Vendor profile
Tines profile: a workflow platform positioned as a modern SOAR
The short answer
By The Triage Desk · AI Cyber Compare · Published 2026-10-08
Desk research from public vendor pages: vendor facts read September 2026, updated 2026-10-13. Editorial reading of what vendors publish; we did not run the products and did not interview vendors.
Which operating model is Tines?
Primary model: SOAR playbook engine.
It also reaches into: AI SOC analyst Tines lists an AI SOC use case, alert intake, triage and remediation built from AI agents and workflows, routing to an analyst when needed.
Who carries each stage in Tines?
- Your analysts
- Rules you write
- AI agent
- Provider's analysts
- Shared
- Not described
- Triage: AI SOC workflows take alert intake and triage, routing to an analyst when needed.
Source: Tines AI SOC · Read 13 Oct 2026
- Respond: Fully autonomous, deterministic or human-in-the-loop actions.
Source: Tines AI SOC · Read 13 Oct 2026
- Tune: Your team builds and changes the workflows.
Source: Tines agents · Read 13 Oct 2026
Compared with the SOAR model as a whole, Tines differs on: Triage, Respond and Nights and weekends.
What does Tines document?
| Capability | Status |
|---|---|
| Runs response actions itself | Documented |
| Approval or sign-off before actions | Documented |
| Can act alone on some cases | Documented |
| Translates existing SOAR playbooks | Not described |
| Optional service where the vendor's people work the queue | Not described |
| Multi-tenant or MSSP offering | Not described |
| On-premises, hybrid or your own cloud tenant | Documented |
| Single-tenant option | Not described |
| Data residency option | Not described |
| Integration count published | Not described |
| Pricing unit or tiers published | Documented |
Documented: 5 of 11. Not described: translating existing SOAR playbooks, an optional service where its own people work the queue, a multi-tenant or MSSP offering, a single-tenant option, a data residency option and a published integration count.
What are Tines's strengths?
Strengths
- Self-hosted and hybrid deployment, with AI available wherever Tines runs.
- A free edition with published limits, so a team can build before talking to sales.
What are Tines's limits?
Limits
- No prebuilt AI SOC analyst is described; your team designs the investigation logic.
- No integration count, and paid editions have no public price.
What does Tines say about its own results?
No vendor figures were collected for this profile.
Key facts
| Fact | Detail |
|---|---|
| AI SOC | "AI SOC: alert intake, triage, and remediation, routing to an analyst when needed"; enrichment, investigation and response workflows built using natural language. Source: Tines AI SOC · Read 13 Oct 2026 |
| Autonomy | "Fully autonomous, deterministic, or with a human in the loop", with full visibility and auditability over every action. Source: Tines AI SOC · Read 13 Oct 2026 |
| Position on SOAR | "Modern SOAR built for speed, security, and scale", positioned against legacy SOAR platforms; includes case management with an audit trail. Source: Tines SOAR · Read 13 Oct 2026 |
| Agents | Task and Chat modes, built no-code on the Storyboard, combining agentic and deterministic steps; Workbench is a Tines-powered AI copilot. Source: Tines agents · Read 13 Oct 2026 |
| Response examples | Create case, escalate, reset password, suspend departing-user accounts in Gmail, Okta and Slack, alert response with CrowdStrike and SentinelOne. Source: Tines agents · Read 13 Oct 2026 |
| AI handling | Hosted on AWS Bedrock or your own provider; Tines describes its AI as stateless, private, geo-bound and tenant-scoped, with no training and no logging; MCP servers and clients supported. Source: AI in Tines · Read 13 Oct 2026 |
Integrations, deployment, pricing, compliance and funding
- Integrations
- Not publishedTines says it integrates with any vendor in your stack; the free edition includes unlimited connectors. No count is published.
- Deployment
- Shared stack, self-hosted or hybrid; Tines says AI features are available wherever Tines is deployed.
Source: AI in Tines · Read 13 Oct 2026
- Pricing
- Free edition: unlimited users and connectors, 3 live workflows, one-time $50 AI allowance. Paid editions: contact sales; startup program discounts.
Source: Tines pricing · Read 13 Oct 2026
- Compliance
- Not reviewed
- Funding
- $125M Series C at a $1.125B valuation, announced 11 February 2025.
Source: Tines blog: Series C · Read 13 Oct 2026
If Tines is not the fit, which vendors document what it does not?
| Capability | Documented by |
|---|---|
| Translates existing SOAR playbooks | Mate Security |
| Optional service where the vendor's people work the queue | 7AI, Artemis Security, Exaforce and Prophet Security |
| Multi-tenant or MSSP offering | Conifers CognitiveSOC and Dropzone AI |
| Single-tenant option | Dropzone AI and Prophet Security |
| Data residency option | Conifers CognitiveSOC and Dropzone AI |
| Integration count published | Artemis Security, Conifers CognitiveSOC, Cortex XSOAR, Dropzone AI, Exaforce, Intezer, Prophet Security, Splunk SOAR and Torq AI SOC Platform |
How does Tines compare head to head?
Dispatches that mention Tines
Asked often about this page
What does Tines cost?
Free edition: unlimited users and connectors, 3 live workflows, one-time $50 AI allowance. Paid editions: contact sales; startup program discounts.
Does Tines replace SOAR?
Tines runs response itself and does not require a SOAR. Existing playbooks are rebuilt or retired rather than translated, on the pages reviewed.
Does Tines offer a managed service?
Not on the pages reviewed. Tines is sold as software your team runs.
Sources for this profile
Source: Tines homepage · Read 13 Oct 2026
Source: Tines AI SOC · Read 13 Oct 2026
Source: Tines SOAR · Read 13 Oct 2026
Source: Tines agents · Read 13 Oct 2026
Source: AI in Tines · Read 13 Oct 2026
Source: Tines pricing · Read 13 Oct 2026
Source: Tines blog: Series C · Read 13 Oct 2026