Google Security Operations SOAR, ManageEngine Log360, Splunk SOAR
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:16yes1210 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:46yes55 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:39yes1328 s
Direct recommendationPerplexity Sonarsonar2026-09-17 11:52yes207 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:42yes3619 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 12:28yes55 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:47yes1618 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:13yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:28yes527 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:30yes2537 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:41yes1644 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:29yes1342 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:58yes169 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:28yes24 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:42yes1827 s
ParaphrasePerplexity Sonarsonar2026-09-17 10:32yes204 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:16yes3519 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 14:11yes55 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:18yes1623 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:07yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:29yes941 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 14:13yes1824 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:07yes2966 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:36yes545 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:29yes99 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:08yes612 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 10:20yes1429 s
ComparativePerplexity Sonarsonar2026-09-17 11:08yes208 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:20yes1713 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 12:50yes57 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:27yes2063 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:43yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:08yes526 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:32yes1734 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:57yes22102 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:44yes1344 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:07yes05 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:38yes612 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:55yes1022 s
Budget constrainedPerplexity Sonarsonar2026-09-17 10:57yes204 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:49yes3918 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 13:46yes97 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:22yes2017 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:32yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:17no042 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:31yes2050 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:42yes25148 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:28yes515 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:28no06 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:28no010 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:44yes1024 s
Scale constrainedPerplexity Sonarsonar2026-09-17 10:49yes208 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:26yes1911 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 11:22no07 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:07yes1623 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:43yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 14:09no033 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:02yes1030 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:38yes13101 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:23yes527 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:32no04 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:53yes47 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 10:56yes1418 s
Negative framingPerplexity Sonarsonar2026-09-17 13:21yes209 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:45yes4720 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 11:48yes56 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:02yes2822 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:25yes54 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:01yes548 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:42yes2935 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:46yes1523 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 14:05yes1749 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
D3 Security read as D3 Security Smart SOAR
Google SecOps read as Google Security Operations SOAR
Google SecOps / Chronicle read as Google Security Operations SOAR
IBM read as IBM QRadar SOAR
Palo Alto Cortex XSOAR read as Cortex XSOAR
Palo Alto Networks Cortex XSOAR read as Cortex XSOAR
Palo Alto Networks Cortex XSOAR (formerly Demisto) read as Cortex XSOAR
Splunk read as Splunk SOAR
Unresolved, counted raw
Admyral
DTonomy
OpenSOAR
SOARCA
Shuffle + IRIS
Splunk Phantom/XSCAL
TheHive + Cortex Analyzer
Discontinued, still offered
No shut-down product was recommended here.

Also in security operations

The other categories of this function, with the leader in each.
← SIEMTPRM →