# SOAR platforms for enterprise buyers: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "SOAR platform" and as "security orchestration and automated response tool", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Page: https://www.gane.ai/index/it/security/soar-platforms/enterprise

**Standing:** Cortex XSOAR leads with 55% of first choices; verdict clear leader. 47 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cortex XSOAR](https://www.gane.ai/index/it/vendors/cortex-xsoar/index.md) | 55% | 30% | 79 |
| 2 | [Tines](https://www.gane.ai/index/it/vendors/tines/index.md) | 9% | 10% | 51 |
| 3 | [IBM QRadar SOAR](https://www.gane.ai/index/it/vendors/ibm-qradar-soar/index.md) | 9% | 35% | 43 |
| 4 | [D3 Security Smart SOAR](https://www.gane.ai/index/it/vendors/d3-security-smart-soar/index.md) | 6% | 18% | 11 |
| 5 | [Microsoft Sentinel](https://www.gane.ai/index/it/vendors/microsoft-sentinel/index.md) | 4% | 7% | 46 |
| 6 | [Splunk SOAR](https://www.gane.ai/index/it/vendors/splunk-soar/index.md) | 4% | 30% | 73 |
| 7 | [Swimlane Turbine](https://www.gane.ai/index/it/vendors/swimlane-turbine/index.md) | 2% | 8% | 40 |
| 8 | [Google Security Operations SOAR](https://www.gane.ai/index/it/vendors/google-security-operations-soar/index.md) | 2% | 7% | 14 |
| 13 | [Torq](https://www.gane.ai/index/it/vendors/torq/index.md) | 0% | 6% | 31 |
| 14 | [FortiSOAR](https://www.gane.ai/index/it/vendors/fortisoar/index.md) | 0% | 5% | 22 |
| 15 | [ServiceNow Security Operations](https://www.gane.ai/index/it/vendors/servicenow-security-operations/index.md) | 0% | 0% | 10 |

Rank is by share of first choices among all 74 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Cortex XSOAR; alternatives FortiSOAR, IBM QRadar SOAR, Splunk SOAR, Tines
- Gemini 3.5 Flash: Cortex XSOAR; alternatives Microsoft Sentinel, Splunk SOAR, Swimlane Turbine, Tines
- Perplexity Sonar: Cortex XSOAR; alternatives FortiSOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR
- Grok 4.20: Cortex XSOAR; alternatives Microsoft Sentinel, Splunk SOAR, Swimlane Turbine
- Mistral Small: Cortex XSOAR; alternatives FortiSOAR, ServiceNow Security Incident Response, Splunk SOAR, Tines
- DeepSeek V4 Flash: Cortex XSOAR, Microsoft Sentinel; alternatives Splunk SOAR, Swimlane Turbine, Tines
- Llama 4 Maverick: Cortex XSOAR; alternatives Logsign Unified SO Platform, Splunk SOAR, Tines
- Qwen 3.7 Flash: Cortex XSOAR; alternatives IBM QRadar SOAR, ServiceNow Security Operations, Splunk SOAR
- Kimi K2: Cortex XSOAR; alternatives Microsoft Sentinel, Splunk SOAR, Tines, Torq
- GLM 4.7 FlashX: no first choice; alternatives BlinkOps, FortiSOAR, Google Security Operations SOAR, KnowBe4 PhishER
- MiniMax M2.5: Cortex XSOAR; alternatives Google Security Operations SOAR, IBM QRadar SOAR, Microsoft Sentinel, Splunk SOAR
- GPT-6 Luna: Tines; alternatives Cortex XSOAR, Microsoft Sentinel, Splunk SOAR
- Muse Glimmer 30B: Cortex XSOAR; alternatives IBM QRadar SOAR, Splunk SOAR

## Sources the answers cite

74 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- csoonline.com: 37 answers, 37 citations
- aimultiple.com: 28 answers, 29 citations
- expertinsights.com: 27 answers, 30 citations
- ciopages.com: 21 answers, 24 citations
- strike48.com: 20 answers, 25 citations
- paloaltonetworks.com: 19 answers, 23 citations
- cloudsek.com: 19 answers, 19 citations
- gane.ai/index: 17 answers, 18 citations

Pages named in the most answers:

- https://csoonline.com/article/3622920/soar-buyers-guide-11-security-orchestration-automation-and-response-products-and-how-to-choose.html (37 answers)
- https://aimultiple.com/top-soar-platforms (28 answers)
- https://expertinsights.com/network-security/the-top-soar-solutions (24 answers)
- https://ciopages.com/buyer-guides/security-orchestration-automation (20 answers)
- https://cloudsek.com/knowledge-base/best-soar-platforms (19 answers)
- https://gane.ai/index/it/security/soar-platforms/enterprise (16 answers)
- https://guideflow.com/blog/soar-software (15 answers)
- https://softwareadvice.com/soar (14 answers)
- https://intezer.com/guides/soar-security/soar-platform-guide (13 answers)
- https://strike48.com/post/top-soar-platforms (13 answers)

## Warned against

- Cortex XSOAR: 24 of 79 labels negative. "Avoid new investment in: Google Siemplify standalone (product discontinued) and be very cautious with IBM QRadar SOAR ... and Cortex XSOAR (impending forced migration to AgentiX within XSIAM)." (DeepSeek V4 Flash, negative prompt)
- Splunk SOAR: 22 of 73 labels negative. "Platforms to Avoid for Your Use Case | Splunk SOAR | Primarily per-seat licensing — adding thousands of users becomes extremely costly" (DeepSeek V4 Flash, budget prompt)
- IBM QRadar SOAR: 15 of 43 labels negative. "Large enterprises should be highly cautious of IBM Security SOAR, specifically due to security vulnerabilities and end-of-life (EoL) status." (GLM 4.7 FlashX, negative prompt)
- Microsoft Sentinel: 3 of 46 labels negative. "To avoid budget variance, you generally want to stay away from Consumption-Based (Usage) models." (Qwen 3.7 Flash, budget prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Cortex XSOAR at 55%.

- Cortex XSOAR: 41% to 55%, +14. Cleared the floor by 3 points · rank 1 of 74, unchanged.
- Splunk SOAR: 16% to 4%, −12. Cleared the floor by 1 point · rank 2 → 6 of 74.
- IBM QRadar SOAR: 2% to 9%, +7. Inside the floor by 4 points · rank 8 → 3 of 74.
- D3 Security Smart SOAR: 0% to 6%, +6. Inside the floor by 5 points · rank 14 → 4 of 74.
- Swimlane Turbine: 6% to 2%, −4. Inside the floor by 7 points · rank 5 → 7 of 74.
- Torq: 4% to 0%, −4. Inside the floor by 7 points · rank 6 → 13 of 74.
- Tines: 12% to 9%, −3. Inside the floor by 8 points · rank 3 → 2 of 74.
- Microsoft Sentinel: 6% to 4%, −2. Inside the floor by 9 points · rank 4 → 5 of 74.
- Google Security Operations SOAR: 4% to 2%, −2. Inside the floor by 9 points · rank 7 → 8 of 74.
- Rapid7 InsightConnect: 2% to 0%, −2. Inside the floor by 9 points · rank 9 → 18 of 74.
- FortiSOAR: 0% to 0%, ±0. Inside the floor by 11 points · rank 16 → 14 of 74.
- ServiceNow Security Operations: 0% to 0%, ±0. Inside the floor by 11 points · rank 15 of 74, unchanged.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.