# Tines alternatives for SOC teams: which SOAR fits your workflow?

> Published 2026-11-07
> Source: https://viktor.com/blog/tines-alternatives

Tines is [co-headquartered in Dublin and Boston](https://www.irishtimes.com/business/2026/10/12/tech-company-tines-to-create-100-jobs-in-ireland-over-two-years-and-open-new-facility), was started in 2018 by Eoin Hinchy and Thomas Kinsella, and has [raised $272 million](https://www.irishtimes.com/business/2026/10/12/tech-company-tines-to-create-100-jobs-in-ireland-over-two-years-and-open-new-facility). It names Coinbase, Databricks, Mars, Reddit and SAP as customers. Builders assemble [no-code workflows](https://viktor.com/blog/ai-workflow-automation-tools) called stories in Tines Stories, which Tines describes as its “visual designer purpose-built for security and IT operations teams”. Viktor, an [AI employee](https://viktor.com/ai-employee), heads this list because he handles the ops and request work around the SOC; the main SOAR competitors are Torq, Swimlane, Splunk SOAR, Cortex XSOAR, Microsoft Sentinel and Shuffle. (New to the category? Here is [what an AI employee is](https://viktor.com/blog/what-is-an-ai-employee).)

How they differ from Tines in one line each: Viktor takes the ops and request work around the SOC instead of replacing SOAR; Torq adds vendor-built autonomous AI triage; Swimlane offers low-code playbooks with cloud, on-premises or air-gapped deployment; Splunk SOAR fits Splunk Enterprise Security customers; Cortex XSOAR fits Palo Alto Networks Cortex customers; Microsoft Sentinel runs automation inside the SIEM; Shuffle is open source and self-hosted, cheaper but more upkeep.

## Why look for Tines alternatives

Teams look at other options because of pricing they cannot predict before a sales call, onboarding effort, AI triage depth, deployment and compliance requirements, or a pile of non-security requests that no SOAR platform was built to absorb. Each reason points to a different kind of alternative, so the reason a team is looking decides what it should evaluate.

### Pricing and cost predictability

The Tines pricing page publishes no dollar figure for paid editions. Its “Get pricing” button opens a demo request.

- **Free edition:** The pricing page lists unlimited users, 3 live workflows and a one-time $50 AI allowance (pricing checked November 2026).
- **Community Edition:** The Stories knowledge base lists 1 user, 3 flows, 25,000 monthly events and 50 monthly AI credits. The two official pages list different limits.
- **Usage limits:** Tines charges for each autonomous flow. When a story reaches its event limit, Tines stops that story until the next period.
- **Reported contracts:** Procurement firm [Vendr reports a median Tines contract of $52,228 per year across 62 purchases, with a range of $26,750 to $157,499](https://www.vendr.com/marketplace/tines), and describes tiers by monthly action volume, a metric the official page does not name (pricing checked November 2026).

Teams that need a budget figure before procurement should ask Tines for the flow and event limits of the paid tier in writing.

### Learning curve and documentation

Reviewers rate Tines highly for ease of use and still flag the early weeks as slow. On G2, [Ease of Use is the most-mentioned pro, with 73 mentions](https://www.g2.com/products/tines/reviews?page=3). Tines holds [4.9 from 57 ratings on Gartner Peer Insights](https://www.gartner.com/reviews/market/security-orchestration-automation-and-response-solutions/vendor/tines), where an October 5, 2026 reviewer wrote that onboarding was “quick allowing us to go from 0 to implementation super fast” ([Gartner Peer Insights](https://www.gartner.com/reviews/market/security-orchestration-automation-and-response-solutions/vendor/tines/product/tines)).

PeerSpot shows the other side. One [PeerSpot reviewer](https://www.peerspot.com/products/tines-reviews) wrote that “the setup can feel a bit technical at first,” that “the learning curve is steep,” and that “the documentation could be much simpler and mainly example-based, showing real workflows.” Tines holds [4.1 out of 5 from 8 PeerSpot reviews](https://www.peerspot.com/products/tines-reviews).

A team with no automation engineer should build one real story during a Community Edition trial before it judges the learning curve.

### Depth of AI triage

Tines treats triage as something builders design, using AI building blocks inside workflows. The AI Agent action runs a large language model at any step in task or chat mode. The Cases add-on creates and enriches cases from alerts, routes them and drafts reports for analyst review.

The governance controls are documented in detail. Pages pause stories for human input. With change control on, a live story is read-only until a change request is approved. And every AI action produces token, model and duration metadata as audit records.

Some buyers want something different: a system that investigates and closes Tier-1 cases with less workflow design up front. Teams that want to design and govern every step of triage get that from Tines. Teams that want the vendor to ship the investigation logic should evaluate platforms that sell autonomous triage as a product.

### Deployment and compliance requirements

Tines Stories cloud runs in seven AWS regions, from Tokyo to Oregon. Business and Enterprise Editions can be self-hosted, and Tines 3B ships an offline bundle for air-gapped environments. Self-serve subscriptions are cloud-only.

The Tines Trust Center lists SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 42001 and TX-RAMP Level 2. On FedRAMP, Tines says it is “actively pursuing FedRAMP authorization”, and no Tines listing appears on the [FedRAMP Marketplace](https://www.fedramp.gov/marketplace/products). A federal buyer who needs a current FedRAMP authorization has a concrete reason to look elsewhere.

