# SOAR platforms: what AI models recommend, October 2026

Gane Index, October 2026 Edition. Asked as "SOAR platform" and as "security orchestration and automated response tool", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/soar-platforms/2026-10

This is the permanent record of the October 2026 Edition, published October 1, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/security/soar-platforms/index.md

**Standing:** Tines leads with 41% of first choices; verdict clear leader. 61 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Tines](https://www.gane.ai/index/it/vendors/tines/index.md) | 41% | 2% | 48 |
| 2 | [Shuffle](https://www.gane.ai/index/it/vendors/shuffle/index.md) | 18% | 0% | 16 |
| 3 | [Swimlane Turbine](https://www.gane.ai/index/it/vendors/swimlane-turbine/index.md) | 11% | 0% | 34 |
| 4 | [Torq](https://www.gane.ai/index/it/vendors/torq/index.md) | 8% | 10% | 30 |
| 5 | [Cortex XSOAR](https://www.gane.ai/index/it/vendors/cortex-xsoar/index.md) | 5% | 44% | 61 |
| 6 | [Rapid7 InsightConnect](https://www.gane.ai/index/it/vendors/rapid7-insightconnect/index.md) | 3% | 17% | 18 |
| 7 | [Microsoft Sentinel](https://www.gane.ai/index/it/vendors/microsoft-sentinel/index.md) | 2% | 8% | 39 |
| 11 | [Splunk SOAR](https://www.gane.ai/index/it/vendors/splunk-soar/index.md) | 2% | 44% | 61 |
| 15 | [FortiSOAR](https://www.gane.ai/index/it/vendors/fortisoar/index.md) | 0% | 18% | 11 |
| 57 | [Google Security Operations SOAR](https://www.gane.ai/index/it/vendors/google-security-operations-soar/index.md) | 0% | 42% | 19 |
| 67 | [IBM QRadar SOAR](https://www.gane.ai/index/it/vendors/ibm-qradar-soar/index.md) | 0% | 52% | 27 |

Rank is by share of first choices among all 67 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Swimlane Turbine, Torq; alternatives Cortex XSOAR, FortiSOAR, Splunk SOAR, Tines
- GPT-5.4 mini: Tines, Torq; alternatives Cortex XSOAR, Microsoft Sentinel, Splunk SOAR
- Gemini 3.5 Flash: Tines; alternatives BlinkOps, Radiant Security, Swimlane Turbine, Torq
- Perplexity Sonar: D3 Security Smart SOAR; alternatives ManageEngine Log360, ThreatConnect
- Grok 4.20: Swimlane Turbine; alternatives Microsoft Sentinel, Rapid7 InsightConnect
- Mistral Small: Swimlane Turbine, Torq; alternatives Microsoft Sentinel, Splunk SOAR, Tines
- DeepSeek V4 Flash: Tines; alternatives Microsoft Sentinel, Rapid7 InsightConnect, Swimlane Turbine
- Llama 4 Maverick: Tines
- Qwen 3.7 Flash: Tines; alternatives Microsoft Sentinel, Swimlane Turbine
- Kimi K2: Tines; alternatives Microsoft Sentinel, Rapid7 InsightConnect, Swimlane Turbine, Torq
- GLM 4.7 FlashX: Cortex XSOAR, Tines; alternatives Microsoft Sentinel, Splunk SOAR, Swimlane Turbine
- MiniMax M2.5: Swimlane Turbine; alternatives FortiSOAR, Microsoft Sentinel, Splunk SOAR, Torq
- GPT-6 Luna: Tines; alternatives Cortex XSOAR, Microsoft Sentinel's built-in automation, Splunk SOAR
- Muse Glimmer 30B: Swimlane Turbine, Tines, Torq; alternatives Cortex XSOAR, Microsoft Sentinel, Splunk SOAR

## Sources the answers cite

78 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- aimultiple.com: 34 answers, 34 citations
- startupstash.com: 30 answers, 30 citations
- paloaltonetworks.com: 29 answers, 35 citations
- strike48.com: 28 answers, 34 citations
- intezer.com: 28 answers, 31 citations
- zendikt.com: 26 answers, 32 citations
- checkthat.ai: 26 answers, 28 citations
- comparitech.com: 26 answers, 26 citations

Pages named in the most answers:

- https://startupstash.com/security-orchestration-tools (30 answers)
- https://aimultiple.com/top-soar-platforms (27 answers)
- https://comparitech.com/net-admin/best-soar-software (26 answers)
- https://zendikt.com/top-10-soar-software (26 answers)
- https://checkthat.ai/answers/what-are-the-best-soar-tools-available (25 answers)
- https://intezer.com/guides/soar-security/soar-platform-guide (24 answers)
- https://paloaltonetworks.com/cyberpedia/soar-tools-comparison (23 answers)
- https://guideflow.com/blog/soar-software (20 answers)
- https://strike48.com/post/top-soar-platforms (20 answers)
- https://gane.ai/index/it/security/soar-platforms (19 answers)

## Warned against

- Cortex XSOAR: 27 of 61 labels negative. "one source flags it as an "avoid" for a mid-size B2B company because it is enterprise/multi-team focused and has premium pricing" (Perplexity Sonar, negative prompt)
- Splunk SOAR: 27 of 61 labels negative. "avoid: ... Splunk SOAR: Only makes financial and operational sense if your company is already heavily standardized on Splunk" (Gemini 3.5 Flash, direct prompt)
- IBM QRadar SOAR: 14 of 27 labels negative. "Currently considered one of the biggest "avoid" options due to significant lifecycle and roadmap risks." (Mistral Small, negative prompt)
- Google Security Operations SOAR: 8 of 19 labels negative. "Google Siemplify | Absorbed into Google SecOps as its SOAR layer. The standalone product no longer exists to renew." (Muse Glimmer 30B, negative prompt)

## Movement since September 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Tines at 37%.

- Rapid7 InsightConnect: 15% to 4%, −11. Cleared the floor by 0 points · rank 2 → 6 of 56.
- Tines: 47% to 37%, −10. Inside the floor by 1 point · rank 1 of 56, unchanged.
- Swimlane Turbine: 4% to 12%, +8. Inside the floor by 3 points · rank 4 → 3 of 56.
- Shuffle: 11% to 18%, +7. Inside the floor by 4 points · rank 3 → 2 of 56.
- Torq: 4% to 8%, +4. Inside the floor by 7 points · rank 5 → 4 of 56.
- Cortex XSOAR: 2% to 6%, +4. Inside the floor by 7 points · rank 9 → 5 of 56.
- FortiSOAR: 2% to 0%, −2. Inside the floor by 9 points · rank 7 → 15 of 56.
- Microsoft Sentinel: 2% to 2%, ±0. Inside the floor by 11 points · rank 6 → 7 of 56.
- Splunk SOAR: 2% to 2%, ±0. Inside the floor by 11 points · rank 10 → 14 of 56.
- Google Security Operations SOAR: 0% to 0%, ±0. Inside the floor by 11 points · rank 19 → 18 of 56.
- IBM QRadar SOAR: 0% to 0%, ±0. Inside the floor by 11 points · rank 15 → 56 of 56.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, October 2026 Edition, www.gane.ai/index/it.