Best SOAR Software in 2026
Updated
In short: Tracecat is ranked #1 of 19 as of 4 October 2026, ahead of OpenSOAR and Sumo Logic. The best-ranked option with a free plan is OpenSOAR. The lowest first paid tier on this page is KnowBe4 at $2.40/mo.
Security orchestration tools bring alert handling, case work, and response actions into workflows that teams can assess against their needs. Compare alert enrichment and case management with playbook automation and threat intel actions. Deployment model and published integrations are important operational distinctions, while free-plan availability and paid-from pricing provide cost context. Shuffle, Cyware Security Orchestration and Automation, and Tines are among the products to examine; Tracecat and Rapid7 InsightConnect provide more options to compare. Use the listed capabilities to identify which approaches align with your team's response processes and deployment requirements.
19 SOAR software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
Recognised 40% · Phone app 26% · Documented 20% · Free plan 14% of the score
- 1 Tracecat No phone app RecognisedPhone appDocumentedFree plan 6.3Free Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 2 OpenSOAR No phone app RecognisedPhone appDocumentedFree plan 6.2Free Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 3 Sumo Logic No phone app RecognisedPhone appDocumentedFree plan 6.2Free
- 4 Tines No phone app RecognisedPhone appDocumentedFree plan 6.1Free
- 5 Mjolnir SOAR Platform No phone app RecognisedPhone appDocumentedFree plan 5.8 Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 6 Palo Alto Networks Cortex Cloud API Security No phone app RecognisedPhone appDocumentedFree plan 5.8
- 7 Cyware Security Orchestration and Automation No phone app RecognisedPhone appDocumentedFree plan 5.7 Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 8 Defensys SOAR Platform No phone app RecognisedPhone appDocumentedFree plan 5.7 Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 9 Shuffle No phone app RecognisedPhone appDocumentedFree plan 5.7$29/mo Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 10 Torq Hyperautomation No phone app RecognisedPhone appDocumentedFree plan 5.7 Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 11 CrowdStrike Falcon Surface No phone app RecognisedPhone appDocumentedFree plan 5.6 Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 12 Swimlane Turbine No phone app RecognisedPhone appDocumentedFree plan 5.6 Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 13 Wildbox No phone app RecognisedPhone appDocumentedFree plan 5.6 Playbook automation: YesThreat intel actions: Yes
- 14 ServiceNow Security Incident Response No phone app RecognisedPhone appDocumentedFree plan 5.5 Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 15 KnowBe4 No phone app RecognisedPhone appDocumentedFree plan 5.4$2.40/mo Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 16 Rapid7 InsightConnect No phone app RecognisedPhone appDocumentedFree plan 5.4 Playbook automation: YesAlert enrichment: YesThreat intel actions: Yes
- 17 ZeroTrusted AI Firewall No phone app RecognisedPhone appDocumentedFree plan 5.4 Playbook automation: YesThreat intel actions: Yes
- 18 eyeCloudXOAR UEBA No phone app RecognisedPhone appDocumentedFree plan 5.0
- 19 NetWitness Platform No phone app RecognisedPhone appDocumentedFree plan 5.0
Compare all 19 in a table
| # | App | Score | Free plan | From | Free plan | Paid from | Playbook automation | Alert enrichment |
|---|---|---|---|---|---|---|---|---|
| 1 | Tracecat | 6.3 | Free plan | Free | Yes | — | Yes | Yes |
| 2 | OpenSOAR | 6.2 | Free plan | Free | Yes | — | Yes | Yes |
| 3 | Sumo Logic | 6.2 | Free plan | Free | Yes | — | — | — |
| 4 | Tines | 6.1 | Free plan | Free | Yes | — | — | — |
| 5 | Mjolnir SOAR Platform | 5.8 | No | — | — | — | Yes | Yes |
| 6 | Palo Alto Networks Cortex Cloud API Security | 5.8 | No | — | — | — | — | — |
| 7 | Cyware Security Orchestration and Automation | 5.7 | No | — | — | — | Yes | Yes |
| 8 | Defensys SOAR Platform | 5.7 | No | — | — | — | Yes | Yes |
| 9 | Shuffle | 5.7 | No | $29/mo | Yes | — | Yes | Yes |
| 10 | Torq Hyperautomation | 5.7 | No | — | — | — | Yes | Yes |
| 11 | CrowdStrike Falcon Surface | 5.6 | No | — | No | — | Yes | Yes |
| 12 | Swimlane Turbine | 5.6 | No | — | — | — | Yes | Yes |
| 13 | Wildbox | 5.6 | No | — | — | — | Yes | — |
| 14 | ServiceNow Security Incident Response | 5.5 | No | — | — | — | Yes | Yes |
| 15 | KnowBe4 | 5.4 | No | $2.40/mo | No | 1.15 /user/mo | Yes | Yes |
| 16 | Rapid7 InsightConnect | 5.4 | No | — | — | — | Yes | Yes |
| 17 | ZeroTrusted AI Firewall | 5.4 | No | — | — | — | Yes | — |
| 18 | eyeCloudXOAR UEBA | 5.0 | No | — | — | — | — | — |
| 19 | NetWitness Platform | 5.0 | No | — | — | — | — | — |
Is your app on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which SOAR software is ranked first on Samsung Mobile US Press?
Tracecat is ranked #1 of 19 with a score of 6.3. OpenSOAR is second and Sumo Logic third.
How many of these have a free plan?
4 of the 19 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, KnowBe4 has the lowest first paid tier we found: $2.40/mo.
How is this list ranked?
Ranked mobile-first: a phone app alongside the web or desktop product, a free tier and the depth of its documentation.