### Requests that fall outside security workflows

In Tines’ own Voice of the SOC Analyst report, 50.4% of analysts named reporting as a task they spend most of their day on, more than named detecting (32.3%), and 64% said they spend over half their time on tedious manual work. The [SANS 2025 SOC Survey, as summarized by SANS](https://www.sans.org/blog/how-integrate-ai-modern-soc), found that 69% of SOCs report metrics manually or mostly manually.

The weekly metrics deck, the access request in a Slack channel and the ticket that needs a third nudge are [internal operations work](https://viktor.com/blog/ai-for-operations-teams). A SOAR platform can run them, but only after someone designs, tests and maintains a story for each one. Before replacing a SOAR platform, list which backlog items are alert response and which are internal requests, since the two lists usually call for different tools.

## Top Tines alternatives at a glance

The seven options fall into four SOAR architecture groups, plus one AI employee for the work around the SOC:

```json:object
{
  "_key": "k109",
  "_type": "table",
  "rows": [
    {
      "_key": "k101",
      "_type": "tableRow",
      "cells": [
        "Alternative",
        "Architecture group",
        "Best for",
        "Key differentiator"
      ]
    },
    {
      "_key": "k102",
      "_type": "tableRow",
      "cells": [
        "Viktor",
        "Ops complement, not a SOAR replacement",
        "SOC and IT teams buried in access requests, reports and follow-ups",
        "Plain-language jobs in Slack, Microsoft Teams or the web app, with approval cards and 9,800+ tools"
      ]
    },
    {
      "_key": "k103",
      "_type": "tableRow",
      "cells": [
        "Torq",
        "AI-native SOAR",
        "SOCs that want vendor-built autonomous triage",
        "Socrates coordinates triage and case handling on a SaaS platform"
      ]
    },
    {
      "_key": "k104",
      "_type": "tableRow",
      "cells": [
        "Swimlane",
        "AI-native SOAR (low-code)",
        "Regulated and government SOCs",
        "Cloud, on-premises or air-gapped Turbine deployment"
      ]
    },
    {
      "_key": "k105",
      "_type": "tableRow",
      "cells": [
        "Splunk SOAR",
        "Established enterprise SOAR",
        "Splunk Enterprise Security customers",
        "A native capability within Splunk Enterprise Security"
      ]
    },
    {
      "_key": "k106",
      "_type": "tableRow",
      "cells": [
        "Cortex XSOAR",
        "Established enterprise SOAR",
        "Palo Alto Networks Cortex customers",
        "1,232 Marketplace content packs (checked November 2026)"
      ]
    },
    {
      "_key": "k107",
      "_type": "tableRow",
      "cells": [
        "Microsoft Sentinel",
        "SIEM-native automation",
        "Microsoft-heavy SOCs",
        "Automation rules and Azure Logic Apps playbooks inside the SIEM"
      ]
    },
    {
      "_key": "k108",
      "_type": "tableRow",
      "cells": [
        "Shuffle",
        "Open source SOAR",
        "Budget-constrained teams that can self-host",
        "AGPL-3.0 backend with MIT-licensed apps and workflows"
      ]
    }
  ]
}
```

## Top Tines alternatives in depth

Torq AI SOC Platform and [Swimlane Turbine](https://swimlane.com/swimlane-turbine) offer AI-native security automation; Splunk SOAR and [Cortex XSOAR](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsoar) are established enterprise SOAR platforms; Microsoft Sentinel builds automation into the SIEM, and Shuffle is the open source option. Viktor handles [requests and reports](https://viktor.com/use-case) around the SOC.

### Viktor

Viktor is the [AI employee](https://viktor.com/ai-employee) that lives in Slack and Microsoft Teams, connects to 9,800+ tools, and does the work. He does not replace a SOAR platform. Alert ingestion, playbook-driven response and case management stay in Tines or whichever SOAR the team runs. Viktor takes the requests and reports that surround that work.

An engineer posts an access request in a Slack channel. Viktor gathers the context from the connected tools and posts an approval card before anything changes, because admins can set any tool to “needs approval” or “forbidden.” The weekly security metrics report becomes a scheduled task that Viktor sets up once in plain English, pulls from Jira or Linear and posts every Monday. When tickets stall, Viktor follows up in the thread.

Quick facts:

- **Where he works:** Slack, [Microsoft Teams](https://viktor.com/integrations/microsoft-teams) (generally available since 18 June 2026), the web app at app.viktor.com and Discord.
- **How work starts:** Plain-language requests, scheduled tasks and event triggers such as a channel message, a submitted form or a webhook.
- **Human control:** Sensitive actions wait for an approval card, and admins can set any tool to “needs approval” or “forbidden.” On the [security page](https://viktor.com/security), money moves, code pushes and customer emails wait for explicit approval in Slack.
- **Credentials:** API keys and tokens are added at run time by a gateway, so the model never reads them.
- **Security status:** SOC 2 Type 1, with SOC 2 Type 2 and ISO 27001 in progress, as stated on [viktor.com/security](https://viktor.com/security) in October 2026. Customer data is never used to train models.
- **Pricing:** Free to start with up to $100 in credits and no credit card. Credits are shared by the whole workspace, not per seat; see current plans on the [pricing page](https://viktor.com/pricing).

