Tines
Tines is a no-code workflow platform where security teams build automated stories that call tools and AI models, with a Cases add-on. It places eighth of 14 at 5.62, yet documents 22 of 25 containment actions, the most of any platform. It publishes a free edition with limits and no time-to-contain, approval or audit detail.
What Tines is
Tines describes a no-code workflow platform that security, IT and other teams use to build stories connecting security tools and AI models. It has a Cases add-on for case management and an AI SOC solution page (tines.com, read 2026-11-03).
The docs cover stories, actions, credentials, cases, records, dashboards, a self-hosted deployment and an MCP server. The home page says customers choose which AI models their teams use and decide what goes live.
vendor claim No-code workflow platform where security, IT and other teams build automated workflows (called stories) that connect to security tools and AI models. Includes a Cases add-on for case management and an AI SOC solution page. tines.com, read
Products named: Tines (workflow platform), Story library, Docs.
Ownership. No acquisition, acquired-by or rebrand event found in one news search dated 2026-11-03. Search returned funding and partnership news only. tines.com, read
no figureon the pages read
Published time to contain
No figure on time to contain, or on any adjacent response metric, was found for Tines on the pages read. No time-to-contain or MTTR figure on the pages read.
22 of 255 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Tines documents 22 as native or partner on the pages read: 22 native, 0 partner, 0 custom step only, 3 not documented. Coverage share is 88 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Tines22 of 25 documented | Tines: Quarantine a delivered message, not documented | Tines: Revoke OAuth app consent, not documented | Tines: Disable a switch port or NAC quarantine, not documented | ||||||||||||||||||||||
Basis: Per-tool pre-built action template lists on tines.com (read through all pages with a headless browser because the lists page client-side) and Tines library stories. Templates are Tines-built, read as native. Read 2026-11-03.
Limits: Template names are the only evidence; the Tines docs site was not needed. Generic HTTP request step exists for any API.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
5.62rank 8 of 14
Rubric scores
Tines is in a band with Cyware (6.11), Google Security Operations (6.09), Palo Alto Cortex XSOAR (5.91), Swimlane (Turbine) (5.84), Splunk SOAR (Cisco) (5.79), Torq (5.74). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 8.6 | 2.150 | documented. 22 of 25 containment actions documented as native or partner (88 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 3.0 | 0.450 | not documented. No MTTR or containment figure on the pages read. tines.com, read |
| Approval, rollback and blast-radius controls documented | 15 | 3.5 | 0.525 | not documented. The product page says Agents enable "autonomous workflow activity and user interaction" but states no approval step, rollback or scope limit. tines.com, read |
| Explanation and audit trail | 15 | 5.0 | 0.750 | partial. Cases are described as "case and incident management" with a collaborative workspace; no audit log or per-action record is stated. tines.com, read |
| Integration depth documented | 10 | 6.5 | 0.650 | partial. Product search shows "521 products" as integrations; action-level detail not read. tines.com, read |
| Detection-to-response coupling | 8 | 6.5 | 0.520 | partial. Report triage example accepts "automated webhook notifications", so direct ingestion by webhook is shown; SIEM is not mentioned. tines.com, read |
| Pricing transparency | 6 | 5.5 | 0.330 | partial. A free edition with 3 live workflows and a one-time USD 50 AI allowance is published; paid editions show no price, "Get pricing" through a demo. tines.com, read |
| Deployment and data handling | 6 | 4.0 | 0.240 | not documented. Pricing page says "Flexible hosting options are available" without naming them; data handling is not stated. tines.com, read |
| Total | 100 | 5.62 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Tines is strong
- The report triage example accepts automated webhook notifications, so direct ingestion by webhook is shown and a SIEM is not mentioned. tines.com, read
- A self-hosted option is listed in the docs sidebar alongside the cloud default, and the docs cover cases and an MCP server. Hosting options are named only as flexible on the pricing page. tines.com, read
