# SOAR platforms for enterprise buyers: what AI models recommend, September 2026 IT AI Recommendation Index, September 2026 Edition. Asked as "SOAR platform" and as "security orchestration and automated response tool", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://it-ai-index.com/security/soar-platforms/enterprise/ **Standing:** Cortex XSOAR leads with 40% of first choices; verdict contested. 43 first choices across the direct, paraphrase, budget and scale prompts. ## First-choice share | # | Product | Share | Negative rate | Labels | |---|---|---|---|---| | 1 | Cortex XSOAR | 40% | 22% | 54 | | 2 | Splunk SOAR | 12% | 25% | 55 | | 3 | Swimlane | 9% | 4% | 28 | | 4 | Swimlane Turbine | 9% | 13% | 15 | | 5 | Tines | 7% | 7% | 29 | | 6 | IBM QRadar SOAR | 5% | 15% | 33 | | 7 | Microsoft Sentinel | 5% | 8% | 26 | | 8 | D3 Security Smart SOAR | 5% | 0% | 15 | | 9 | Google Security Operations SOAR | 5% | 25% | 16 | | 10 | Torq | 2% | 4% | 23 | | 11 | FortiSOAR | 2% | 20% | 15 | ## Each model's first choice on the direct prompt - Claude Haiku 4.5: no first choice - GPT-5.4 mini: Cortex XSOAR, Microsoft Sentinel; alternatives Splunk SOAR - Gemini 3.5 Flash: Tines, Torq; alternatives Cortex XSOAR, D3 Security Smart SOAR, Prophet Security, Simbian - Perplexity Sonar: Cortex XSOAR; alternatives IBM QRadar SOAR, Splunk SOAR, Swimlane - Grok 4.1 Fast: Cortex XSOAR; alternatives FortiSOAR - Mistral Small: Splunk SOAR, Swimlane; alternatives Cortex XSOAR, Tines, Torq - DeepSeek V4 Flash: Cortex XSOAR; alternatives D3 Security Smart SOAR, Splunk SOAR, Swimlane, Tines - Llama 4 Maverick: no first choice - Qwen 3.7 Flash: Cortex XSOAR, Swimlane; alternatives Microsoft Sentinel, Splunk SOAR - Kimi K2: Cortex XSOAR, Splunk SOAR; alternatives IBM QRadar SOAR, Microsoft Sentinel, Swimlane - GLM 4.7 FlashX: no first choice - MiniMax M2.5: Swimlane; alternatives Cortex XSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR ## Sources the answers cite 66 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers: - expertinsights.com: 37 answers, 38 citations - gartner.com: 34 answers, 50 citations - strike48.com: 33 answers, 44 citations - paloaltonetworks.com: 29 answers, 32 citations - blinkops.com: 27 answers, 27 citations - exabeam.com: 25 answers, 30 citations - simbian.ai: 20 answers, 21 citations - aimultiple.com: 19 answers, 21 citations Pages named in the most answers: - https://expertinsights.com/network-security/the-top-soar-solutions (35 answers) - https://gartner.com/reviews/market/security-orchestration-automation-and-response-solutions (33 answers) - https://paloaltonetworks.com/cyberpedia/soar-tools-comparison (28 answers) - https://strike48.com/post/top-soar-platforms (28 answers) - https://blinkops.com/blog/soar-platforms (26 answers) - https://aimultiple.com/top-soar-platforms (19 answers) - https://guideflow.com/blog/soar-software (18 answers) - https://exabeam.com/explainers/soar/best-soar-platforms-for-enterprises-top-5-options (17 answers) - https://simbian.ai/blog/top-5-soar-platforms-2026 (16 answers) - https://checkthat.ai/answers/what-are-the-best-soar-tools-available (15 answers) ## Warned against - Splunk SOAR: 14 of 55 labels negative. "Platforms to Avoid for Your Use Case | Splunk SOAR | Primarily per-seat licensing; adding thousands of users is extremely costly." (Qwen 3.7 Flash, budget prompt) - Cortex XSOAR: 12 of 54 labels negative. "Platforms to Avoid... Cortex XSOAR | Quote-based, tied to broader Palo Alto Cortex commitments" (Kimi K2, budget prompt) - IBM QRadar SOAR: 5 of 33 labels negative. "Avoid | Starting new implementations on sunset/legacy platforms (QRadar SOAR, traditional static-playbook SOAR)" (Kimi K2, negative prompt) - Google Security Operations SOAR: 4 of 16 labels negative. "unless your enterprise is fully committed to the Google Cloud/Chronicle ecosystem, adopting Google SecOps as a standalone SOAR adds unnecessary friction and architectural lock-in" (Gemini 3.5 Flash, negative prompt) ## Record - Method: https://it-ai-index.com/methodology/ - Raw judge labels and full responses: https://it-ai-index.com/data/ - License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.