Swimlane (Turbine)
Swimlane sells Turbine, an automation platform that routes each alert to deterministic playbooks, AI-assisted investigation or fully agentic investigation (vendor claim). It places fifth of 14 at 5.84, with 18 of 25 containment actions documented. A customer quote claims containment in under 5 minutes with no method, and no price or integration count is published.
What Swimlane (Turbine) is
Turbine is described by the vendor as an agentic AI automation platform for security operations. It routes each alert to deterministic playbooks, AI-assisted investigation or fully agentic investigation, chosen per alert (swimlane.com, read 2026-11-03, vendor claim).
A 2026-01-27 release, read through a search result because Business Wire returned 403, says Turbine playbooks act as orchestrators and guardrails for the AI agents. An August 2026 release, read from a syndicated copy, adds model selection and bring-your-own-model.
vendor claim Swimlane Turbine is an agentic AI automation platform for security operations. It routes each alert to deterministic playbooks, AI-assisted investigation or fully agentic investigation. swimlane.com, read
Products named: Swimlane Turbine.
under 5 mingrade C
Published time to contain
| Figure | Metric | Sample and who measured | Grade | Source |
|---|---|---|---|---|
| MTTR down to 6.7 minutes with Hero AI | time to respond or remediate | Swimlane's own SOC, sample and period not stated on the listing page. Measured by vendor (internal use). Date: not stated on listing page. | C | vendor claim swimlane.com, read |
| Sub-5 minute threat containment | time to contain | one customer (Thetabyte, Africa energy), details not read. Measured by customer testimonial published by the vendor. Date: not stated on listing page. | C | vendor claim swimlane.com, read |
Swimlane (Turbine)'s figure reaches grade C: a vendor number with no sample, so it is not comparable with a number measured another way. The guide to vendor response-time numbers lists the questions to ask.
18 of 255 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Swimlane (Turbine) documents 18 as native or partner on the pages read: 18 native, 0 partner, 0 custom step only, 7 not documented. Coverage share is 72 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Swimlane18 of 25 documented | Swimlane: Kill process, not documented | Swimlane: Quarantine a delivered message, not documented | Swimlane: Remove a URL rewrite exemption, not documented | Swimlane: Pull from quarantine, not documented | Swimlane: Revoke cloud session, not documented | Swimlane: Revoke OAuth app consent, not documented | Swimlane: Add to a threat list on the NDR, not documented | ||||||||||||||||||
Basis: Capability sections of the Turbine connector documentation on docs.swimlane.com. The marketplace site is a script-rendered page that returns no content to a plain fetch. Read 2026-11-03.
Limits: Connector capability lists are short bullet lists; some names are generic (for example, a take-action capability) so the exact verb was read from the description.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
5.84rank 5 of 14
Rubric scores
Swimlane (Turbine) is in a band with Cyware (6.11), Google Security Operations (6.09), Palo Alto Cortex XSOAR (5.91), Splunk SOAR (Cisco) (5.79), Torq (5.74), Tines (5.62). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 7.4 | 1.850 | documented. 18 of 25 containment actions documented as native or partner (72 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 5.0 | 0.750 | partial. A resource titled "MTTR Down to 6.7 Min with Hero AI" is linked; the page does not describe its method, and the blog page gives no time-to-contain figure. vendor claim swimlane.com, read |
| Approval, rollback and blast-radius controls documented | 15 | 5.0 | 0.750 | partial. Only "complex cases escalate to human-in-the-loop review" is stated; no approval tiers, rollback or scope limit. vendor claim swimlane.com, read |
| Explanation and audit trail | 15 | 6.0 | 0.900 | partial. Page says "every action is auditable" and describes AI-driven case management, without record contents or retention. vendor claim swimlane.com, read |
| Integration depth documented | 10 | 5.5 | 0.550 | partial. No integration count; the page shows 24 vendor tiles and an "ever-expanding list of pre-built connectors". swimlane.com, read |
| Detection-to-response coupling | 8 | 7.0 | 0.560 | partial. Page says customer detection logic alerts "flow into the same routing model as alerts from SIEM, EDR and cloud security tools", so a SIEM is not stated as required. vendor claim swimlane.com, read |
| Pricing transparency | 6 | 3.0 | 0.180 | not documented. Pricing is not published; page mentions tiered enterprise and MSSP options through sales. swimlane.com, read |
| Deployment and data handling | 6 | 5.0 | 0.300 | partial. Cloud-native SaaS is described; on-premises, data residency and handling are not stated, and a Trust Center link was not read. swimlane.com, read |
| Total | 100 | 5.84 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Swimlane (Turbine) is strong
- Vendor claim: each alert is routed to deterministic playbooks, AI-assisted investigation or fully agentic investigation. The routing gives a buyer a way to keep response steps deterministic while AI handles triage. swimlane.com, read
