After SOAR

Instead of Palo Alto Cortex XSOAR

Palo Alto Cortex XSOAR scores 6.18 of 10 and sits 8 of 12 on the card. The gaps below are the reasons a team looks elsewhere. Each alternative is placed by what it answers.

Where Palo Alto Cortex XSOAR leaves gaps

The XSOAR product page publishes no price or pricing unit and offers an ROI calculator in its place, and the pricing path under it returned 404 on 2026-11-03. paloaltonetworks.com, read 2026-11-03

  • Palo Alto announced on 2025-07-25 that legacy professional services SKUs, including XSOAR SKUs, reach end-of-sale on 2026-02-01, and its AgentiX release names a successor without giving an XSOAR end-of-sale date. paloaltonetworks.com, read 2026-11-03
  • The stated pack counts disagree: 900+ on the product page and 850+ integrations on the Marketplace page, neither with a date, and neither says how many packs are community content. paloaltonetworks.com, read 2026-11-03

Where Palo Alto Cortex XSOAR scores lowest on the rubric

  • Pricing model and transparency, 3.0 of 10: No price or pricing unit on the product page, which offers an ROI calculator instead. paloaltonetworks.com, read 2026-11-03
  • Approvals and human-in-the-loop controls, 4.0 of 10: Not found in the pages read on 2026-11-03. Manual tasks and approval steps exist in the product but no page read here documents them. paloaltonetworks.com, read 2026-11-03
  • Migration tooling and import or export formats, 6.0 of 10: The pan.dev pages, read in full on 2026-11-03, name the YAML file format of integrations and scripts and the content-pack layout that bundles playbooks, but the playbook on-disk format is not stated and no leaving-XSOAR guide or importer from another vendor was found, so it is counted as a named format under the rule at 6.0 while the zip export bundle, seen in a search summary only, is not counted; a competitor also claims XSOAR scripts are not portable, a claim about a rival. xsoar.pan.dev, read 2026-11-03

The alternatives, in the order that answers the gaps

  1. Torq, 6.77 of 10. Torq is second on the rubric at 6.77. It answers the lifecycle gap: an independent vendor with a USD 140M Series D on 2026-01-12 and no version retirement cycle on the pages read. It does not answer the price gap, because Torq publishes none either. Palo Alto Cortex XSOAR v Torq.
  2. Splunk SOAR (Cisco), 6.68 of 10. Splunk SOAR is third at 6.68. It matches XSOAR on hosting, with cloud, on-prem and hybrid, and documents agents that build playbooks. It also publishes no price and sits under Cisco with a separate licence, so it answers the hosting gap and little else. Palo Alto Cortex XSOAR v Splunk SOAR (Cisco).
  3. D3 Security, 6.67 of 10. D3 Security is fourth at 6.67. It publishes a pricing structure by daily alert volume and a migration program that names XSOAR among six sources (vendor claim), so it answers both the price gap and the leaving gap. D3 Security v Palo Alto Cortex XSOAR.
  4. Tines, 6.42 of 10. Tines is fifth at 6.42. It publishes a free edition with three live workflows and sells paid editions by demo, which answers the price gap in part. It documents no converter from XSOAR, so plan a rebuild. Palo Alto Cortex XSOAR v Tines.
  5. Mate Security, 6.22 of 10. Mate Security is sixth at 6.22. It documents approvals in three autonomy modes, where XSOAR documents none on the pages read, and shows an AWS Marketplace list price of USD 150,000 per 12 months. It is not a SOAR, and it names no source format for migration. Mate Security v Palo Alto Cortex XSOAR.

Palo Alto Cortex XSOAR on its own: profile. If you are leaving it, see the portability matrix, and Leaving Palo Alto Cortex XSOAR.