# SOAR platforms: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "SOAR platform" and as "security orchestration and automated response tool", six framings each, to twelve models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/soar-platforms/2026-09

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/soar-platforms/index.md

**Standing:** Tines leads with 47% of first choices; verdict clear leader. 47 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Tines](https://www.gane.ai/index/it/vendors/tines/index.md) | 47% | 0% | 48 |
| 2 | [Rapid7 InsightConnect](https://www.gane.ai/index/it/vendors/rapid7-insightconnect/index.md) | 15% | 8% | 25 |
| 3 | [Shuffle](https://www.gane.ai/index/it/vendors/shuffle/index.md) | 11% | 0% | 11 |
| 4 | [Swimlane Turbine](https://www.gane.ai/index/it/vendors/swimlane-turbine/index.md) | 4% | 6% | 32 |
| 5 | [Torq](https://www.gane.ai/index/it/vendors/torq/index.md) | 4% | 10% | 29 |
| 6 | [Microsoft Sentinel](https://www.gane.ai/index/it/vendors/microsoft-sentinel/index.md) | 2% | 10% | 29 |
| 7 | [FortiSOAR](https://www.gane.ai/index/it/vendors/fortisoar/index.md) | 2% | 6% | 18 |
| 9 | [Cortex XSOAR](https://www.gane.ai/index/it/vendors/cortex-xsoar/index.md) | 2% | 47% | 47 |
| 10 | [Splunk SOAR](https://www.gane.ai/index/it/vendors/splunk-soar/index.md) | 2% | 42% | 55 |
| 15 | [IBM QRadar SOAR](https://www.gane.ai/index/it/vendors/ibm-qradar-soar/index.md) | 0% | 25% | 20 |
| 19 | [Google Security Operations SOAR](https://www.gane.ai/index/it/vendors/google-security-operations-soar/index.md) | 0% | 29% | 14 |

Rank is by share of first choices among all 45 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Rapid7 InsightConnect, Swimlane Turbine; alternatives Cortex XSOAR, Google Security Operations SOAR, Microsoft Sentinel, Splunk SOAR
- GPT-5.4 mini: Swimlane Turbine; alternatives Microsoft Sentinel
- Gemini 3.5 Flash: Tines; alternatives BlinkOps, Microsoft Sentinel, Swimlane Turbine, Torq
- Perplexity Sonar: Tines; alternatives Cortex XSOAR, Splunk SOAR, Swimlane Turbine
- Grok 4.20: Tines; alternatives Microsoft Sentinel, Rapid7 InsightConnect, Swimlane Turbine, Torq
- Mistral Small: Rapid7 InsightConnect, Tines; alternatives FortiSOAR, Swimlane Turbine
- DeepSeek V4 Flash: Rapid7 InsightConnect, Tines; alternatives Swimlane Turbine
- Llama 4 Maverick: Tines; alternatives FortiSOAR, Rapid7 InsightConnect, Splunk SOAR
- Qwen 3.7 Flash: Tines; alternatives FortiSOAR, Rapid7 InsightConnect
- Kimi K2: Tines; alternatives Rapid7 InsightConnect
- GLM 4.7 FlashX: Tines; alternatives FortiSOAR, Rapid7 InsightConnect, Torq
- MiniMax M2.5: Rapid7 InsightConnect, Tines; alternatives FortiSOAR, Swimlane Turbine

## Sources the answers cite

65 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- paloaltonetworks.com: 43 answers, 49 citations
- blinkops.com: 36 answers, 38 citations
- gartner.com: 31 answers, 45 citations
- strike48.com: 22 answers, 25 citations
- expertinsights.com: 21 answers, 21 citations
- simbian.ai: 18 answers, 19 citations
- comparitech.com: 18 answers, 18 citations
- checkthat.ai: 17 answers, 18 citations

Pages named in the most answers:

- https://paloaltonetworks.com/cyberpedia/soar-tools-comparison (41 answers)
- https://blinkops.com/blog/soar-platforms (32 answers)
- https://gartner.com/reviews/market/security-orchestration-automation-and-response-solutions (30 answers)
- https://expertinsights.com/network-security/the-top-soar-solutions (20 answers)
- https://comparitech.com/net-admin/best-soar-software (18 answers)
- https://strike48.com/post/top-soar-platforms (18 answers)
- https://simbian.ai/blog/top-5-soar-platforms-2026 (17 answers)
- https://eastbaycyber.com/content/compare-best-soar-platforms-compared-2026 (17 answers)
- https://aimultiple.com/top-soar-platforms (14 answers)
- https://checkthat.ai/answers/what-are-the-best-soar-tools-available (13 answers)

## Warned against

- Splunk SOAR: 23 of 55 labels negative. "Acquired, not native; integration with Splunk ES is described as "hacky" and problematic" (Kimi K2, negative prompt)
- Cortex XSOAR: 22 of 47 labels negative. "What to Avoid for a Mid-Size B2B Company - Palo Alto Cortex XSOAR — Excellent but enterprise/multi-team focused, with premium pricing" (DeepSeek V4 Flash, paraphrase prompt)
- IBM QRadar SOAR: 5 of 20 labels negative. "This is arguably the biggest "avoid" right now, primarily due to lifecycle/roadmap risk" (DeepSeek V4 Flash, negative prompt)
- Google Security Operations SOAR: 4 of 14 labels negative. "High vendor lock-in. Bundled SOAR platforms naturally optimize for their parent vendor's ecosystem." (Gemini 3.5 Flash, negative prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.