Which scores higher, Splunk SOAR (Cisco) or Torq?

Splunk SOAR (Cisco), 5.79 to 5.74 on the published rubric; they share a band, so the evidence does not order them. Torq scores higher on 2 of the eight criteria, and Splunk SOAR (Cisco) on 6.

Which documents more containment actions, Splunk SOAR (Cisco) or Torq?

Splunk SOAR (Cisco), with 19 of 25 as native or partner on the pages read, against 13 for Torq. The scorecard links every counted cell to the vendor page it was read from.

Do Splunk SOAR (Cisco) and Torq publish a time to contain?

Neither publishes a time to contain. A grade C figure has no published sample or method, so it is not comparable with a number measured another way.

Splunk SOAR (Cisco) vs Torq: which documents the audit trail?

Splunk SOAR (Cisco) and Torq are a draw inside one band (5.79 to 5.74 on the published rubric, 0.05 apart), so the evidence does not order them. The widest gap between them is on the explanation and audit trail, where Torq scores 8.0 against 4.0 for Splunk SOAR. Splunk SOAR scores higher on 6 of the eight criteria and Torq on 2. Neither publishes a time to contain.

Splunk SOAR (Cisco) is a Cisco-owned SOAR product sold alone or with Splunk Enterprise Security. Torq is an AI SOC platform with hyperautomation, case management and agent products. They split on what a reviewer can read after an action, where the rubric reads Splunk SOAR (Cisco) as not documented and Torq as documented on the pages read on 2026-11-03.

5.79to5.74Totals on the published rubric: Splunk SOAR (Cisco) 6th, Torq 7th of 14. They share a band, 0.05 apart, so the evidence does not order them.

0.05points apart

Which rows matter most inside this band?

The widest gap between them is on the explanation and audit trail, where Torq scores 8.0 against 4.0 for Splunk SOAR. That row carries 15 points of 100, a difference of 0.60 on the total. Splunk SOAR (Cisco) scores higher on 6 of the eight criteria and Torq on 2.

On what a reviewer can read after an action, Splunk SOAR (Cisco) names case management but describes no audit trail or per-action record, while Torq says every verdict, decision, exception and override is captured with context, though the page states this for triage. Source: torq.io · Read 2026-11-03

8criteria

How do they score criterion by criterion?

Each criterion is scored 0 to 10 from the vendor's own pages; points are weight times score divided by 100.
Criterion	Weight	Splunk SOAR (Cisco)	Torq	Gap, first minus second
Native containment coverage (19 and 13 of 25 actions)	25	7.7	5.9	+1.8
Published time-to-contain evidence with method	15	5.5	4.0	+1.5
Approval, rollback and blast-radius controls documented	15	3.0	6.5	-3.5
Explanation and audit trail	15	4.0	8.0	-4.0
Integration depth documented	10	8.5	7.0	+1.5
Detection-to-response coupling	8	6.0	5.0	+1.0
Pricing transparency	6	4.5	3.0	+1.5
Deployment and data handling	6	6.5	3.5	+3.0
Total	100	5.79	5.74	0.05

Full reasons and sources for every score are on the reviews of Splunk SOAR (Cisco) and Torq.

8criteria compared

What separates this pair?

For each criterion where the two scores differ, and always for approval controls and containment coverage, the reason recorded for each platform and the page it was read from, widest weighted gap first. Each score is a proposal under the published rubric bands, and a vendor's statement about itself is labelled a vendor claim.

The explanation and audit trail, 15 points: Splunk SOAR (Cisco) 4.0, Torq 8.0

Splunk SOAR (Cisco). Page names "Comprehensive case management" but describes no audit trail or per-action record.Source: splunk.com/en_us/products/splunk-security-orc... · Read 2026-11-03

Torq. Page says "Transparent audit logs" and "Every verdict, decision, exception, and override is captured with surrounding context of when and why" vendor claim, though stated for triage.Source: torq.io · Read 2026-11-03

Approval and rollback controls, 15 points: Splunk SOAR (Cisco) 3.0, Torq 6.5

Splunk SOAR (Cisco). No approval, rollback or blast-radius control is stated on the page read.Source: splunk.com/en_us/products/splunk-security-orc... · Read 2026-11-03

Torq. Page says response runs fully autonomously or with human-on-the-loop oversight and cites a manual override vendor claim; no tiers, rollback or scope limit.Source: torq.io · Read 2026-11-03

Native containment coverage, 25 points: Splunk SOAR (Cisco) 7.7, Torq 5.9

Splunk SOAR (Cisco). 19 of 25 containment actions documented as native or partner (76 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5.Source: the containment coverage scorecard · Read 2026-11-03

Torq. 13 of 25 containment actions documented as native or partner (52 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5.Source: the containment coverage scorecard · Read 2026-11-03

