# SOAR platforms: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "SOAR platform" and as "security orchestration and automated response tool", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Page: https://www.gane.ai/index/it/security/soar-platforms

**Standing:** Tines leads with 47% of first choices; verdict clear leader. 51 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Tines](https://www.gane.ai/index/it/vendors/tines/index.md) | 47% | 0% | 57 |
| 2 | [Shuffle](https://www.gane.ai/index/it/vendors/shuffle/index.md) | 14% | 0% | 15 |
| 3 | [Swimlane Turbine](https://www.gane.ai/index/it/vendors/swimlane-turbine/index.md) | 8% | 9% | 44 |
| 4 | [Cortex XSOAR](https://www.gane.ai/index/it/vendors/cortex-xsoar/index.md) | 8% | 45% | 60 |
| 5 | [ManageEngine Log360](https://www.gane.ai/index/it/vendors/manageengine-log360/index.md) | 4% | 11% | 18 |
| 6 | [Splunk SOAR](https://www.gane.ai/index/it/vendors/splunk-soar/index.md) | 4% | 35% | 57 |
| 7 | [Torq](https://www.gane.ai/index/it/vendors/torq/index.md) | 2% | 11% | 36 |
| 8 | [Rapid7 InsightConnect](https://www.gane.ai/index/it/vendors/rapid7-insightconnect/index.md) | 2% | 11% | 19 |
| 9 | [Tracecat](https://www.gane.ai/index/it/vendors/tracecat/index.md) | 2% | 0% | 11 |
| 10 | [FortiSOAR](https://www.gane.ai/index/it/vendors/fortisoar/index.md) | 2% | 22% | 18 |
| 15 | [Microsoft Sentinel](https://www.gane.ai/index/it/vendors/microsoft-sentinel/index.md) | 0% | 5% | 43 |
| 17 | [Google Security Operations SOAR](https://www.gane.ai/index/it/vendors/google-security-operations-soar/index.md) | 0% | 18% | 17 |

Rank is by share of first choices among all 82 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Rapid7 InsightConnect; alternatives Splunk SOAR, Swimlane Turbine
- GPT-5.4 mini: Tines; alternatives Cortex XSOAR, FortiSOAR, Splunk SOAR
- Gemini 3.5 Flash: Tines; alternatives Microsoft Defender XDR, Microsoft Sentinel, Prophet Security, Simbian
- Perplexity Sonar: Tines; alternatives ManageEngine Log360, Microsoft Sentinel, Rapid7 InsightConnect, Swimlane Turbine
- Grok 4.20: Tines; alternatives Microsoft Sentinel, Torq
- Mistral Small: Tines; alternatives Cortex XSOAR, Microsoft Sentinel, Swimlane Turbine
- DeepSeek V4 Flash: Tines; alternatives Splunk SOAR, Swimlane Turbine
- Llama 4 Maverick: Tines; alternatives Cortex XSOAR, IncMan SOAR, Logsign Unified SO Platform, Splunk SOAR
- Qwen 3.7 Flash: Swimlane Turbine, Tines; alternatives Microsoft Sentinel
- Kimi K2: Tines; alternatives Cortex XSOAR, ORNA
- GLM 4.7 FlashX: Cortex XSOAR; alternatives ManageEngine Log360, Microsoft Sentinel, Splunk SOAR, Tines
- MiniMax M2.5: Cortex XSOAR, Swimlane Turbine; alternatives Microsoft Sentinel, Rapid7 InsightConnect
- GPT-6 Luna: Tines; alternatives Defender, Microsoft Sentinel, Torq
- Muse Glimmer 30B: Tines; alternatives ManageEngine Log360, Rapid7 InsightConnect, Shuffle, Swimlane Turbine

## Sources the answers cite

74 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- csoonline.com: 29 answers, 29 citations
- aimultiple.com: 26 answers, 26 citations
- knowbe4.com: 21 answers, 27 citations
- strike48.com: 21 answers, 24 citations
- comparitech.com: 19 answers, 19 citations
- paloaltonetworks.com: 18 answers, 19 citations
- g2.com: 16 answers, 23 citations
- tracecat.com: 16 answers, 19 citations

Pages named in the most answers:

- https://csoonline.com/article/3622920/soar-buyers-guide-11-security-orchestration-automation-and-response-products-and-how-to-choose.html (29 answers)
- https://aimultiple.com/top-soar-platforms (26 answers)
- https://comparitech.com/net-admin/best-soar-software (19 answers)
- https://softwareadvice.com/soar (16 answers)
- https://tracecat.com/alternatives/best-soar-platforms (16 answers)
- https://strike48.com/post/top-soar-platforms (14 answers)
- https://knowbe4.com/hubfs/G2-Spring-2024-Grid-Report-for-Security-Orchestration-Automation-and-Response.pdf?hsLang (12 answers)
- https://intezer.com/guides/soar-security/soar-platform-guide (11 answers)
- https://ciopages.com/buyer-guides/security-orchestration-automation (10 answers)
- https://cloudsek.com/knowledge-base/best-soar-platforms (10 answers)

## Warned against

- Splunk SOAR: 20 of 57 labels negative. "Avoid for tight budgets: Enterprise-heavy tools like Palo Alto Cortex XSOAR, Splunk SOAR, or FortiSOAR" (Grok 4.20, budget prompt)
- Cortex XSOAR: 27 of 60 labels negative. "Avoid for tight budgets: Enterprise-heavy tools like Palo Alto Cortex XSOAR, Splunk SOAR, or FortiSOAR" (Grok 4.20, budget prompt)
- IBM QRadar SOAR: 12 of 28 labels negative. "Palo Alto announced End-of-Life for QRadar SaaS offerings. Customers are being directed to migrate to Cortex XSIAM/XSOAR." (Gemini 3.5 Flash, negative prompt)
- Torq: 4 of 36 labels negative. "While newer, it has a 30% negative rate, with some users reporting integration and scalability issues" (Mistral Small, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Tines at 47%.

- Tines: 41% to 47%, +6. Inside the floor by 5 points · rank 1 of 82, unchanged.
- Torq: 8% to 2%, −6. Inside the floor by 5 points · rank 4 → 7 of 82.
- Shuffle: 18% to 14%, −4. Inside the floor by 7 points · rank 2 of 82, unchanged.
- Swimlane Turbine: 11% to 8%, −3. Inside the floor by 8 points · rank 3 of 82, unchanged.
- Cortex XSOAR: 5% to 8%, +3. Inside the floor by 8 points · rank 5 → 4 of 82.
- ManageEngine Log360: 2% to 4%, +2. Inside the floor by 9 points · rank 10 → 5 of 82.
- Splunk SOAR: 2% to 4%, +2. Inside the floor by 9 points · rank 11 → 6 of 82.
- Tracecat: 0% to 2%, +2. Inside the floor by 9 points · rank 16 → 9 of 82.
- FortiSOAR: 0% to 2%, +2. Inside the floor by 9 points · rank 15 → 10 of 82.
- Microsoft Sentinel: 2% to 0%, −2. Inside the floor by 9 points · rank 7 → 15 of 82.
- Rapid7 InsightConnect: 3% to 2%, −1. Inside the floor by 10 points · rank 6 → 8 of 82.
- Google Security Operations SOAR: 0% to 0%, ±0. Inside the floor by 11 points · rank 57 → 17 of 82.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.