#### Viktor vs Tines

Viktor and Tines do different jobs and can run side by side:

```json:object
{
  "_key": "k175",
  "_type": "table",
  "rows": [
    {
      "_key": "k168",
      "_type": "tableRow",
      "cells": [
        " ",
        "Viktor",
        "Tines"
      ]
    },
    {
      "_key": "k169",
      "_type": "tableRow",
      "cells": [
        "Primary job",
        "Requests, reports and follow-ups around the SOC",
        "Security and IT workflow orchestration"
      ]
    },
    {
      "_key": "k170",
      "_type": "tableRow",
      "cells": [
        "How work is defined",
        "Plain-language hand-off; no workflow building",
        "Stories built in a visual designer"
      ]
    },
    {
      "_key": "k171",
      "_type": "tableRow",
      "cells": [
        "Where people interact",
        "Slack, Microsoft Teams, web app, Discord",
        "Tines tenant, pages and Workbench"
      ]
    },
    {
      "_key": "k172",
      "_type": "tableRow",
      "cells": [
        "Human control",
        "Approval cards in Slack or Microsoft Teams",
        "Pages and change control"
      ]
    },
    {
      "_key": "k173",
      "_type": "tableRow",
      "cells": [
        "Deployment",
        "Cloud, US-hosted by default",
        "Cloud in seven AWS regions or self-hosted"
      ]
    },
    {
      "_key": "k174",
      "_type": "tableRow",
      "cells": [
        "Compliance",
        "SOC 2 Type 1; Type 2 and ISO 27001 in progress",
        "SOC 2 Type 2, ISO 27001, 27701, 42001, TX-RAMP Level 2"
      ]
    }
  ]
}
```

Viktor holds 4.9 on G2 and is used by [75,000+ teams](https://viktor.com) as of October 2026. He was named in the Forbes Agentic 20 (October 2026) and the Sifted AI 100 2026 (#21). Outside security, [Hampton’s published story](https://viktor.com/case-study) reports that Hampton avoided $440K in planned hires; in 44 days Viktor connected 24 tools, took over reporting and took on 26 recurring jobs per week.

Pros and cons:

- **Pro:** Requests and reports go to one shared AI employee in the chat tools the team already uses, and nobody builds a workflow first.
- **Pro:** Workspace memory keeps team context and decisions across conversations, and written skills can be inspected and edited.
- **Con:** He does not ingest alerts or run SOAR playbooks, so a SOC still needs a SOAR platform or SIEM automation.
- **Con:** There is no self-hosted or air-gapped option, and SOC 2 Type 2 is still in progress.
- **Con:** Microsoft Teams lacks some Slack features, including canvases, Lists and Slack Connect.

Add Viktor when the SOC backlog is mostly access requests, metrics reports and ticket chasing rather than alert response. [Start free with up to $100 in credits, no credit card →](https://app.viktor.com/signup)

### Torq

Torq sells the [Torq AI SOC Platform](https://torq.io), built around [Auto Triage, HyperAgents, Socrates and Case Management](https://torq.io/blog/idc-ai-soc-marketscape-2026), with [Hyperautomation described as its foundation](https://torq.io/hyperautomation). Torq’s platform page calls Socrates [“the quarterback of the agentic SOC”](https://torq.io/ai-soc-platform). HyperSOC, launched in April 2024, no longer appears among the modules on Torq’s current platform page.

Quick facts:

- **Integrations:** Torq lists “300 pre-built integrations and 4,000+ pre-built steps”.
- **Deployment:** The platform runs as [SaaS across US, EU and APAC regions](https://torq.io/blog/idc-ai-soc-marketscape-2026), and Torq’s [data sheet](https://flow.torq.io/hubfs/Content%20Assets/Torq%20Product%20Data%20Sheet.pdf) adds hybrid and on-premise support.
- **Pricing model:** Under Extend pricing, AI Tasks, AI Agents and Socrates draw on [a shared AI Credits pool, and Socrates usage is based on case volume](https://kb.torq.io/en/articles/10219449-track-ai-task-operator-usage).
- **Company:** Torq closed a [$140 million Series D at a $1.2 billion valuation, for $332 million in total funding](https://torq.io/news/torq-seriesd), and lists [Tel Aviv and Denver headquarters](https://torq.io/contact-us).

#### Torq vs Tines

Torq and Tines differ most on who designs the triage logic:

```json:object
{
  "_key": "k259",
  "_type": "table",
  "rows": [
    {
      "_key": "k254",
      "_type": "tableRow",
      "cells": [
        " ",
        "Torq",
        "Tines"
      ]
    },
    {
      "_key": "k255",
      "_type": "tableRow",
      "cells": [
        "AI triage",
        "Socrates handles cases end to end",
        "AI Agent action and Cases inside designed workflows"
      ]
    },
    {
      "_key": "k256",
      "_type": "tableRow",
      "cells": [
        "Autonomy claim",
        "Socrates “Offloads 90%+ of Tier-1 Cases” (vendor claim)",
        "Triage built from deterministic steps, AI actions and human approvals"
      ]
    },
    {
      "_key": "k257",
      "_type": "tableRow",
      "cells": [
        "Deployment",
        "SaaS, multi-region",
        "Cloud or self-hosted, including air-gapped"
      ]
    },
    {
      "_key": "k258",
      "_type": "tableRow",
      "cells": [
        "Pricing published",
        "No price page; AWS listing at $450,000.00 per plan for a 12-month contract (basis not stated)",
        "No paid price; free edition published"
      ]
    }
  ]
}
```

[PeerSpot summarizes](https://www.peerspot.com/products/comparisons/splunk-soar_vs_torq) that enterprise buyers “have mixed opinions on Torq’s pricing, with some finding it affordable and others expensive but valuable.” [Vendr reports a median Torq contract of $185,178 per year, ranging from $60,000 to $378,333](https://www.vendr.com/marketplace/torq) (pricing checked November 2026).

