Fourteen platforms in rank order
Each profile shows the platform's total on the published rubric, its containment coverage of 25 actions, the time to contain it publishes, and the source and read date for every vendor fact.
14platforms scored
Rank, total and coverage
| Rank | Platform | Total | Actions of 25 | Published time to contain | In short |
|---|---|---|---|---|---|
| 1 | D3 Security | 7.08 | 19 | 4 to 8 minutes, vendor claim, grade C | D3 Security sells Morpheus, an AI security operations platform with a deterministic playbook engine and four autonomy modes. |
| 2 | Cyware | 6.11 | 17 | no published figure | Cyware sells Orchestrate, a low-code automation product for playbooks across SIEM, EDR and other tools, beside a threat intelligence platform. |
| 3 | Google Security Operations | 6.09 | 19 | no published figure | Google Security Operations combines a SIEM, SOAR and Gemini features, and its Response Agent documents approval modes by risk tier. |
| 4 | Palo Alto Cortex XSOAR | 5.91 | 20 | no published figure | Palo Alto Cortex XSOAR is a SOAR product with a visual playbook editor and a 900+ pack count, and Palo Alto names Cortex AgentiX as its successor. |
| 5 | Swimlane (Turbine) | 5.84 | 18 | under 5 minutes, customer claim, grade C | Swimlane sells Turbine, an automation platform that routes each alert to deterministic playbooks, AI-assisted investigation or fully agentic investigation (vendor claim). |
| 6 | Splunk SOAR (Cisco) | 5.79 | 19 | no published figure | Splunk SOAR, owned by Cisco, publishes 2,800+ automated actions across 300+ third-party tools and deploys in the cloud, on premises or hybrid. |
| 7 | Torq | 5.74 | 13 | no published figure | Torq sells an AI SOC platform with triage, investigation and response, and states that every verdict, decision, exception and override is captured. |
| 8 | Tines | 5.62 | 22 | no published figure | Tines is a no-code workflow platform where security teams build automated stories that call tools and AI models, with a Cases add-on. |
| 9 | Microsoft Sentinel | 5.14 | 9 | no published figure | Microsoft Sentinel is a cloud SIEM whose automation rules and Logic Apps playbooks take incidents from the same product, including those ingested from Microsoft Defender XDR. |
| 10 | Dropzone AI | 5.00 | 2 | no published figure | Dropzone AI sells a SOC platform that describes itself as agentic, with three agents for alert investigation, threat hunting and threat intelligence, and says analysts own every verdict. |
| 11 | Prophet Security | 4.87 | 0 | no published figure | Prophet Security sells an AI SOC platform that describes itself as agentic and triages alerts and responds through scoped actions, deployed single-tenant. |
| 11 | Mate Security | 4.87 | 0 | no published figure | Mate Security sells a security operations platform that describes itself as agentic and announced a Series A on 2026-07-28. |
| 13 | ServiceNow Security Operations | 4.16 | 7 | no published figure | ServiceNow Security Operations covers security incident response and exposure management on the ServiceNow platform. |
| 14 | CrowdStrike Falcon Fusion SOAR | 3.49 | 0 (docs behind login) | no published figure | CrowdStrike Falcon Fusion SOAR is no-code workflow automation inside the Falcon platform, and Charlotte Agentic SOAR adds agents with autonomy set per workflow. |
Considered and not ranked
Four platforms were read for the scorecard and are not ranked. They appear on the scorecard with their cells.
- ThreatConnect: redirects to Dataminr.
- Revelstoke (Arctic Wolf): absorbed into Arctic Wolf.
- Exabeam: reserve slot, thin public docs on containment.
- BlinkOps: site returned 403 during research; profile if the enrichment pass fills it.