Time-to-contain evidence, 15 points: Splunk SOAR (Cisco) 5.5, Torq 4.0

Splunk SOAR (Cisco). Customer claims only: Tide "minutes to respond ... compared to hours previously" and "up to 95% of incident responses automated" vendor claim, no method; the 7-minute figure is detection, not containment.Source: splunk.com/en_us/products/splunk-security-orc... · Read 2026-11-03

Torq. Page says "Slash mean time to respond" vendor claim with no figure; a separate vendor claim of closing over 90 percent of cases autonomously is a closure rate, not a containment time.Source: torq.io · Read 2026-11-03

Deployment and data handling, 6 points: Splunk SOAR (Cisco) 6.5, Torq 3.5

Splunk SOAR (Cisco). Page says deployment is "via the cloud, on-premises or hybrid"; data handling, retention and residency are not stated.Source: splunk.com/en_us/products/splunk-security-orc... · Read 2026-11-03

Torq. Deployment options are not stated; AI governance and data governance pages are linked but were not read.Source: torq.io · Read 2026-11-03

Integration depth, 10 points: Splunk SOAR (Cisco) 8.5, Torq 7.0

Splunk SOAR (Cisco). Page states "2,800+ automated actions" and "300+ third-party tools", both a tool count and an action count. vendor claimSource: splunk.com/en_us/products/splunk-security-orc... · Read 2026-11-03

Torq. The Torq page read gives no count; a secondary read of Torq pages reports 300 integrations and 4,000+ steps, which needs a primary check. secondary sourceSource: torq.io · Read 2026-11-03

Pricing transparency, 6 points: Splunk SOAR (Cisco) 4.5, Torq 3.0

Splunk SOAR (Cisco). No prices; a free trial with no credit card is offered.Source: splunk.com/en_us/products/splunk-security-orc... · Read 2026-11-03

Torq. No price on the page; a secondary read recorded the pricing URL as a 404 on 2026-10-11.Source: torq.io · Read 2026-11-03

Detection-to-response coupling, 8 points: Splunk SOAR (Cisco) 6.0, Torq 5.0

Splunk SOAR (Cisco). Page says SOAR consolidates "alerts and data from the various tools in your environment" and that Enterprise Security integration needs a Splunk SOAR subscription; whether a SIEM is required is not stated.Source: splunk.com/en_us/products/splunk-security-orc... · Read 2026-11-03

Torq. Page describes de-duplicating "unprocessed events" but does not say whether a SIEM is required.Source: torq.io · Read 2026-11-03

19 : 13actions of 25

How many containment actions does each document?

Domain	Splunk SOAR (Cisco)	Torq
EDR	6 of 6	4 of 6
Identity	4 of 5	4 of 5
Email	3 of 5	1 of 5
Cloud	3 of 5	3 of 5
Network	3 of 4	1 of 4
All five	19 of 25	13 of 25

Neither publishes a time to contain. A cell counts only when the vendor's own documentation shows the action against a named target; the scorecard links every counted cell to that page.

3buyer types

Which fits each buyer type?

regulated financial: Torq has the stronger published case on approval and audit: it documents audit logs and human-on-the-loop oversight, with no tiers or rollback. Splunk SOAR (Cisco) states neither approval controls nor an audit trail on the pages read.
lean team: Splunk SOAR (Cisco) is easier to size up before a call: it offers a free trial with no credit card but no price list. Torq publishes no price and states no deployment options.
MSSP: Only Torq states anything for MSSPs: it cites RSM, a global MSSP, automating 82 percent of its cases (customer claim). Splunk SOAR (Cisco) states no MSSP terms on the pages read.

When should you pick each?

Pick Splunk SOAR (Cisco) when deployment location and data handling are fixed by policy, because it says it deploys in the cloud, on-premises or hybrid, without data handling detail.

Pick Torq when the record a reviewer reads after an action decides the purchase, because it says every verdict, decision, exception and override is captured with context, though the page states this for triage.

Read dates are on each source line. See also Splunk SOAR (Cisco) alternatives and Torq alternatives, or the buyer-type rankings.

3questions

Questions about this pair

Which scores higher, Splunk SOAR (Cisco) or Torq?: Splunk SOAR (Cisco), 5.79 to 5.74 on the published rubric; they share a band, so the evidence does not order them. Torq scores higher on 2 of the eight criteria, and Splunk SOAR (Cisco) on 6.
Which documents more containment actions, Splunk SOAR (Cisco) or Torq?: Splunk SOAR (Cisco), with 19 of 25 as native or partner on the pages read, against 13 for Torq. The scorecard links every counted cell to the vendor page it was read from.
Do Splunk SOAR (Cisco) and Torq publish a time to contain?: Neither publishes a time to contain. A grade C figure has no published sample or method, so it is not comparable with a number measured another way.