Pros and cons:

- **Pro:** Socrates, Auto Triage and Case Management come as packaged modules, so less triage logic has to be designed in-house.
- **Pro:** The SaaS platform spans three regions, and Torq reports 99.99% availability over five-plus years.
- **Con:** Torq publishes no pricing page, and its Tier-1 automation percentages are vendor claims.
- **Con:** HyperSOC no longer appears on the current platform page, so buyers should confirm which modules a quote covers.

Choose Torq when the goal is autonomous Tier-1 triage delivered as a SaaS product and the budget suits an enterprise contract.

### Swimlane

Swimlane sells Swimlane Turbine, which combines Hero AI, case management, low-code playbooks and dashboards. Builders use [Turbine Canvas, “a low-code automation building studio”](https://swimlane.com/cpg-swimlane-turbine). On October 28, 2026, Swimlane announced [customer-defined detections, two-way MCP support and a Hero AI feature that builds applications from natural-language prompts](https://swimlane.com/news/ai-soc-customer-defined-detections).

Quick facts:

- **Deployment:** Turbine deploys [in the cloud, on-premises or in air-gapped environments](https://swimlane.com/platform/enterprise-packaging), and Swimlane Cloud runs in 8 regions, including what Swimlane describes as a FedRAMP-High certified GOV region.
- **Pricing model:** Five plans (Starter, Core, Plus, Premium and Elite) are tiered by daily automation volume, with user-based pricing through sales. No dollar figures are published.
- **Case management:** Swimlane describes an [“AI-driven case management application”](https://swimlane.com/swimlane-turbine).
- **Reviews:** Turbine holds [4.8 from 125 ratings on Gartner Peer Insights](https://www.gartner.com/reviews/product/swimlane-turbine).

#### Swimlane vs Tines

Swimlane publishes its own Tines comparison, and its claims are vendor-authored and unverified:

```json:object
{
  "_key": "k326",
  "_type": "table",
  "rows": [
    {
      "_key": "k320",
      "_type": "tableRow",
      "cells": [
        " ",
        "Swimlane Turbine",
        "Tines"
      ]
    },
    {
      "_key": "k321",
      "_type": "tableRow",
      "cells": [
        "Case management",
        "Built into the platform",
        "Cases available as an add-on"
      ]
    },
    {
      "_key": "k322",
      "_type": "tableRow",
      "cells": [
        "Builder",
        "Turbine Canvas, low-code",
        "Tines Stories visual designer"
      ]
    },
    {
      "_key": "k323",
      "_type": "tableRow",
      "cells": [
        "Air-gapped",
        "Supported",
        "Supported in Tines 3B self-hosted"
      ]
    },
    {
      "_key": "k324",
      "_type": "tableRow",
      "cells": [
        "Pricing metric",
        "Daily automated actions",
        "Autonomous flows and events"
      ]
    },
    {
      "_key": "k325",
      "_type": "tableRow",
      "cells": [
        "Switching offer",
        "Up to 90% of Tines workflows migrate automatically; up to the first year free on a 3-year agreement (vendor claim)",
        "Not applicable"
      ]
    }
  ]
}
```

PeerSpot pricing comments vary. One reviewer calls Swimlane [“on the slightly expensive side”](https://www.peerspot.com/questions/what-is-your-experience-regarding-pricing-and-costs-for-swimlane), while a comparison page states [“Swimlane is cheaper than other SOAR platforms”](https://www.peerspot.com/products/comparisons/swimlane_vs_torq). A June 22, 2026 Gartner Peer Insights reviewer wrote, “We migrate from another SOAR to Swimlane in only 3 weeks!” ([Gartner Peer Insights](https://www.gartner.com/reviews/market/security-orchestration-automation-and-response-solutions/vendor/swimlane)).

Pros and cons:

- **Pro:** A government cloud region plus on-premises and air-gapped options cover most regulated deployments.
- **Pro:** Case management ships with the platform, and all enterprise tiers include unlimited tenants.
- **Con:** No published prices exist, so cost depends on a quote.
- **Con:** Its performance and migration claims are Swimlane’s own.

Choose Swimlane when the buyer needs a government cloud region or air-gapped deployment with case management in the same platform.

### Splunk SOAR

Splunk states that [“Splunk SOAR is now a native capability within Splunk Enterprise Security”](https://www.splunk.com/en_us/products/splunk-security-orchestration-and-automation.html). Splunk Enterprise Security Premier [bundles Enterprise Security, SOAR, UEBA and the AI Assistant](https://www.splunk.com/en_us/newsroom/press-releases/2025/cisco-elevates-the-soc-with-agentic-ai-for-faster-threat-response-and-reduced-complexity.html). Cisco [announced the Splunk acquisition on September 21, 2023](https://www.cisco.com/site/us/en/about/corporate-development/acquisitions/acquisitions-list-years/index.html) and [completed it on March 18, 2024](https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m03/cisco-completes-acquisition-of-splunk.html).

