Skip to content
AI Cyber Compare

Operating model

What is SOAR, and when does a playbook engine still fit?

The short answer

SOAR is a workflow engine that runs playbooks your team writes in advance across integrated tools. It still fits fixed, audited responses and teams with engineers to maintain playbooks. It strains when each alert needs a different set of lookups, which is the gap AI SOC analyst platforms aim at.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

Desk research from public vendor pages: vendor facts read September 2026, updated 2026-10-13. Editorial reading of what vendors publish; we did not run the products and did not interview vendors.

What is SOAR, in one paragraph?

Security orchestration, automation and response: a workflow engine that runs playbooks your team writes in advance, across many integrated tools.

What you buy: Software plus the ongoing work of writing and maintaining playbooks.

Who decides: The playbook author decides in advance. At run time the engine follows the logic, and people handle what the logic does not cover.

Who carries each stage in SOAR?

Work strip for SOAR playbook engine: Triage, rules you write; Investigate, shared; Respond, rules you write; Tune, your analysts; Nights and weekends, rules you write.TriageRules you writeInvestigateSharedRespondRules you writeTuneYour analystsNights and weekendsRules you write
  • Your analysts
  • Rules you write
  • AI agent
  • Provider's analysts
  • Shared
  • Not described
  • Investigate: Playbooks gather enrichment; an analyst usually reads it and decides.
  • Tune: Every new alert type or tool change means a playbook edit.
  • Nights and weekends: Playbooks run at any hour, but only for the cases they were written for.
Our reading of who carries each stage by default. For a product it reflects what the vendor's public pages describe, not how your deployment will be set up.

When does SOAR fit?

  • Responses are fixed and audited, such as disabling a leaver's accounts or blocking a known-bad hash everywhere.
  • You have engineers who can write and maintain playbooks.
  • You need a very broad integration catalog for actions.

When does SOAR strain?

  • Each alert needs a different set of lookups.
  • A tool swap would break many playbooks at once.
  • Playbook upkeep competes with investigation for the same people.

Which profiled vendors work this way?

Primary model

Cortex XSOAR

Palo Alto Networks' SOAR platform, with Cortex AgentiX described as its next generation.

Adds AI inside SOAR

Work strip for Cortex XSOAR: Triage, rules you write; Investigate, shared; Respond, rules you write; Tune, your analysts; Nights and weekends, rules you write.TriageRules you writeInvestigateSharedRespondRules you writeTuneYour analystsNights and weekendsRules you write
Splunk SOAR

Splunk's SOAR, now a native capability inside Splunk Enterprise Security.

Adds AI inside SOAR

Work strip for Splunk SOAR: Triage, rules you write; Investigate, rules you write; Respond, rules you write; Tune, your analysts; Nights and weekends, rules you write.TriageRules you writeInvestigateRules you writeRespondRules you writeTuneYour analystsNights and weekendsRules you write
Tines

A workflow platform for AI agents, apps and automation that positions itself as a modern SOAR, with an AI SOC use case built from workflows.

Replaces SOAR

Work strip for Tines: Triage, AI agent; Investigate, shared; Respond, shared; Tune, your analysts; Nights and weekends, not described.TriageAI agentInvestigateSharedRespondSharedTuneYour analystsNights and weekendsNot described

Also covers this model

  • Artemis Security: Artemis includes an AI-native SOAR builder aimed at teams maintaining a SOAR, and offers an MDR option in which its senior analysts operate the platform 24/7.
  • Google Security Operations with Gemini: Google Security Operations also includes SOAR, so it reaches into the SOAR model.
  • Torq AI SOC Platform: Torq runs agents on top of Hyperautomation, a no-code workflow engine that supports deterministic workflows, so it also covers the SOAR model.

What should you ask before buying SOAR?

  1. How many integrations and actions does the vendor maintain?
  2. Which editions exist: SaaS, on-premises or hybrid?
  3. How are AI features added: inside playbooks or alongside them?
  4. What does one playbook change cost us in people time?
  5. What is the support horizon for the edition we run?

How does SOAR compare with the other models?

Dispatches on this model

Asked often about this page

Is SOAR dead?

Torq's blog says so, but that is a vendor's position. Cortex XSOAR and Splunk SOAR are both adding AI inside or next to the SOAR, and deterministic playbooks remain the right tool for fixed, audited responses.

Can AI be added to an existing SOAR?

Yes. Palo Alto describes Cortex AgentiX as the next generation of Cortex XSOAR, with AI prompts inside playbooks, and Splunk says SOAR is now native in Splunk Enterprise Security, which it describes as integrated with agentic AI.

What happens to playbooks if we move to an AI SOC platform?

It depends on the vendor. Mate Security describes translating playbooks into its Gamebooks, Torq rebuilds them as workflows, and Dropzone AI, 7AI and Intezer work beside the SOAR you keep.

Read next

Which modelThe decision guide for all four models.Fit finderFive questions that order the models by your answers.Fact tableAll thirteen vendors side by side.Four operating modelsPrimer lesson on how the models divide the work.