# SOAR platforms: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "SOAR platform" and as "security orchestration and automated response tool", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://it-ai-index.com/security/soar-platforms/

**Standing:** Tines leads with 47% of first choices; verdict clear leader. 47 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Tines | 47% | 0% | 48 |
| 2 | Rapid7 InsightConnect | 15% | 8% | 25 |
| 3 | Shuffle | 11% | 0% | 10 |
| 4 | Torq | 4% | 10% | 29 |
| 5 | Swimlane Turbine | 4% | 0% | 14 |
| 6 | Microsoft Sentinel | 2% | 11% | 28 |
| 7 | FortiSOAR | 2% | 6% | 18 |
| 8 | Cortex XSOAR | 2% | 47% | 47 |
| 9 | Splunk SOAR | 2% | 43% | 54 |
| 10 | Swimlane | 0% | 11% | 18 |
| 11 | IBM QRadar SOAR | 0% | 25% | 20 |
| 12 | Google Security Operations SOAR | 0% | 29% | 14 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Rapid7 InsightConnect, Swimlane Turbine; alternatives Cortex XSOAR, Google Security Operations SOAR, Microsoft Sentinel, Splunk SOAR
- GPT-5.4 mini: Swimlane Turbine; alternatives Microsoft Sentinel
- Gemini 3.5 Flash: Tines; alternatives BlinkOps, Microsoft Sentinel, Swimlane Turbine, Torq
- Perplexity Sonar: Tines; alternatives Cortex XSOAR, Splunk SOAR, Swimlane
- Grok 4.1 Fast: Tines; alternatives Microsoft Sentinel, Rapid7 InsightConnect, Swimlane Turbine, Torq
- Mistral Small: Rapid7 InsightConnect, Tines; alternatives FortiSOAR, Swimlane
- DeepSeek V4 Flash: Rapid7 InsightConnect, Tines; alternatives Swimlane Turbine
- Llama 4 Maverick: Tines; alternatives FortiSOAR, Rapid7 InsightConnect, Splunk SOAR
- Qwen 3.7 Flash: Tines; alternatives FortiSOAR, Rapid7 InsightConnect
- Kimi K2: Tines; alternatives Rapid7 InsightConnect
- GLM 4.7 FlashX: Tines; alternatives FortiSOAR, Rapid7 InsightConnect, Torq
- MiniMax M2.5: Rapid7 InsightConnect, Tines; alternatives FortiSOAR, Swimlane

## Sources the answers cite

65 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- paloaltonetworks.com: 39 answers, 45 citations
- blinkops.com: 31 answers, 33 citations
- gartner.com: 30 answers, 44 citations
- expertinsights.com: 21 answers, 21 citations
- strike48.com: 19 answers, 21 citations
- comparitech.com: 18 answers, 18 citations
- eastbaycyber.com: 17 answers, 17 citations
- aimultiple.com: 16 answers, 18 citations

Pages named in the most answers:

- https://paloaltonetworks.com/cyberpedia/soar-tools-comparison (37 answers)
- https://gartner.com/reviews/market/security-orchestration-automation-and-response-solutions (29 answers)
- https://blinkops.com/blog/soar-platforms (28 answers)
- https://expertinsights.com/network-security/the-top-soar-solutions (20 answers)
- https://comparitech.com/net-admin/best-soar-software (18 answers)
- https://eastbaycyber.com/content/compare-best-soar-platforms-compared-2026 (17 answers)
- https://strike48.com/post/top-soar-platforms (15 answers)
- https://aimultiple.com/top-soar-platforms (14 answers)
- https://getapp.com/all-software/security-orchestration-automation-and-response-soar/org/mid-size-business (13 answers)
- https://simbian.ai/blog/top-5-soar-platforms-2026 (13 answers)

## Warned against

- Splunk SOAR: 23 of 54 labels negative. "Acquired, not native; integration with Splunk ES is described as "hacky" and problematic" (Kimi K2, negative prompt)
- Cortex XSOAR: 22 of 47 labels negative. "What to Avoid for a Mid-Size B2B Company - Palo Alto Cortex XSOAR — Excellent but enterprise/multi-team focused, with premium pricing" (DeepSeek V4 Flash, paraphrase prompt)
- IBM QRadar SOAR: 5 of 20 labels negative. "This is arguably the biggest "avoid" right now, primarily due to lifecycle/roadmap risk" (DeepSeek V4 Flash, negative prompt)
- Google Security Operations SOAR: 4 of 14 labels negative. "High vendor lock-in. Bundled SOAR platforms naturally optimize for their parent vendor's ecosystem." (Gemini 3.5 Flash, negative prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.