Quick facts:

- **Deployment:** Splunk SOAR deploys via cloud, on-premises or hybrid, and Splunk SOAR (Cloud) now [runs natively on Microsoft Azure](https://help.splunk.com/en/splunk-soar/soar-cloud/release-notes).
- **Integrations:** Splunk lists 300+ third-party tools and 2,800+ automated actions.
- **Playbooks:** Builders use the Visual Playbook Editor and can open the [underlying Python code](https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/view-or-edit-the-python-code-in-splunk-soar-cloud-playbooks).
- **Licensing:** SOAR is [licensed by user accounts, purchased in increments of five seats](https://help.splunk.com?resourceId=SOAR_Admin_License).

#### Splunk SOAR vs Tines

The Python requirement is the main skills difference between the two:

```json:object
{
  "_key": "k402",
  "_type": "table",
  "rows": [
    {
      "_key": "k397",
      "_type": "tableRow",
      "cells": [
        " ",
        "Splunk SOAR",
        "Tines"
      ]
    },
    {
      "_key": "k398",
      "_type": "tableRow",
      "cells": [
        "Packaging",
        "Included in Enterprise Security Premier",
        "Standalone platform license"
      ]
    },
    {
      "_key": "k399",
      "_type": "tableRow",
      "cells": [
        "Code requirement",
        "Automations must be Python 3.13 compatible from release 8.7.0 (September 2, 2026)",
        "Workflows built without heavy coding (G2 reviewer)"
      ]
    },
    {
      "_key": "k400",
      "_type": "tableRow",
      "cells": [
        "Deployment",
        "Cloud, on-premises or hybrid",
        "Cloud or self-hosted"
      ]
    },
    {
      "_key": "k401",
      "_type": "tableRow",
      "cells": [
        "Licensing",
        "Per user seat",
        "Per autonomous flow"
      ]
    }
  ]
}
```

A June 2, 2026 PeerSpot review states [“The price of Splunk SOAR is high”](https://www.peerspot.com/products/splunk-soar-pros-and-cons). Another PeerSpot comparison calls it [“moderately priced, neither cheap nor overly expensive”](https://www.peerspot.com/products/comparisons/microsoft-sentinel_vs_splunk-soar).

Pros and cons:

- **Pro:** Pairing with Enterprise Security gives one analyst experience across SIEM and SOAR.
- **Pro:** Cloud, on-premises and hybrid options include an [Automation Broker](https://help.splunk.com/en/splunk-soar/splunk-automation-broker/splunk-soar-automation-broker-release-notes/whats-new-in-splunk-soar-automation-broker) for segregated networks.
- **Con:** Custom functions and advanced playbooks require Python, so the team needs scripting skills.
- **Con:** Splunk publishes no SOAR list price.

Choose Splunk SOAR when the SOC already runs Splunk Enterprise Security and has engineers comfortable maintaining Python.

### Palo Alto Networks Cortex XSOAR

Palo Alto Networks describes [Cortex AgentiX as the next generation of Cortex XSOAR](https://www.paloaltonetworks.com/company/press/2025/palo-alto-networks-unveils-cortex-agentix-to-build--deploy-and-govern-the-agentic-workforce-of-the-future). A [February 2026 blog](https://www.paloaltonetworks.com/blog/2026/02/soc-agentic-next-evolution-cortex) calls the standalone Agentix platform the “natural evolution” for XSOAR customers. Current documentation still covers [Cortex XSOAR 8 Cloud](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/Cortex-XSOAR-Releases/Cortex-XSOAR-Releases) and [On-prem releases through 8.13](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.13/Cortex-XSOAR-On-prem-Documentation/Cortex-XSOAR-concepts), so XSOAR remains a current product.

Quick facts:

- **Marketplace:** The XSOAR Marketplace showed [1,232 content packs](https://www.paloaltonetworks.com/cortex/xsoar-ecosystem?_sf_s=uptycs) in November 2026.
- **Air-gapped:** Cortex XSOAR 6.14 [installs offline in an air-gapped environment](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.14/Cortex-XSOAR-Administrator-Guide/Install-the-Server-Offline), and XSOAR 8.10 On-prem documents [offline engine installation](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.10/Cortex-XSOAR-On-prem-Documentation/Engine-air-gap-installation).
- **Licensing:** XSOAR [requires a yearly license per user](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.14/Cortex-XSOAR-Administrator-Guide/Licenses).
- **Suite fit:** Marketplace packs such as XSOAR Incident Exporter push XSOAR incidents into Cortex XSIAM.

#### Cortex XSOAR vs Tines

The two differ most on product direction and licensing:

```json:object
{
  "_key": "k481",
  "_type": "table",
  "rows": [
    {
      "_key": "k476",
      "_type": "tableRow",
      "cells": [
        " ",
        "Cortex XSOAR",
        "Tines"
      ]
    },
    {
      "_key": "k477",
      "_type": "tableRow",
      "cells": [
        "Product direction",
        "Cortex AgentiX positioned as the next generation",
        "Tines Stories continues alongside Tines 3B"
      ]
    },
    {
      "_key": "k478",
      "_type": "tableRow",
      "cells": [
        "Content library",
        "1,232 content packs",
        "Action template library, available in air-gapped deployments"
      ]
    },
    {
      "_key": "k479",
      "_type": "tableRow",
      "cells": [
        "Offline install",
        "6.14 server; 8.10 engine",
        "3B offline bundle"
      ]
    },
    {
      "_key": "k480",
      "_type": "tableRow",
      "cells": [
        "Licensing",
        "Yearly per user",
        "Per autonomous flow"
      ]
    }
  ]
}
```

A 2026 [PeerSpot page](https://www.peerspot.com/products/palo-alto-networks-cortex-xsoar-reviews) says XSOAR “is considered pricey, especially after a 1.5x increase following its acquisition by Palo Alto”. One reviewer, writing on August 23, 2024, [reported a quote](https://www.peerspot.com/questions/what-needs-improvement-with-palo-alto-networks-cortex-xsoar) of “$12,000 per user per year”.

