Google Security Operations vs Splunk SOAR (Cisco)

Google Security Operations is a cloud SIEM with SOAR and a Response Agent in Private Preview. Splunk SOAR (Cisco) is a Cisco-owned SOAR product sold alone or with Splunk Enterprise Security. The rubric reads Google Security Operations as documented and Splunk SOAR (Cisco) as not documented on approval, rollback and blast radius, from pages read 2026-11-03.

6.09to5.79Totals on the published rubric: Google Security Operations 3rd, Splunk SOAR (Cisco) 6th of 14. They share a band, 0.29 apart, so the evidence does not order them.

0.29points apart

The difference that decides it

On approval, rollback and blast radius, Google Security Operations documents manual approval as the default for the Response Agent, autonomous thresholds at Low, Medium or High risk, and per-integration or per-action overrides, in Private Preview and with no rollback, while Splunk SOAR (Cisco) states no approval, rollback or blast-radius control on the page read. docs.cloud.google.com, read 2026-11-03

8criteria

Rubric side by side

Each criterion is scored 0 to 10 from the vendor's own pages; points are weight times score divided by 100.
Criterion	Weight	Google Security Operations	Splunk SOAR (Cisco)	Gap, first minus second
Native containment coverage (19 and 19 of 25 actions)	25	7.7	7.7	level
Published time-to-contain evidence with method	15	3.5	5.5	-2.0
Approval, rollback and blast-radius controls documented	15	8.0	3.0	+5.0
Explanation and audit trail	15	6.5	4.0	+2.5
Integration depth documented	10	4.0	8.5	-4.5
Detection-to-response coupling	8	8.0	6.0	+2.0
Pricing transparency	6	3.5	4.5	-1.0
Deployment and data handling	6	3.5	6.5	-3.0
Total	100	6.09	5.79	0.29

Full reasons and sources for every score are on the profiles of Google Security Operations and Splunk SOAR (Cisco).

8.0 : 3.0approval score each

Approval and rollback controls

Google Security Operations. Docs state manual approval as default, autonomous thresholds at Low, Medium or High risk, and per-integration or per-action overrides (Autonomous, Default, Manual Approval); no rollback; feature is Pre-GA in Private Preview. docs.cloud.google.com, read 2026-11-03

Splunk SOAR (Cisco). No approval, rollback or blast-radius control is stated on the page read. splunk.com, read 2026-11-03

19 : 19actions of 25

Containment coverage by domain

Domain	Google Security Operations	Splunk SOAR (Cisco)
EDR	6 of 6	6 of 6
Identity	4 of 5	4 of 5
Email	3 of 5	3 of 5
Cloud	3 of 5	3 of 5
Network	3 of 4	3 of 4
All five	19 of 25	19 of 25

Published time to contain: Google Security Operations, no published figure; Splunk SOAR (Cisco), no published figure.

4buyer types

Verdict by buyer type

regulated financial: Google Security Operations has the stronger published case on approval and audit: it documents approval thresholds by risk tier, in Private Preview, with execution history. Splunk SOAR (Cisco) states neither approval controls nor an audit trail on the pages read.
lean team: Neither is easier to size up before a call. Google Security Operations ships SOAR inside the SIEM, with no readable pricing page; Splunk SOAR (Cisco) offers a free trial with no credit card but no price list.
MSSP: Neither Google Security Operations nor Splunk SOAR (Cisco) states MSSP terms on the pages read. Ask both for multitenant approval settings and per-client audit exports.
Microsoft estate: Only Google Security Operations says anything specific: it ingests Office 365 and Azure AD logs, per its product page. Splunk SOAR (Cisco) states no Microsoft-specific detail on the pages read.

When to pick each

Pick Google Security Operations when approval controls must be readable in the docs, because it documents manual approval as the default for the Response Agent, autonomous thresholds at Low, Medium or High risk, and per-integration or per-action overrides, in Private Preview and with no rollback.

Pick Splunk SOAR (Cisco) when connector count and breadth matter most, because it states 2,800+ automated actions and 300+ third-party tools, a tool count and an action count.

Read dates are on each source link. See also Google Security Operations alternatives and Splunk SOAR (Cisco) alternatives, or the buyer-type rankings.