Agents inside the SOAR: what it means for teams that stay put

What is the in-place path?

For years the choice looked binary: keep the SOAR and its playbooks, or replace it with an AI SOC platform. Both incumbent SOAR vendors in our profiles now offer a third route: add AI inside or next to the SOAR you already run.

What does Palo Alto describe?

Palo Alto calls Cortex AgentiX "the next generation of Cortex XSOAR". On its pages, agents can "reason, plan and execute workflows", act "within existing roles and permissions" and can "require approval for high-impact actions". Teams can drop prebuilt AI prompts into playbooks or write their own in natural language. Palo Alto says over 1,000 Cortex customers have enabled AgentiX; that is Palo Alto's figure.

XSOAR keeps its strengths: 900+ prebuilt integrations and automation packs, and SaaS and on-premises editions. Palo Alto's documentation lists 30 September 2029 as the end of life for Cortex XSOAR 8 On-prem, which on-premises teams should put in their plans now.

What does Splunk describe?

Splunk says "Splunk SOAR is now a native capability within Splunk Enterprise Security", which it describes as integrated with agentic AI, SOAR, UEBA and SIEM. Splunk SOAR itself publishes 300+ third-party tools and 2,800+ automated actions, and runs in the cloud, on-premises or hybrid. The AI in this picture sits on the SIEM side; on its own, the SOAR remains playbook-driven.

What does staying put offer?

• No migration. Playbooks keep running, and the people who maintain them keep their skills.
• The broadest action catalogs among the vendors we profiled.
• Deployment choice, including on-premises, which most AI SOC platforms we profiled do not describe.

What does it not change?

The work strip for these products still shows rules you write carrying triage and response, and your team carrying tuning. Agents inside playbooks help where a playbook calls them; they do not, by themselves, pick up the alerts no playbook covers. If most analyst time goes to that long tail, the in-place path helps less than the headline suggests.

How does this compare with the replacement pitch?

Torq's blog states "SOAR is officially obsolete." That is a vendor's position, and Torq sells agents on top of its own workflow engine, which keeps deterministic workflows in the product. Mate Security describes translating SOAR playbooks into its Gamebooks rather than discarding them. Even the replacement vendors keep a deterministic layer, which suggests the real question is not whether playbooks survive but where they run.

Who should take the in-place path?

• Teams whose playbooks work and whose alert volume is manageable.
• Teams with engineers who maintain playbooks and want AI to help them, not replace them.
• Teams whose SIEM is Splunk Enterprise Security or whose estate is deeply tied to Cortex.

Who should look further?

Teams whose analysts spend most of their time on alerts no playbook covers, or for whom playbook upkeep has become a job of its own. For them, the AI SOC analyst versus SOAR comparison is the better starting point.

The practical test

Take your ten most frequent alert types. For each, ask whether a playbook handles it end to end today. If most do, adding agents inside the SOAR is a sensible next step. If most do not, the in-place path leaves the core problem where it was.

What should an on-premises team plan now?

If you run an on-premises edition, write the support horizon into your roadmap. For Cortex XSOAR 8 On-prem, Palo Alto's documentation gives 30 September 2029. Three years is enough time to plan a move to SaaS, an in-place upgrade or a different model, but not enough to start late, because playbook estates take time to test on a new platform.