Pros and cons:

- **Pro:** The Marketplace lists 1,232 content packs, and packs such as XSOAR Incident Exporter push incidents into Cortex XSIAM.
- **Pro:** [On-premises deployment](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.13/Cortex-XSOAR-On-prem-Documentation/Cortex-XSOAR-concepts) is documented across many versions, including offline installs.
- **Con:** Per-user licensing [reported by reviewers](https://www.peerspot.com/questions/what-needs-improvement-with-palo-alto-networks-cortex-xsoar) raises the cost of adding analysts.
- **Con:** Packaging is moving toward AgentiX, so buyers should ask how a new XSOAR contract maps to it.

Choose Cortex XSOAR when the SOC already runs Palo Alto Networks Cortex products and needs on-premises deployment with a large content library.

### Microsoft Sentinel

Microsoft describes Sentinel as a SIEM that is also a SOAR platform. Automation rules handle incident tasks without code and trigger playbooks built on Azure Logic Apps. After March 31, 2027, Sentinel will be available only in the Microsoft Defender portal.

Quick facts:

- **Ingestion pricing:** Pay-as-you-go analytics costs $4.3 per GB, the 100 GB commitment tier costs $296 per day, and data lake ingestion is $0.05 per GB (pricing checked November 2026).
- **Automation pricing:** Logic Apps is charged separately. The Consumption plan includes the first 4,000 actions free, then $0.000025 per execution (pricing checked November 2026).
- **AI playbooks:** The Defender portal offers an AI-assisted playbook generator, listed as in preview on February 23, 2026.
- **Latency:** Automation rules can take up to 10 minutes to run after a Defender portal incident is created or updated.

#### Microsoft Sentinel vs Tines

Sentinel keeps automation inside the SIEM, while Tines orchestrates across tools:

```json:object
{
  "_key": "k539",
  "_type": "table",
  "rows": [
    {
      "_key": "k534",
      "_type": "tableRow",
      "cells": [
        " ",
        "Microsoft Sentinel",
        "Tines"
      ]
    },
    {
      "_key": "k535",
      "_type": "tableRow",
      "cells": [
        "Architecture",
        "Automation rules plus Logic Apps playbooks inside the SIEM",
        "Standalone workflow platform"
      ]
    },
    {
      "_key": "k536",
      "_type": "tableRow",
      "cells": [
        "Pricing basis",
        "Per GB ingested, plus Logic Apps charges",
        "Flows and events"
      ]
    },
    {
      "_key": "k537",
      "_type": "tableRow",
      "cells": [
        "AI building",
        "AI playbook generator (preview)",
        "AI Agent action and Workbench"
      ]
    },
    {
      "_key": "k538",
      "_type": "tableRow",
      "cells": [
        "Free usage",
        "Up to 5 MB of free ingestion daily per user for key security logs",
        "Community Edition"
      ]
    }
  ]
}
```

One PeerSpot comparison notes [“Sentinel’s pricing is on the higher side”](https://www.peerspot.com/products/comparisons/graylog-security_vs_microsoft-sentinel) and that “There are also fees for Logic Apps and particular features.” Another calls it [“cost-effective within the Microsoft ecosystem with optimization strategies in place”](https://www.peerspot.com/products/comparisons/anvilogic_vs_microsoft-sentinel).

Pros and cons:

- **Pro:** Detection and response share one data platform, with hundreds of ready-to-use playbooks.
- **Pro:** Commitment tiers save up to 52% over pay-as-you-go.
- **Con:** Ingestion and Logic Apps bills are separate meters, so forecasting takes work.
- **Con:** Teams still in the Azure portal have to move to the Defender portal before March 31, 2027.

Choose Sentinel when the SOC already runs Microsoft Defender and Azure.

### Shuffle

The [Shuffle GitHub repository](https://github.com/shuffle/shuffle) licenses the backend under AGPL-3.0 and the apps, workflows, documentation and App SDK under MIT. AGPL-3.0 is an [Open Source Initiative approved license](https://opensource.org/license/agpl-3-0), so Shuffle is open source in the OSI sense. Shuffle [documents self-hosted open source, self-hosted licensed and Shuffle Cloud installs](https://shuffler.io/docs/architecture).

Quick facts:

- **Free tier:** The Open Source plan on the [pricing page](https://security.shuffler.io/pricing) lists 1 user, 1 tenant, community-level support and docs-based onboarding (pricing checked November 2026).
- **Paid tiers:** The same page lists Standard as “Starts from $1920/month” and Enterprise as contact sales, with “Air Gap Possible.” Earlier versions of the page listed different tier names and figures.
- **Apps:** The pricing page lists [“All 2500+ Apps”](https://security.shuffler.io/pricing).
- **Hosting:** Shuffle deploys on-premises or on GCP, AWS or Azure.

