IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index › Security operations › SOAR › Enterprise › September 2026 Edition

SOAR platforms for enterprise buyers

Asked as “SOAR platform”, and as “security orchestration and automated response tool”, on behalf of an enterprise B2B company. 43 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Cortex XSOAR
Contested
40% of first choices, contested.
ShowinginAll 67 categories in the September 2026 Edition →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessTines49%Clear leaderStanding →Mid-marketTines47%Clear leaderStanding →EnterpriseCortex XSOAR40%ContestedThis page

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Cortex XSOAR40%22%54endorsed leader
02Splunk SOAR12%25%55criticized challenger
03Swimlane9%4%28accepted challenger
04Swimlane Turbine9%13%15accepted challenger
05Tines7%7%29accepted challenger
06IBM QRadar SOAR5%15%33accepted challenger
07Microsoft Sentinel5%8%26accepted challenger
08D3 Security Smart SOAR5%0%15accepted challenger
09Google Security Operations SOAR5%25%16criticized challenger
10Torq2%4%23accepted challenger
11FortiSOAR2%20%15accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.
Head to head
Tines vs Rapid7 InsightConnectTines vs ShuffleRapid7 InsightConnect vs Shuffle

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Cortex XSOAR40%
02Splunk SOAR12%
03Swimlane9%
04Swimlane Turbine9%
05Tines7%
06IBM QRadar SOAR5%
07Microsoft Sentinel5%
08D3 Security Smart SOAR5%
09Google Security Operations SOAR5%
10Torq2%
11FortiSOAR2%

02What they warned about

Four of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Mistral Small, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2 and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Splunk SOAR
25%
14 of 55 labels negative · 10 of 12 models · 3 hard negative
“Platforms to Avoid for Your Use Case | **Splunk SOAR** | Primarily **per-seat** licensing; adding thousands of users is extremely costly.” Qwen 3.7 Flash, budget prompt
Cortex XSOAR
22%
12 of 54 labels negative · 8 of 12 models · 3 hard negative
“Platforms to Avoid... **Cortex XSOAR** | Quote-based, tied to broader Palo Alto Cortex commitments” Kimi K2, budget prompt
IBM QRadar SOAR
15%
5 of 33 labels negative · 5 of 12 models · 3 hard negative
“**Avoid** | Starting new implementations on sunset/legacy platforms (QRadar SOAR, traditional static-playbook SOAR)” Kimi K2, negative prompt
Google Security Operations SOAR
25%
4 of 16 labels negative · 4 of 12 models
“unless your enterprise is fully committed to the Google Cloud/Chronicle ecosystem, adopting Google SecOps as a standalone SOAR adds unnecessary friction and architectural lock-in” Gemini 3.5 Flash, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

66 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 906 links across 184 sites, every framing counted. Ranked by the number of answers carrying the site or page.

expertinsights.com
vendor site · Expert Insights37 answers · 38 citations · 10 models
gartner.com
34 answers · 50 citations · 11 models
strike48.com
vendor site · Strike4833 answers · 44 citations · 10 models
paloaltonetworks.com
vendor site · Palo Alto Networks29 answers · 32 citations · 9 models
blinkops.com
vendor site · BlinkOps27 answers · 27 citations · 10 models
exabeam.com
vendor site · Exabeam25 answers · 30 citations · 9 models
simbian.ai
vendor site · Simbian20 answers · 21 citations · 8 models
aimultiple.com
19 answers · 21 citations · 9 models
guideflow.com
vendor site · Guideflow18 answers · 18 citations · 8 models
checkthat.ai
17 answers · 18 citations · 8 models
prophetsecurity.ai
vendor site · Prophet Security14 answers · 17 citations · 8 models
guptadeepak.com
14 answers · 14 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

