D3 SecurityvTines
D3 Security 6.67Tines 6.42
D3 Security v Tines: the totals are 0.25 apart, inside the 0.25 band. They are a band, not a ladder, so read the rows that decide the pair. Rows won: D3 Security 2, Tines 4, level 3.
The difference that decides D3 Security v Tines
On integration depth, D3 Security states 800+ integrations for Morpheus (vendor claim, score 8.0), while Tines states no integration count and reaches APIs through HTTP actions (score 5.0). d3security.com, read 2026-11-03
Rows with the widest weighted gap: Integration count and depth documented (D3 Security ahead by 3.0), Migration tooling and import or export formats (D3 Security ahead by 2.5), Hosting and data residency options (Tines ahead by 2.0).
D3 Security v Tines: the nine rows side by side
Playbook authoring model
weight 14 of 100D3 Security
7.0
Smart SOAR is described by Gartner's listing as codeless integrations with visual playbook design; migrated playbooks arrive in Morpheus in Deterministic mode. D3's authoring docs were not read.
d3security.com, read 2026-11-03 (search summary only)
Integration count and depth documented
weight 14 of 100D3 Security
8.0Ahead
D3 states 800+ integrations for Morpheus (vendor claim).
d3security.com, read 2026-11-03 (vendor claim)
Tines
5.0
No integration count on the home page; positioned as vendor-agnostic. HTTP-based actions reach any API (not read on a docs page).
tines.com, read 2026-11-03
Case management and collaboration
weight 8 of 100Approvals and human-in-the-loop controls
weight 12 of 100D3 Security
6.0
D3 states approval and wait steps carry over in migrated playbooks.
d3security.com, read 2026-11-03 (vendor claim)
Tines
7.0Ahead
Home page states governance, guardrails and monitoring, and that you choose where and when models are used. Coverage of the January 2026 AI interaction layer cites human-in-the-loop controls and audit logging (search summary).
tines.com, read 2026-11-03 (vendor claim) (search summary only); tines.com, read 2026-11-03 (vendor claim) (search summary only)
Agentic or AI features that are documented
weight 12 of 100D3 Security
7.0
Morpheus is positioned as an autonomous SOC platform. Vendor figures: up to 95 percent of alerts investigated end to end in under two minutes and USD 0.97 per investigated alert. Method and sample not published on the page read.
d3security.com, read 2026-11-03 (vendor claim)
Hosting and data residency options
weight 8 of 100Pricing model and transparency
weight 8 of 100D3 Security
6.0
A per-alert benchmark (USD 0.97 per investigated alert) is cited by the vendor; no plan tiers.
d3security.com, read 2026-11-03 (vendor claim)
Tines
6.0
A free edition (3 live workflows, one-time USD 50 AI allowance) is published; paid editions are by request with no pricing unit.
tines.com, read 2026-11-03
Migration tooling and import or export formats
weight 14 of 100D3 Security
8.5Ahead
Legacy SOAR Migration Program: porting for six source platforms (XSOAR, Splunk SOAR, QRadar SOAR, Siemplify, Swimlane, FortiSOAR), three artifact types, a written list of what is not portable (custom code, in-house connectors), a parity report from replayed incidents and a rollback path. All vendor claims; no third-party check found.
d3security.com, read 2026-11-03 (vendor claim)
Tines
6.0
Tines' help article, read 2026-11-03, names the format: stories export as JSON with credentials, resources and event data excluded and import with a Replace option, while the docs page itself does not name the format, no inbound SOAR converter was found, and a library story moves Splunk SOAR case records, not logic.
explained.tines.com, read 2026-11-03; tines.com, read 2026-11-03
Ownership stability
weight 10 of 100D3 Security
7.0
Independent; no 2026 acquisition found. The product line moved from Smart SOAR to Morpheus, which is a renaming risk for existing customers.
d3security.com, read 2026-11-03
Tines
8.0Ahead
Independent; USD 125M round led by Goldman Sachs Alternatives in February 2025 at about USD 1.13B. Product naming changed in 2026 (Tines Stories and 3B).
pymnts.com, read 2026-11-03 (search summary only); tines.com, read 2026-11-03 (search summary only)
The verdict for D3 Security v Tines, by buyer type
- small team
- Tines fits better, because it publishes a free edition with 3 live workflows and a one-time 50 USD AI allowance; D3 Security publishes a subscription structure by daily alert volume tier, 500 to 10,000 alerts a day (vendor claim).
- regulated or air-gapped
- Tines fits better, because it lists a self-hosted deployment in its docs sidebar; D3 Security documents nothing for this buyer type on the pages read.
- leaving a legacy SOAR
- D3 Security fits better, because it runs a migration program for six named source SOARs, with a list of what does not port, a parity report and a rollback path (vendor claim); Tines moves Splunk SOAR case records through a library story and not playbook logic.
When to pick each
Pick D3 Security when
Pick D3 Security when you are leaving a legacy SOAR and you want a tool that runs a migration program for six named source SOARs, with a list of what does not port, a parity report and a rollback path (vendor claim).
Pick Tines when
Pick Tines when you run in a regulated or air-gapped setting and you want a tool that lists a self-hosted deployment in its docs sidebar.
Moving playbooks between D3 Security and Tines
The portability matrix records seven playbook types for each direction it covers. Verdicts are documentation findings, not test results. How the matrix is built.
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Identity actions | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Ticketing and case sync | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Tines' legacy SOAR migration post (read via a third-party summary) names no source platform or converter, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Playbook type | Verdict | Reason |
|---|---|---|
| Enrichment lookups | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Phishing triage | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Endpoint containment | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Identity actions | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Ticketing and case sync | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Custom scripted logic | rebuild from scratch | Tines custom logic is Python Run script action, but D3 Security documents no importer for it, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
| Scheduled or batch jobs | rebuild from scratch | Tines documents story JSON, but no importer for it or migration guide was found for D3 Security, so no documented path on 2026-11-03. tines.com, read 2026-11-03 |
Profiles
D3 Security. Tines. Alternatives: instead of D3 Security, instead of Tines.