Which SOARs let me write playbooks in code, and which are visual only?
None of the twelve profiled products is visual only. Splunk SOAR generates Python from its visual editor, and XSOAR packs hold Python or JavaScript beside YAML metadata (Splunk help pages and pan.dev, read 2026-11-03). Swimlane pairs its Canvas with Python, Torq has a Python script step and Tines has a Run script action that executes Python. Sentinel uses Logic Apps with Azure Functions for code. Cyware says it has a low-code Python editor, a vendor claim. Mate has no code editor, because a Gamebook is written in plain language.
Can AI write my playbooks, and what can it not create?
Several vendors say so, and only Google lists limits. Its Gemini playbook creation cannot create playbook blocks or parallel actions, uses only installed integrations and cannot create integration instances (Google docs, read 2026-11-03). Splunk's Automation Builder agent builds playbooks and its Connector Builder Agent builds connectors, in Cloud only (release notes, read 2026-11-03). Cyware and Swimlane name AI builders without stated limits. Review any draft by hand before it touches a write action.
Does a visual editor make playbooks portable?
No. The editor is a front end for the platform's own format. Splunk generates Python, XSOAR keeps tasks in a content pack, Swimlane exports a .ssp, Torq exports YAML, Tines JSON and Sentinel ARM JSON. In the portability matrix no cell rests on a technical importer document: 0 of 637 applicable cells (matrix method, read 2026-11-03). Visual authoring helps you read a playbook. It does not help you move one.
How do I read a vendor's integration count?
Ask what is counted: packs, apps, actions or logos. Splunk says 300+ third-party tools and 2,800+ actions. XSOAR says 900+ packs on one page and 850+ integrations on another. D3 says 800+, and Cyware says 400+ while its integrations page returned 404 (vendor pages, read 2026-11-03). All of these are vendor claims. Then check the custom connector path and whether the specific tools you run are on the list.
Which of these vendors publish no integration count at all?
On the pages read, Torq, Tines, Swimlane, Microsoft Sentinel, ServiceNow and Mate Security. Torq's integrations page shows names and no count. Swimlane says "infinite integrations". Tines says actions reach any API over HTTP. Sentinel lists Logic Apps connectors and Content hub solutions, and Mate lists ten categories (vendor pages, read 2026-11-03). Those integration rows score 5.0 or 6.0 here.
What if the connector I need does not exist?
Check the custom path before you buy. Torq's Integration Builder needs the Workspace Creator role. Swimlane builds connectors with the Turbine SDK. Splunk adds Python libraries through application wheels modules. Tines actions call any API over HTTP, Google edits integrations in an IDE, and XSOAR packs take Python or JavaScript (vendor docs, read 2026-11-03). Mate maintains its own Flows, so for Mate you ask Mate.
How do approvals work across these products?
They differ in kind. Mate documents three autonomy modes and D3 four (vendor pages, read 2026-11-03). Cyware says critical decisions can be approved from a mobile app. In Sentinel the author builds the approval, for example a Send approval email action. Torq says response can run autonomously or with human-on-the-loop oversight. XSOAR approvals were not documented on any page read, and that row scores 4.0 and is flagged for a re-read.
Can I set approvals per action instead of per playbook?
Only Mate documents it on the pages read: autonomy is raised one action class at a time, and a category drops back to supervised if accuracy drifts (Mate platform page, vendor claim, read 2026-11-03). Torq's per-action gating detail was not read. Elsewhere an approval is a step the author places in a playbook, so the control follows how you build it. Ask each vendor to show the setting.
Where does Mate Security rank, and why not first?
Sixth of 14 at 6.22, in a band with Tines (6.42), Sentinel (6.21), XSOAR (6.18) and Swimlane (6.14), and 1.02 behind Cyware (scores read 2026-11-03). Approvals score 8.5. Mate loses ground on hosting (3.5), integrations (5.0), case management (5.0) and migration (5.0), because its pages state no deployment model or integration count and name no source platform or format. Its 98.7 percent accuracy claim is a vendor claim and is not scored.
What should an approval log show?
At minimum: the request, the approver, the time and the action taken, including refusals. Vendors claim logs without showing them. Torq says transparent audit logs, Cyware says version control with audit trails and Mate says guardrails and audit (vendor pages, read 2026-11-03). Ask for a sample log from a proof of concept, and check that a rejected approval is recorded as well as an approved one. Without that, the claim is marketing.
Is an agent or a playbook better for phishing triage?