#### Shuffle vs Tines

Shuffle’s and Tines’ free tiers differ in what they include:

```json:object
{
  "_key": "k606",
  "_type": "table",
  "rows": [
    {
      "_key": "k601",
      "_type": "tableRow",
      "cells": [
        " ",
        "Shuffle",
        "Tines"
      ]
    },
    {
      "_key": "k602",
      "_type": "tableRow",
      "cells": [
        "License",
        "AGPL-3.0 backend, MIT apps",
        "Commercial, with a forever-free Community Edition"
      ]
    },
    {
      "_key": "k603",
      "_type": "tableRow",
      "cells": [
        "Free self-hosting",
        "Open source self-hosted",
        "Self-hosting on Business and Enterprise only"
      ]
    },
    {
      "_key": "k604",
      "_type": "tableRow",
      "cells": [
        "Free-tier support",
        "Community level",
        "Basic limits; upgrades through Sales"
      ]
    },
    {
      "_key": "k605",
      "_type": "tableRow",
      "cells": [
        "Apps",
        "2500+",
        "Unlimited connectors"
      ]
    }
  ]
}
```

[G2 lists four Shuffle pricing editions starting at $0](https://www.g2.com/products/shuffle/pricing). Shuffle’s homepage directs teams that want [priority support to the Enterprise plan](https://shuffler.io).

Pros and cons:

- **Pro:** The open source edition self-hosts at no license cost under an OSI-approved license.
- **Pro:** Apps and workflows are MIT-licensed, which the repository describes as usable “for whatever purpose.”
- **Con:** Free-tier support is community-only, so the team carries upgrades and troubleshooting.
- **Con:** Published prices differed between versions of the official pricing page.

Choose Shuffle when license cost is the hard constraint and the team can run and maintain its own infrastructure.

## How to choose the right Tines alternative

Tines remains the right choice for a SOC that wants to design and govern every workflow step, needs self-hosting or air-gapped deployment, and values no-code building; that team should stay on Tines and add capacity around it. Switching makes sense when one of four conditions holds:

- **Team skills:** A team without automation engineers that wants packaged triage fits Torq. A team with Python skills inside Splunk fits Splunk SOAR.
- **AI governance:** Teams that require human approval at defined steps can build it in Tines with pages and change control. Buyers who want the vendor to own triage logic should test Torq or Swimlane against their own alert data.
- **Deployment:** For a current FedRAMP authorization requirement, Swimlane says its cloud includes a FedRAMP-High certified GOV region; confirm the listing on the [FedRAMP Marketplace](https://www.fedramp.gov/marketplace/products). Air-gapped needs can be met by Tines, Swimlane or Cortex XSOAR.
- **Integrations:** Microsoft-centric stacks fit Sentinel. Palo Alto Networks stacks fit Cortex XSOAR.

If the real backlog is access requests, reports and ticket follow-ups, the SOAR choice can stay as it is, and Viktor takes that work instead.

### Budget considerations

Each platform prices on a different unit, so totals cannot be compared without a quote for the same workload. Published and reported figures, pricing checked November 2026:

```json:object
{
  "_key": "k663",
  "_type": "table",
  "rows": [
    {
      "_key": "k655",
      "_type": "tableRow",
      "cells": [
        "Platform",
        "Pricing model",
        "Published or reported figure"
      ]
    },
    {
      "_key": "k656",
      "_type": "tableRow",
      "cells": [
        "Tines",
        "Flows and events; free Community Edition",
        "No paid price published; Vendr reports a $52,228 per year median"
      ]
    },
    {
      "_key": "k657",
      "_type": "tableRow",
      "cells": [
        "Torq",
        "Plan tier plus AI credits",
        "$450,000.00 per plan per 12-month contract on AWS Marketplace (basis not stated); Vendr reports a $185,178 per year median"
      ]
    },
    {
      "_key": "k658",
      "_type": "tableRow",
      "cells": [
        "Swimlane",
        "Daily automated actions, or user-based through sales",
        "No price published"
      ]
    },
    {
      "_key": "k659",
      "_type": "tableRow",
      "cells": [
        "Splunk SOAR",
        "User seats in increments of five",
        "No price published"
      ]
    },
    {
      "_key": "k660",
      "_type": "tableRow",
      "cells": [
        "Cortex XSOAR",
        "Yearly per user",
        "No price published"
      ]
    },
    {
      "_key": "k661",
      "_type": "tableRow",
      "cells": [
        "Microsoft Sentinel",
        "Consumption per GB, plus Logic Apps",
        "$4.3 per GB pay-as-you-go"
      ]
    },
    {
      "_key": "k662",
      "_type": "tableRow",
      "cells": [
        "Shuffle",
        "Free open source; app runs on paid tiers",
        "Standard “Starts from $1920/month”"
      ]
    }
  ]
}
```

Viktor prices on shared workspace credits, and he’s [free to start with up to $100 in credits and no credit card](https://viktor.com/pricing). The Team plan is $100 a month for 40,000 credits for the whole workspace, not per seat, and unused Team credits roll over. Before comparing SOAR quotes, ask every vendor to price the same monthly alert volume, user count and deployment model.

### Migration considerations

Moving from Tines means rebuilding stories, not importing them. Tines itself says successful SOAR migrations “rarely involve a one-to-one port of existing playbooks”. Common failure modes and their fixes:

- **Credential delays:** Rebuilds stall while OAuth apps and API keys are requested. Tines’ migration guide advises creating “a credential for each tool you’ll be connecting to” up front, and the same step applies when moving away from Tines.
- **Copying sprawl:** Porting every workflow as-is carries the old clutter into the new platform. Rationalize first: Tines’ Mars case study reports 200 Splunk playbooks consolidated into 79 stories, though other Tines pages give 50 or 70 for the same project.
- **Coverage gaps at cutover:** Alerts go unhandled while the new platform is incomplete. Run the old and new platforms in parallel during a defined cutover window.
- **Untested logic:** Rebuilt actions fail silently in production. Microsoft’s guidance is to “test the playbooks extensively” after migration.
- **Runtime changes:** Code written for older runtimes stops running. On Splunk SOAR, automations [not compatible with Python 3.13 no longer execute from 8.7.0](https://help.splunk.com?resourceId=SOARonprem_ReleaseNotes_Enhancements), so migrate code to 3.13 before cutover.