- Vendor claim: customer detection logic alerts flow into the same routing model as alerts from SIEM, EDR and cloud security tools, so a SIEM is not stated as required. swimlane.com, read
- Per the 2026-01-27 release headline, Turbine playbooks act as orchestrators and guardrails for the AI agents. The Business Wire page itself returned 403, so only the search result was read. businesswire.com, read
Where Swimlane (Turbine) is behind
- Time-to-contain evidence: a figure without a method. The customers page quotes Thetabyte reporting threats contained in under 5 minutes and a 70 percent cut in incident response time, with no period or measurement. A linked resource titled MTTR down to 6.7 min with Hero AI describes no method. swimlane.com, read
- Only complex cases escalating to human-in-the-loop review is stated. No approval tiers, rollback or scope limit appear on the page, and audit is described as every action auditable without record contents. swimlane.com, read
- No price is published, and the pricing URL returned 404. There is no integration count: the page shows 24 vendor tiles and a list of pre-built connectors with no action detail. swimlane.com, read
What only Swimlane (Turbine) has
Swimlane's August 2026 Turbine release adds model selection to manage AI costs and lets customers bring their own model, per a syndicated copy of the release. swimlane.com, read
nonelisted
Pricing as published
vendor claim No price is published on the home page read. The pricing URL (swimlane.com/pricing/) returned 404 on 2026-11-03. swimlane.com, read
15names on its pages
Named customers
Customers below are names on Swimlane (Turbine)'s own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- Lincoln Financial Group, Comcast, BMW, Caterpillar, Capgemini, Amgen, Harvard University, Prudential Financial. swimlane.com, read
- Victrix, AHEAD, Softcat, ProCircular, Thetabyte, Northland Power, InComm Payments. swimlane.com, read
3dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2026-08 | Turbine release: intelligent routing for the AI SOC, with model selection and bring-your-own-model. Routes each alert to automation, AI-assisted investigation or fully agentic investigation. Adds model selection to manage AI costs and lets customers bring their own model. Read from the release on the Swimlane newsroom. | vendor claim swimlane.com, read |
| 2026-02-18 | Swimlane announces AI SOC product, available now. Announced through SiliconANGLE coverage. Primary release not opened. | vendor claim siliconangle.com, read |
| 2026-01-27 | Swimlane unveils fleet of Hero AI agents and Agent Builder. Turbine playbooks act as orchestrators and guardrails for the AI agents, per the release. Business Wire page returned 403 on fetch; date and title from the search result. | vendor claim businesswire.com, read |
6graded
Claims Swimlane (Turbine) makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| Cuts investigation cost by 90 percent while investigating 180 threats per day (unnamed healthcare customer) | one unnamed healthcare customer. Measured by customer. | C | vendor claim swimlane.com, read |
| Hero AI reduces MTTR by 75 percent and closes cases autonomously | not stated. Measured by vendor. | C | vendor claim swimlane.com, read |
| Adds 20x analyst capacity while cutting costs up to 90 percent | not stated. Measured by vendor. | C | vendor claim swimlane.com, read |
| Thetabyte: 70 percent incident response time reduction, threats contained in under 5 minutes | one customer (Thetabyte). Measured by customer. | C | vendor claim swimlane.com, read |
| Victrix: 100 percent AI recommendation accuracy | not stated. Measured by customer. | C | vendor claim swimlane.com, read |
| AHEAD: 30 percent reduction in alerts with alert correlation | one customer (AHEAD). Measured by customer. | C | vendor claim swimlane.com, read |
Who should shortlist Swimlane (Turbine)
- You want to keep deterministic playbooks as the control layer while AI handles triage and investigation.
- Your detections are custom and you want them to enter the same routing as SIEM and EDR alerts.
- You buy for an MSSP or a large enterprise and will negotiate tiers through sales.
Swimlane (Turbine) places 5th of 14 at a total of 5.84, with 18 of 25 containment actions documented. A solid orchestration option with 18 of 25 documented actions and three ways to route an alert. The under 5 minutes figure is a customer claim, a testimonial published by the vendor, with no method. It shares a band with Cyware, Google Security Operations, Palo Alto Cortex XSOAR, Splunk SOAR, Torq and Tines, so the order inside it is not settled by the evidence.
The same platform under other weights
- Regulated financial: 6th of 14, total 5.79.
- Lean team: 6th of 14, total 5.69.
- MSSP: 6th of 14, total 5.72.
- Microsoft estate: 4th of 14, total 5.86.
- CrowdStrike estate: 4th of 14, total 5.95.
Compare Swimlane (Turbine)
- Swimlane (Turbine) alternatives: 3 gaps and 5 platforms that answer them.
- Swimlane (Turbine) against Splunk SOAR (Cisco), totals 5.84 and 5.79.
- Swimlane (Turbine) against Palo Alto Cortex XSOAR, totals 5.84 and 5.91.
- Swimlane (Turbine) against Torq, totals 5.84 and 5.74.
- Swimlane (Turbine) against Tines, totals 5.84 and 5.62.
Facts on this page were read 2026-11-03 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.