No vendor publishes a head-to-head, so this magazine cannot say. Swimlane routes each alert to a playbook, an AI-assisted or an agentic investigation (vendor claim), D3 keeps a deterministic mode beside AI modes, and Mate describes a Gamebook as intent that agents follow (vendor pages, read 2026-11-03). Phishing is a multi-step case with parsing, detonation and user communication, one of the seven types in the matrix. Test it on your own mail.
Where do vendors say deterministic steps still belong?
Swimlane says Turbine playbooks act as orchestrators and guardrails for its Hero AI agents (January 2026 release). D3 keeps a deterministic engine and says migrated playbooks arrive in Deterministic mode. Mate's Gamebooks define which actions are permitted and when to stop or ask (vendor pages, read 2026-11-03). The common thread is fixed steps for write actions and agents for investigation. All three are vendor statements.
Does After SOAR think SOAR is over?
The name is a thesis, and the magazine tests it. Splunk, Swimlane, Cyware and Torq documented agents in 2026, and D3 keeps a deterministic engine beside its AI modes. Of the agent-led products, D3 and BlinkOps name source SOARs on marketing pages and Mate names none (vendor pages, read 2026-11-03). In the matrix, 0 of 637 applicable cells rest on a technical importer. That supports a narrower claim than the name: vendors are adding agents beside playbooks, and the way out is still mostly manual.
What format does each SOAR export playbooks in?
XSOAR: zip content bundles with YAML metadata. Splunk SOAR: JSON download and .tgz import. Swimlane: .ssp. Torq: YAML. Tines: JSON. Sentinel: ARM JSON. Google SecOps: ZIP. Cyware: JSON. BlinkOps: workflow YAML. D3: encrypted XML, YAML or JSON between D3 systems, with no export to another vendor's format. ServiceNow: an update set in XML per a third-party guide (portability research, read 2026-11-03, several through search summaries). Formats are vendor-specific, and none is documented as read by another vendor.
Can I import another vendor's export file?
Not on a documented technical basis. Of 637 applicable matrix cells, 64 carry a path and 573 are rebuild from scratch. Every path is a vendor statement or one library story, and none rests on a technical importer document (matrix method, read 2026-11-03). D3 and Swimlane name sources on marketing pages, BlinkOps names Splunk SOAR, and Microsoft publishes a Splunk SOAR to Sentinel guide, while Mate claims translation without naming a source and scores rebuild. Test each claim on your own files.
What does a Tines or Swimlane export leave out?
A Tines story export excludes event data, resources and credentials (Tines docs, read 2026-11-03). A Swimlane .ssp excludes application history, records, key-store secrets and secure asset values (Swimlane 10x guide, read 2026-11-03). In both cases you re-enter credentials in the target. Torq's export differs: it includes the custom steps and integrations a workflow uses (Torq knowledge base, read 2026-11-03). Check what a package leaves out before you plan a cutover.
Which vendors offer migration programs, and what do they promise?
D3 has a Legacy SOAR Migration Program for six named sources with a parity report and a rollback path. Swimlane has a page naming sources and claiming up to 90 percent of workflows migrate automatically. BlinkOps offers a four-week plan for Splunk SOAR. Mate offers a free playbook migration assessment. Torq's guide is behind a form and was not read (vendor pages, read 2026-11-03). Each is a vendor claim from a seller of the destination.
How long does a SOAR migration take?
No neutral figure exists. D3's guide says industry migrations often run 6 to 12 months, BlinkOps offers a four-week plan, and a customer on Mate's page says 3 weeks against 9 months expected, at one unnamed company (vendor pages, read 2026-11-03). All are vendor claims. The real driver is how many playbooks of the seven types you have, and how many carry custom code that people must rework.
Does Mate's 711 into 10 figure show what I can expect?
No. Mate's page says one unnamed Fortune 500 customer moved 711 SOAR playbooks into 10 Gamebooks, in 3 weeks against 9 months expected, quoting a customer (read 2026-11-03). It names no source SOAR and gives no method, so it is a vendor claim. A playbook count also says little, since many may be near-duplicates, and Gamebooks are described as investigation procedures, not case sync or scheduled jobs.
Is Splunk SOAR going away?
No end-of-sale or end-of-life notice was found on the pages read on 2026-11-03. Cisco has owned Splunk since 2024-03-18, and Splunk calls SOAR a native capability within Enterprise Security, licensed separately. On-prem 8.7.0 dropped Python 3.9 on 2026-09-02, and the new agents are Cloud only. On this evidence the product is changing, not ending. Competitor claims about an unclear roadmap carry no source.
