# SOAR platforms for enterprise buyers: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "SOAR platform" and as "security orchestration and automated response tool", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/security/soar-platforms/2026-10/enterprise

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/soar-platforms/enterprise/index.md

**Standing:** Cortex XSOAR leads with 41% of first choices; verdict clear leader. 51 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cortex XSOAR](https://www.gane.ai/index/it/vendors/cortex-xsoar/index.md) | 41% | 32% | 72 |
| 2 | [Splunk SOAR](https://www.gane.ai/index/it/vendors/splunk-soar/index.md) | 16% | 34% | 73 |
| 3 | [Tines](https://www.gane.ai/index/it/vendors/tines/index.md) | 12% | 5% | 38 |
| 4 | [Microsoft Sentinel](https://www.gane.ai/index/it/vendors/microsoft-sentinel/index.md) | 6% | 9% | 46 |
| 5 | [Swimlane Turbine](https://www.gane.ai/index/it/vendors/swimlane-turbine/index.md) | 6% | 3% | 38 |
| 6 | [Torq](https://www.gane.ai/index/it/vendors/torq/index.md) | 4% | 4% | 27 |
| 7 | [Google Security Operations SOAR](https://www.gane.ai/index/it/vendors/google-security-operations-soar/index.md) | 4% | 35% | 23 |
| 8 | [IBM QRadar SOAR](https://www.gane.ai/index/it/vendors/ibm-qradar-soar/index.md) | 2% | 29% | 41 |
| 9 | [Rapid7 InsightConnect](https://www.gane.ai/index/it/vendors/rapid7-insightconnect/index.md) | 2% | 20% | 10 |
| 14 | [D3 Security Smart SOAR](https://www.gane.ai/index/it/vendors/d3-security-smart-soar/index.md) | 0% | 9% | 11 |
| 15 | [ServiceNow Security Operations](https://www.gane.ai/index/it/vendors/servicenow-security-operations/index.md) | 0% | 10% | 10 |

Rank is by share of first choices among all 45 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Cortex XSOAR; alternatives Google Security Operations SOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR
- GPT-5.4 mini: Microsoft Sentinel; alternatives Cortex XSOAR, Splunk SOAR
- Gemini 3.5 Flash: Tines, Torq; alternatives D3 Security Smart SOAR, Microsoft Sentinel, Prophet Security, Simbian
- Perplexity Sonar: Cortex XSOAR; alternatives IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR
- Grok 4.20: Cortex XSOAR; alternatives Microsoft Sentinel, Splunk SOAR
- Mistral Small: Cortex XSOAR; alternatives Splunk SOAR, Tines, Torq
- DeepSeek V4 Flash: Cortex XSOAR; alternatives IBM QRadar SOAR, Splunk SOAR, Swimlane Turbine, Tines
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Cortex XSOAR, Splunk SOAR; alternatives IBM QRadar SOAR, Microsoft Sentinel, Tines
- Kimi K2: Microsoft Sentinel, Splunk SOAR; alternatives Cortex XSOAR, D3 Security Smart SOAR, Google Security Operations SOAR, IBM QRadar SOAR
- GLM 4.7 FlashX: Cortex XSOAR; alternatives IBM QRadar SOAR, Splunk SOAR, Tines, Torq
- MiniMax M2.5: Cortex XSOAR; alternatives IBM QRadar SOAR, Microsoft Sentinel, Rapid7 InsightConnect, ServiceNow Security Operations
- GPT-6 Luna: Tines; alternatives Cortex XSOAR, Microsoft Sentinel, Splunk SOAR
- Muse Glimmer 30B: Cortex AgentiX, Cortex XSOAR; alternatives IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR

## Sources the answers cite

81 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- checkthat.ai: 39 answers, 43 citations
- intezer.com: 39 answers, 40 citations
- strike48.com: 38 answers, 47 citations
- aimultiple.com: 37 answers, 39 citations
- guideflow.com: 37 answers, 37 citations
- paloaltonetworks.com: 36 answers, 44 citations
- expertinsights.com: 35 answers, 37 citations
- zendikt.com: 31 answers, 35 citations

Pages named in the most answers:

- https://intezer.com/guides/soar-security/soar-platform-guide (39 answers)
- https://checkthat.ai/answers/what-are-the-best-soar-tools-available (38 answers)
- https://guideflow.com/blog/soar-software (37 answers)
- https://aimultiple.com/top-soar-platforms (35 answers)
- https://expertinsights.com/network-security/the-top-soar-solutions (32 answers)
- https://strike48.com/post/top-soar-platforms (31 answers)
- https://zendikt.com/top-10-soar-software (31 answers)
- https://paloaltonetworks.com/cyberpedia/soar-tools-comparison (30 answers)
- https://startupstash.com/security-orchestration-tools (28 answers)
- https://ciopages.com/buyer-guides/security-orchestration-automation (24 answers)

## Warned against

- Splunk SOAR: 25 of 73 labels negative. "Platforms to Avoid for Your Use Case | Splunk SOAR | Primarily per-seat licensing; adding thousands of users is extremely costly." (Muse Glimmer 30B, budget prompt)
- Cortex XSOAR: 23 of 72 labels negative. "Platforms to Avoid for Predictable Costs at Scale ... ~$12,000 per user annually" (Kimi K2, budget prompt)
- IBM QRadar SOAR: 12 of 41 labels negative. "Avoid for Cloud. ... Large enterprises planning cloud-first architectures should completely avoid signing new contracts for QRadar SOAR." (Gemini 3.5 Flash, negative prompt)
- Google Security Operations SOAR: 8 of 23 labels negative. "Verdict: Avoid unless you are already a Chronicle/SecOps customer. If you are only buying SOAR, the convergence risk is too high." (DeepSeek V4 Flash, negative prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Cortex XSOAR at 42%.

- Swimlane Turbine: 19% to 5%, −14. Cleared the floor by 3 points · rank 2 → 5 of 41.
- Splunk SOAR: 12% to 19%, +7. Inside the floor by 4 points · rank 3 → 2 of 41.
- Tines: 7% to 12%, +5. Inside the floor by 6 points · rank 4 → 3 of 41.
- D3 Security Smart SOAR: 5% to 0%, −5. Inside the floor by 6 points · rank 7 → 12 of 41.
- Torq: 2% to 5%, +3. Inside the floor by 8 points · rank 9 → 6 of 41.
- IBM QRadar SOAR: 5% to 2%, −3. Inside the floor by 8 points · rank 5 → 8 of 41.
- Cortex XSOAR: 40% to 42%, +2. Inside the floor by 9 points · rank 1 of 41, unchanged.
- Microsoft Sentinel: 5% to 7%, +2. Inside the floor by 9 points · rank 6 → 4 of 41.
- Rapid7 InsightConnect: 0% to 2%, +2. Inside the floor by 9 points · rank 19 → 9 of 41.
- FortiSOAR: 2% to 0%, −2. Inside the floor by 9 points · rank 10 → 13 of 41.
- Google Security Operations SOAR: 5% to 5%, ±0. Inside the floor by 11 points · rank 8 → 7 of 41.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.