# SOAR platforms for enterprise buyers: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "SOAR platform" and as "security orchestration and automated response tool", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/security/soar-platforms/2026-09/enterprise

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/soar-platforms/enterprise/index.md

**Standing:** Cortex XSOAR leads with 40% of first choices; verdict contested. 43 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cortex XSOAR](https://www.gane.ai/index/it/vendors/cortex-xsoar/index.md) | 40% | 22% | 54 |
| 2 | [Swimlane Turbine](https://www.gane.ai/index/it/vendors/swimlane-turbine/index.md) | 19% | 7% | 43 |
| 3 | [Splunk SOAR](https://www.gane.ai/index/it/vendors/splunk-soar/index.md) | 12% | 25% | 55 |
| 4 | [Tines](https://www.gane.ai/index/it/vendors/tines/index.md) | 7% | 7% | 29 |
| 5 | [IBM QRadar SOAR](https://www.gane.ai/index/it/vendors/ibm-qradar-soar/index.md) | 5% | 15% | 33 |
| 6 | [Microsoft Sentinel](https://www.gane.ai/index/it/vendors/microsoft-sentinel/index.md) | 5% | 7% | 27 |
| 7 | [D3 Security Smart SOAR](https://www.gane.ai/index/it/vendors/d3-security-smart-soar/index.md) | 5% | 0% | 15 |
| 8 | [Google Security Operations SOAR](https://www.gane.ai/index/it/vendors/google-security-operations-soar/index.md) | 5% | 25% | 16 |
| 9 | [Torq](https://www.gane.ai/index/it/vendors/torq/index.md) | 2% | 4% | 23 |
| 10 | [FortiSOAR](https://www.gane.ai/index/it/vendors/fortisoar/index.md) | 2% | 20% | 15 |

Rank is by share of first choices among all 43 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Cortex XSOAR, Microsoft Sentinel; alternatives Splunk SOAR
- Gemini 3.5 Flash: Tines, Torq; alternatives Cortex XSOAR, D3 Security Smart SOAR, Prophet Security, Simbian
- Perplexity Sonar: Cortex XSOAR; alternatives IBM QRadar SOAR, Splunk SOAR, Swimlane Turbine
- Grok 4.20: Cortex XSOAR; alternatives FortiSOAR
- Mistral Small: Splunk SOAR, Swimlane Turbine; alternatives Cortex XSOAR, Tines, Torq
- DeepSeek V4 Flash: Cortex XSOAR; alternatives D3 Security Smart SOAR, Splunk SOAR, Swimlane Turbine, Tines
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Cortex XSOAR, Swimlane Turbine; alternatives Microsoft Sentinel, Splunk SOAR
- Kimi K2: Cortex XSOAR, Splunk SOAR; alternatives IBM QRadar SOAR, Microsoft Sentinel, Swimlane Turbine
- GLM 4.7 FlashX: no first choice
- MiniMax M2.5: Swimlane Turbine; alternatives Cortex XSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR

## Sources the answers cite

66 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- strike48.com: 37 answers, 48 citations
- expertinsights.com: 37 answers, 38 citations
- gartner.com: 35 answers, 51 citations
- paloaltonetworks.com: 34 answers, 37 citations
- blinkops.com: 31 answers, 31 citations
- exabeam.com: 28 answers, 34 citations
- simbian.ai: 25 answers, 26 citations
- aimultiple.com: 19 answers, 21 citations

Pages named in the most answers:

- https://expertinsights.com/network-security/the-top-soar-solutions (35 answers)
- https://gartner.com/reviews/market/security-orchestration-automation-and-response-solutions (33 answers)
- https://paloaltonetworks.com/cyberpedia/soar-tools-comparison (33 answers)
- https://strike48.com/post/top-soar-platforms (31 answers)
- https://blinkops.com/blog/soar-platforms (30 answers)
- https://simbian.ai/blog/top-5-soar-platforms-2026 (21 answers)
- https://exabeam.com/explainers/soar/best-soar-platforms-for-enterprises-top-5-options (20 answers)
- https://aimultiple.com/top-soar-platforms (19 answers)
- https://guideflow.com/blog/soar-software (18 answers)
- https://checkthat.ai/answers/what-are-the-best-soar-tools-available (15 answers)

## Warned against

- Splunk SOAR: 14 of 55 labels negative. "Platforms to Avoid for Your Use Case | Splunk SOAR | Primarily per-seat licensing; adding thousands of users is extremely costly." (Qwen 3.7 Flash, budget prompt)
- Cortex XSOAR: 12 of 54 labels negative. "Platforms to Avoid... Cortex XSOAR | Quote-based, tied to broader Palo Alto Cortex commitments" (Kimi K2, budget prompt)
- IBM QRadar SOAR: 5 of 33 labels negative. "Avoid | Starting new implementations on sunset/legacy platforms (QRadar SOAR, traditional static-playbook SOAR)" (Kimi K2, negative prompt)
- Google Security Operations SOAR: 4 of 16 labels negative. "unless your enterprise is fully committed to the Google Cloud/Chronicle ecosystem, adopting Google SecOps as a standalone SOAR adds unnecessary friction and architectural lock-in" (Gemini 3.5 Flash, negative prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.