Vendor programs reduce rebuild effort. Swimlane claims [up to 90% of Tines workflows migrate automatically](https://swimlane.com/swimlane-vs-tines), and Torq offers [JumpStart for a custom migration roadmap](https://torq.io/blog/xdr-vs-soar-vs-siem). The timelines on record are vendor-published, such as a Tines customer that migrated 45 workflows in a little over 60 days. Start with the highest-volume alert paths and rebuild those first.

## Final recommendations

A SOC’s deployment needs, engineering skills and request backlog determine the right choice:

- **Ops and request work around the SOC:** Keep the SOAR platform and add Viktor for access requests, weekly metrics reports and ticket follow-ups in Slack or Microsoft Teams. [Hand Viktor the weekly security metrics report first, free with up to $100 in credits, no credit card →](https://app.viktor.com/signup)
- **Small SOC without automation engineers:** Start on Tines Community Edition if no-code building fits the team. Evaluate Torq if the team wants packaged autonomous triage instead.
- **Enterprise SOC:** Stay on Tines if self-hosting and designed workflows matter. Choose Splunk SOAR or Cortex XSOAR if the SOC already standardizes on that vendor’s SIEM or XDR.
- **Regulated or air-gapped:** Tines, Swimlane and Cortex XSOAR all document air-gapped installs. Swimlane says its cloud includes a FedRAMP-High certified GOV region.
- **Microsoft-centric:** Use Sentinel automation rules and Logic Apps, and plan the Defender portal move before March 31, 2027.
- **Budget-constrained:** Self-host Shuffle’s open source edition if the team can carry community-only support.

Security reviewers planning a governed rollout can [review Viktor’s security details →](https://viktor.com/security) or [talk to the Viktor team about security review and spend controls →](https://viktor.com/contact-sales).

## FAQ

Tines’ pricing page and Stories knowledge base list different free-tier limits, so buyers should confirm the limits for their intended product before committing.

### How much does Tines cost, and is there a free tier?

Tines publishes no paid-edition price, and its paid tiers route to a demo request. The free edition on the pricing page lists unlimited users, 3 live workflows and a one-time $50 AI allowance, while the knowledge base lists Community Edition at 1 user, 3 flows and 25,000 monthly events (pricing checked November 2026).

### Where is Tines based, and how does it compare in size with rivals?

Tines is co-headquartered in Dublin and Boston and has raised $272 million, including a [$125 million Series C announced February 11, 2025 at a $1.125 billion valuation](https://www.prnewswire.com/news-releases/tines-secures-125m-in-series-c-financing-bringing-total-valuation-to-1-125b-302372726.html). Torq lists [Tel Aviv and Denver headquarters](https://torq.io/contact-us) and has raised [$332 million at a $1.2 billion valuation](https://torq.io/news/torq-seriesd).

### Is Torq better than Tines at autonomous triage?

No, not automatically, since Torq sells autonomous triage as a packaged module while Tines has teams design triage with its AI building blocks. Torq [claims on its blog](https://torq.io/blog/ai-soc-analyst) that Socrates “Offloads 90%+ of Tier-1 Cases”, a vendor figure. Tines gives builders pages and change control to govern each step.

### Are there free or open source Tines alternatives?

Yes, Shuffle’s backend is licensed under AGPL-3.0, with MIT-licensed apps, and its open source edition self-hosts for free. Tines also offers a forever-free Community Edition, but it runs in the cloud only.

### What is the best pick for a small SOC?

A small SOC without automation engineers should first test Tines Community Edition, since [reviewers praise its ease](https://www.g2.com/products/tines/reviews?page=10) of use. Teams that want packaged triage and have an enterprise budget can evaluate Torq. If the team’s time goes mainly to requests and reports, add Viktor alongside either one.

### Which options support on-premises or air-gapped deployment?

Tines 3B ships an offline bundle for air-gapped environments. Swimlane supports on-premises and air-gapped deployment, Cortex XSOAR documents [offline installation](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.14/Cortex-XSOAR-Administrator-Guide/Install-the-Server-Offline), and Shuffle Enterprise lists “Air Gap Possible”.

### Is migrating off Tines difficult?

Yes, migration takes real effort because stories must be rebuilt, tested and run in parallel before cutover. Swimlane claims up to 90% of Tines workflows migrate automatically, a vendor claim worth testing on a sample of workflows before signing.

### What do reviewers like and dislike about Tines?

Reviewers like its ease of use and support: G2 records [73 mentions of Ease of Use](https://www.g2.com/products/tines/reviews?page=3), and Tines holds [4.9 from 57 ratings on Gartner Peer Insights](https://www.gartner.com/reviews/market/security-orchestration-automation-and-response-solutions/vendor/tines). Dislikes center on onboarding, with one PeerSpot reviewer describing a steep learning curve and asking for more example-based documentation.

[Hire your first AI employee: start free with up to $100 in credits, no credit card →](https://app.viktor.com/signup)