- The pricing page publishes a free edition with 3 live workflows and a one-time USD 50 AI allowance. Paid editions are quoted by demo. tines.com, read
Where Tines is behind
- Time-to-contain evidence: none. No MTTR, MTTD, accuracy or closure figure appears on the home page, blog index, docs or pricing page. The one numeric anecdote, over 1000 workflows in 90 days, is an internal rollout count. tines.com, read
- The product page says Agents enable autonomous workflow activity and user interaction, but states no approval step, rollback or scope limit. A buyer must design the gates in the story. tines.com, read
- Cases are described as case and incident management with a collaborative workspace. No audit log or per-action record is stated. tines.com, read
What only Tines has
Tines was reported to have raised USD 125 million at a USD 1.1 billion valuation, per a PYMNTS item, though the round date is not confirmed. pymnts.com, read
1prices listed
Pricing as published
vendor claim Free edition with limited features, plus paid editions with unlisted pricing that are obtained by booking a demo. Free edition includes 3 live workflows and a one-time USD 50 AI allowance. tines.com, read
| Item | Price | Source |
|---|---|---|
| Free edition, one-time AI allowance | USD 50 one-time | tines.com, read |
Trial or free tier. Free edition is the only self-serve entry on the pricing page. No separate trial is listed. tines.com, read
Integrations. No count published; named: CrowdStrike, Wiz, Recorded Future, Panther, Elastic, Drata, Jira Software, Slack, Microsoft Teams, VirusTotal, AbuseIPDB, URLScan.io, Cisco, Bitsight. vendor claim tines.com, read
22names on its pages
Named customers
Customers below are names on Tines's own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
5dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2026-07-28 | Tines takes on vibe coding with new platform (Irish Times coverage). Press coverage listed on the newsroom page. Date from the newsroom listing. | tines.com, read |
| 2026-07 | Tines launches Government Solutions for the public sector (PR Newswire). Date inferred from newsroom image timestamp, not a printed date. Verify before use. | vendor claim tines.com, read |
| 2026-07 | Deloitte and Tines announce collaboration on operationalising AI and automation. Date inferred from newsroom image timestamp. Verify before use. | vendor claim tines.com, read |
| 2026-01-15 | Tines launches AI interaction layer to unify agents, copilots and workflows (SiliconANGLE). Secondary source. Seen in a search result, not read on the primary page. | siliconangle.com, read |
| 2025-12-04 | SpecterOps and Tines partner on native BloodHound integration for attack path automation. Release dated 2025-12-04, read on the SpecterOps news page (the original; the press-wire copy was unreachable). | specterops.io, read |
2graded
Claims Tines makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| Over 1000 workflows went live after all employees were given access to Tines 3B, over a 90-day period | Internal Tines rollout, one company. Measured by vendor. | C | vendor claim tines.com, read |
| Finance team built a custom billing app for under USD 1,000 after being quoted six figures for a tool | One internal app. Measured by vendor. | C | vendor claim tines.com, read |
Who should shortlist Tines
- You want to build your own response workflows and gates, and have engineers to do it.
- You want a free edition to prototype containment steps before any purchase.
- You need a self-hosted deployment option.
Tines places 8th of 14 at a total of 5.62, with 22 of 25 containment actions documented. The widest documented containment coverage on the scorecard, 22 of 25 actions, held back on the total by thin approval, audit and time-to-contain detail. A free edition with limits lets a team test the workflows. It shares a band with Cyware, Google Security Operations, Palo Alto Cortex XSOAR, Swimlane, Splunk SOAR and Torq.
The same platform under other weights
- Regulated financial: 9th of 14, total 5.36.
- Lean team: 7th of 14, total 5.69.
- MSSP: 7th of 14, total 5.68.
- Microsoft estate: 5th of 14, total 5.83.
- CrowdStrike estate: 5th of 14, total 5.91.
Compare Tines
- Tines alternatives: 3 gaps and 5 platforms that answer them.
- Tines against Torq, totals 5.62 and 5.74.
- Tines against Splunk SOAR (Cisco), totals 5.62 and 5.79.
- Tines against Swimlane (Turbine), totals 5.62 and 5.84.
- Tines against Palo Alto Cortex XSOAR, totals 5.62 and 5.91.
Facts on this page were read 2026-11-03 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.