expertinsights.com/network-security/the-top-soar-solutions
35 answers · 10 models
gartner.com/reviews/market/security-orchestration-automation-and-response-s…
33 answers · 10 models
paloaltonetworks.com/cyberpedia/soar-tools-comparison
28 answers · 8 models
strike48.com/post/top-soar-platforms
28 answers · 10 models
blinkops.com/blog/soar-platforms
26 answers · 9 models
aimultiple.com/top-soar-platforms
19 answers · 9 models
guideflow.com/blog/soar-software
18 answers · 8 models
exabeam.com/explainers/soar/best-soar-platforms-for-enterprises-top-5-options
17 answers · 8 models
simbian.ai/blog/top-5-soar-platforms-2026
16 answers · 8 models
checkthat.ai/answers/what-are-the-best-soar-tools-available
15 answers · 8 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best SOAR platform for an enterprise B2B company?”Paraphrase“Which security orchestration and automated response tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade SOAR platforms and how do they differ?”Budget-constrained“What is the best SOAR platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a SOAR platform. What should we look at?”Negative“Which SOAR platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceCortex XSOARChanged
Three alternativesMicrosoft Sentinel, Splunk SOAR, Swimlane
Cortex XSOAR
Five alternativesIBM QRadar SOAR, Rapid7 InsightConnect, Splunk SOAR, Swimlane, Torq
IBM QRadar SOAR
One alternativeManageEngine Log360
no first choiceagainst: ArcSight SOAR, Shuffle, StackStorm, Strike48, TheHive with Cortex
GPT-5.4 miniCortex XSOAR, Microsoft Sentinel
One alternativeSplunk SOAR
Microsoft SentinelChanged
Two alternativesIBM QRadar SOAR, Splunk SOAR
Cortex XSOAR
Five alternativesIBM QRadar SOAR, Microsoft Sentinel, ServiceNow Security Incident Response / Security Operations, Splunk SOAR, Swimlane Turbine
Splunk SOAR
One alternativeCortex XSOAR
no first choiceagainst: IBM QRadar SOAR, Rapid7 InsightConnect
Gemini 3.5 FlashTines, Torq
Six alternativesCortex XSOAR, D3 Security Smart SOAR, Prophet Security, Simbian, Splunk SOAR, Swimlane Turbine
Cortex XSOAR, TinesChanged
Three alternativesMicrosoft Sentinel, Splunk SOAR, Torq
no first choice
Six alternativesCortex XSOAR, D3 Security Smart SOAR, Splunk SOAR, Swimlane Turbine, Tines, Torq
Tines
Three alternativesIBM QRadar SOAR, Securonix SOAR, Swimlane Turbine
no first choiceagainst: Cortex XSOAR, FortiSOAR, Google Security Operations SOAR, Rapid7 InsightConnect, ServiceNow Security Operations (SecOps) / Security Incident Response, Shuffle, Splunk SOAR, StackStorm, Walkoff
Perplexity SonarCortex XSOAR
Three alternativesIBM QRadar SOAR, Splunk SOAR, Swimlane
Cortex XSOARHeld
Three alternativesIBM QRadar SOAR, Splunk SOAR, Swimlane Turbine
Cortex XSOAR
Seven alternativesCyware, IBM QRadar SOAR, Microsoft Sentinel + Logic Apps, Splunk SOAR, Swimlane, Tines, Torq
Google Security Operations SOAR
Two alternativesCortex XSOAR, IBM QRadar SOAR
no first choiceagainst: Cortex XSOAR, IBM QRadar SOAR, Splunk SOAR
Grok 4.1 FastCortex XSOAR
One alternativeFortiSOAR
Cortex XSOARHeld
Four alternativesIBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR, Swimlane
Cortex XSOAR
Six alternativesFortiSOAR, IBM QRadar SOAR, ServiceNow Security Incident Response, Splunk SOAR, Swimlane, Torq
D3 Security Smart SOAR, IBM QRadar SOARagainst: Azure Logic Apps, Cortex XSOAR, Google Security Operations SOAR, Microsoft Sentinel, Splunk SOAR, Swimlane Turbineno first choice
Three alternativesCortex XSOAR, Swimlane, Tines
against: Cortex XSOAR, FortiSOAR, Splunk SOAR, Swimlane
Mistral SmallSplunk SOAR, Swimlane
Three alternativesCortex XSOAR, Tines, Torq
Cortex XSOARChanged
Four alternativesIBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR, TheHive
Cortex XSOAR
Four alternativesFortiSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR
D3 Security Smart SOAR
Two alternativesGoogle Security Operations SOAR, Swimlane
no first choiceagainst: Azure Logic Apps, Splunk SOAR
DeepSeek V4 FlashCortex XSOAR
Four alternativesD3 Security Smart SOAR, Splunk SOAR, Swimlane, Tines
Cortex XSOARHeld
Four alternativesIBM QRadar SOAR, Splunk SOAR, Swimlane Turbine, Tines
Cortex XSOAR
Seven alternativesFortiSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR, Swimlane, Tines, Torq
Swimlane Turbine
Three alternativesD3 Morpheus, D3 Security Smart SOAR, Google Security Operations SOAR
against: Cortex XSOAR, Cyware, Splunk SOARno first choice
Two alternativesMicrosoft Sentinel, Splunk SOAR
against: Cortex XSOAR, IBM QRadar SOAR, LogRhythm, RSA NetWitness SOAR, Splunk SOAR, Tufin
Llama 4 Maverickno first choiceCortex XSOARChangedCortex XSOAR
Six alternativesFortiSOAR, IBM QRadar SOAR, Microsoft Sentinel, Rapid7 InsightConnect, Splunk SOAR, Tines
no first choiceno first choiceagainst: Cortex XSOAR, Splunk SOAR, Swimlane Turbine
Qwen 3.7 FlashCortex XSOAR, Swimlane
Two alternativesMicrosoft Sentinel, Splunk SOAR
Cortex XSOARChanged
Three alternativesServiceNow Security Operations, Splunk SOAR, Swimlane
Cortex XSOAR
Four alternativesIBM QRadar SOAR, Microsoft Sentinel, Rapid7 InsightConnect, Splunk SecOps Platform
Swimlane Turbine
One alternativeD3 Morpheus
against: Cortex XSOAR, IBM QRadar SOAR, Splunk SOAR, Tinesno first choiceagainst: Cortex XSOAR, Splunk SOAR
Kimi K2Cortex XSOAR, Splunk SOAR
Three alternativesIBM QRadar SOAR, Microsoft Sentinel, Swimlane
Cortex XSOARChanged
Three alternativesIBM QRadar SOAR, Splunk SOAR, Swimlane
Cortex XSOAR
Eight alternativesFortiSOAR, Google Security Operations SOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR, Swimlane Turbine, Tines, Torq
Swimlane Turbine
One alternativeD3 Security Smart SOAR
against: Cortex XSOAR, Splunk SOAR, Tines, TorqCortex XSOAR, Splunk SOAR, Swimlane Turbine
Two alternativesTines, Torq
against: Cortex XSOAR, FortiSOAR, Google Security Operations SOAR, IBM QRadar SOAR, Microsoft Sentinel, Shuffle, Splunk SOAR, TheHive
GLM 4.7 FlashXno first choiceno first choiceHeldCortex XSOAR
Nine alternativesD3 Security Smart SOAR, FortiSOAR, Google Security Operations SOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR, Swimlane Turbine, Tines, Torq
against: SimbianGoogle Security Operations SOAR, Splunk SOAR
Two alternativesFortiSOAR, ServiceNow Security Operations
