D3 Security vs Tines
D3 Security is an AI SOC platform that keeps a deterministic playbook engine beside four autonomy modes. Tines is a no-code workflow platform with a Cases add-on and an AI SOC page. They split on approval, rollback and blast radius, where the rubric reads D3 Security as documented and Tines as not documented on the pages read on 2026-11-03.
1.47points apart
The difference that decides it
On approval, rollback and blast radius, Tines says agents allow autonomous workflow activity and states no approval step, rollback or scope limit; D3 Security states built-in approval gates at every command-risk tier and four autonomy modes from Deterministic to Autonomous, but publishes no rollback or blast-radius control. d3security.com, read
8criteria
Rubric side by side
| Criterion | Weight | D3 Security | Tines | Gap, first minus second |
|---|---|---|---|---|
| Native containment coverage (19 and 22 of 25 actions) | 25 | 7.7 | 8.6 | -0.9 |
| Published time-to-contain evidence with method | 15 | 4.0 | 3.0 | +1.0 |
| Approval, rollback and blast-radius controls documented | 15 | 8.0 | 3.5 | +4.5 |
| Explanation and audit trail | 15 | 8.5 | 5.0 | +3.5 |
| Integration depth documented | 10 | 8.5 | 6.5 | +2.0 |
| Detection-to-response coupling | 8 | 6.0 | 6.5 | -0.5 |
| Pricing transparency | 6 | 3.5 | 5.5 | -2.0 |
| Deployment and data handling | 6 | 9.0 | 4.0 | +5.0 |
| Total | 100 | 7.08 | 5.62 | 1.47 |
Full reasons and sources for every score are on the profiles of D3 Security and Tines.
8.0 : 3.5approval score each
Approval and rollback controls
D3 Security. Page states "Built-in approval gates at every command-risk tier" and configurable gates for autonomous modes; rollback and blast-radius controls are not stated. d3security.com, read
Tines. The product page says Agents enable "autonomous workflow activity and user interaction" but states no approval step, rollback or scope limit. tines.com, read
19 : 22actions of 25
Containment coverage by domain
| Domain | D3 Security | Tines |
|---|---|---|
| EDR | 6 of 6 | 6 of 6 |
| Identity | 4 of 5 | 5 of 5 |
| 3 of 5 | 4 of 5 | |
| Cloud | 3 of 5 | 4 of 5 |
| Network | 3 of 4 | 3 of 4 |
| All five | 19 of 25 | 22 of 25 |
Published time to contain: D3 Security, 4 to 8 minutes (vendor claim, grade C); Tines, no published figure.
5buyer types
Verdict by buyer type
- regulated financial
- D3 Security has the stronger published case on approval and audit: it documents approval gates at every risk tier and an immutable audit record. Tines states neither an approval step nor an audit log on the pages read.
- lean team
- Tines is easier to size up before a call: it publishes a free edition with 3 live workflows. D3 Security prices by alert volume tier, shows no amounts, and lists SIEM, EDR and XDR integrations.
- MSSP
- Only D3 Security states anything for MSSPs: it reports cutting 145,000 alerts to 200 for human review at one unnamed MSSP customer (vendor claim). Tines states no MSSP terms on the pages read.
- Microsoft estate
- Both name Microsoft pieces. D3 Security names Microsoft Sentinel and Microsoft Defender among its connectors; Tines lists Microsoft and Microsoft Teams in its story library.
- CrowdStrike estate
- Both name CrowdStrike pieces. D3 Security names CrowdStrike among its connectors; Tines lists CrowdStrike in its story library.
When to pick each
Pick D3 Security when approval controls must be readable in the docs, because it states built-in approval gates at every command-risk tier and four autonomy modes from Deterministic to Autonomous, but publishes no rollback or blast-radius control.
Pick Tines when detection and response should arrive in one product, because it accepts automated webhook notifications and does not mention a SIEM.
Read dates are on each source link. See also D3 Security alternatives and Tines alternatives, or the buyer-type rankings.