What is the lifecycle of Cortex XSOAR?
XSOAR 6.12 and 6.13 reached end-of-life on 2026-06-30. XSOAR 8 on-prem versions retire on a three-month cycle: 8.10 ended on 2026-07-30 and 8.11 ends on 2026-11-13 (Palo Alto lifecycle pages, read 2026-11-03). The release of 2025-10-28 calls Cortex AgentiX the successor and gives no XSOAR end-of-sale date. Legacy professional services SKUs for XSOAR reached end-of-sale on 2026-02-01.
What changes for Sentinel automation in 2027?
After 2027-03-31 Sentinel is supported only in the Microsoft Defender portal, and Azure portal users are redirected. Microsoft lists differences in Defender: incident updates are batched for five to ten minutes, automation rules can take up to ten minutes to run, and manual runs of playbooks are not yet supported (Microsoft Learn, read 2026-11-03). Test any timing-sensitive playbook in Defender before the date.
Which of these vendors publish a price?
Few do. Sentinel publishes USD 4.30 per GB analysed on pay-as-you-go and commitment tiers. Tines publishes a free edition. Mate shows an Enterprise tier list price of USD 150,000 per 12 months on AWS Marketplace, not on its own site. D3 publishes tiers by daily alert volume without amounts. XSOAR, Splunk SOAR, Swimlane, Torq, Google, ServiceNow, Cyware and BlinkOps give no price on the pages read (read 2026-11-03).
How is Sentinel automation billed?
Playbooks are Logic Apps workflows, and Logic Apps charges apply on top of Sentinel charges (Microsoft Learn, read 2026-11-03). The Sentinel pricing page shows USD 4.30 per GB analysed on pay-as-you-go and commitment tiers from USD 296 per day at 100 GB a day, at the page default region. Commitment tiers apply per workspace. If you run a second automation product in parallel, you pay for both until the Logic Apps playbooks are off.
How should I budget when no price is published?
Ask for the pricing unit first. D3 prices by daily alert volume tier. Cyware scopes cost by deployment model, analyst seats, intelligence feeds and automation volume. Splunk requires a separate SOAR subscription beside Enterprise Security. Google sells packages based on ingestion (vendor pages, read 2026-11-03). Get the unit and the tier boundaries in writing, and ask what a doubling of alert volume costs.
Which SOARs can run on-prem or air-gapped?
Palo Alto recommends XSOAR 6 for on-prem and air-gapped installs, and XSOAR 8 has on-prem versions with dated end-of-life. Splunk SOAR documents cloud, on-prem and hybrid. Cyware says Orchestrate runs in cloud and on-premise environments. Tines lists a self-hosted option in its docs. A BlinkOps AppSource listing says runners work on-prem, read through a search summary. Sentinel is Azure only, with a Hybrid Runbook Worker for on-prem systems (vendor pages, read 2026-11-03).
Where is data residency documented?
Google's product page FAQ says data residency for specific regions is supported and points to a regions list we did not read (read 2026-11-04). Splunk 8.6.0 adds FIPS 140-3 for FedRAMP Cloud, with regions not read. Mate states no regions, though a German page names STACKIT, a European sovereign cloud. For most others nothing was found. Ask for the regions list and retention terms in writing.
Is Mate Security SaaS only?
Mate's bug-bounty page refers to its SaaS offering, the product is built on AWS and has been on AWS Marketplace since 2026-01-15, and a German page says it is available through STACKIT (Mate pages, read 2026-11-03). No page states data residency, retention or whether data is copied into Mate, and its Trust Center did not render without JavaScript. Hosting scores 3.5 and is flagged for a re-read.
What can an agentic platform not do that a SOAR does?
On the pages read, a few things are undocumented. Mate describes Gamebooks as investigation procedures, so case sync and scheduled or batch jobs have no documented path, and the matrix marks both rebuild from scratch. No agent platform documents an export of its procedures. Several publish no integration count. A SOAR remains the documented answer for a fixed, audited sequence and for a scheduled job (vendor pages, read 2026-11-03).
Which accuracy claims can I trust?
None is independently verified. Mate says 98.7 percent accuracy on 7,200 alerts and 97 percent auto-closure, with no method (graded C). D3 says 98 percent triage accuracy and up to 95 percent of alerts handled in under two minutes. Torq's over 90 percent of cases closed autonomously is reported by third parties and is not on the page read (vendor pages, read 2026-11-03). The rubric never lifts a score above 8.0 on such figures without a published method, sample and measurer.