no first choiceagainst: Splunk SOAR
MiniMax M2.5Swimlane
Four alternativesCortex XSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR
Cortex XSOARChanged
Three alternativesExabeam Incident Responder, Google Security Operations SOAR, Swimlane
Splunk SOAR
Five alternativesCortex XSOAR, IBM QRadar SOAR, ServiceNow Security Operations, Swimlane, Tines
against: Google Security Operations SOARFortiSOAR, Swimlaneno first choiceagainst: Cortex XSOAR, Exabeam Incident Responder, Splunk SOAR
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:11no04 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:37yes35 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:03yes1824 s
Direct recommendationPerplexity Sonarsonar2026-09-17 12:49yes205 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 11:48yes3115 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 12:48yes1112 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:49yes620 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:31yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:42yes553 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:36yes1329 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:21yes10130 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:31yes533 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:22yes910 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:56yes35 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:25yes919 s
ParaphrasePerplexity Sonarsonar2026-09-17 09:53yes205 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:13yes2512 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 13:57yes56 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:24yes1229 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:44yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:51yes532 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:41yes1024 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:58yes10653 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:57yes518 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 09:55yes1512 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:37yes913 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:13yes2026 s
ComparativePerplexity Sonarsonar2026-09-17 12:55yes2010 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:05yes2719 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 11:17yes1814 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:04yes1520 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:30yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:12no043 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:20yes1450 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:52yes16286 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 09:30yes520 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:19yes1312 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:53yes37 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 10:32yes1429 s
Budget constrainedPerplexity Sonarsonar2026-09-17 13:19yes208 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:32yes3922 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 11:30yes86 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:54yes2628 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:23yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:37yes2285 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:29yes2544 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:39yes1355 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 09:37yes1759 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:20yes1711 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:30no011 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:09yes1226 s
Scale constrainedPerplexity Sonarsonar2026-09-17 11:27yes2011 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:33yes1912 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 12:18no08 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 09:37yes2529 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:10yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:17no042 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:12yes1541 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:53yes28494 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:23no058 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:49yes3514 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:59yes710 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:55yes1625 s
Negative framingPerplexity Sonarsonar2026-09-17 11:59yes197 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:43yes4520 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 09:50yes55 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:46yes3446 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 10:45yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:01yes1055 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:33yes3048 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:55yes15112 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:17yes1951 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
D3 read as D3 Security Smart SOAR
D3 Security read as D3 Security Smart SOAR
D3 Security (Morpheus) read as D3 Security Smart SOAR
D3 Security (Morpheus/Smart SOAR) read as D3 Security Smart SOAR
Exabeam read as Exabeam Incident Responder
Google SecOps read as Google Security Operations SOAR
Google SecOps (SOAR) read as Google Security Operations SOAR
Google SecOps (post-Siemplify) read as Google Security Operations SOAR
Google Security Operations (SecOps SOAR) read as Google Security Operations SOAR
Palo Alto Cortex XSOAR read as Cortex XSOAR
Palo Alto Networks Cortex XSOAR read as Cortex XSOAR
Rapid7 read as Rapid7 InsightConnect
Splunk read as Splunk SOAR
Unresolved, counted raw
Ciphers Security
Intezer
Prophet
RSA NetWitness SOAR
ServiceNow Security Incident Response / Security Operations
ServiceNow Security Operations (SecOps) / Security Incident Response (SIR)
Splunk SecOps Platform
Tufin
Walkoff
Discontinued, still offered
No shut-down product was recommended here.

Also in security operations

The other categories of this function, with the leader in each.
← SIEMTPRM →