Leaving Cyware

Cyware is not a source row in the portability matrix, which covers nine other platforms, so no cell, verdict or documented path is recorded for leaving it. What exists is an export route: playbooks export as JSON, SVG or PNG, read through search summaries. Treat any claim of a converter as untested until a proof of concept runs it.

What moves

• The matrix has no Cyware row, so there is no verdict per playbook type. The planning assumption used here is rebuild from scratch for all seven types, and it is an assumption, not a matrix finding.
• No target migration page read names Cyware as a source. D3 Security names six sources, Swimlane names four, and BlinkOps names Splunk SOAR.
• The artefact is a JSON file. Cyware techdocs, read through search summaries, say playbooks export as JSON, SVG or PNG from Manage Playbooks, and import requires JSON and the Import Playbook permission.
• Moving between Cyware instances is documented. Moving to another vendor is not.

What breaks

• Apps first. Associated apps must be installed before a JSON import or nodes break, so the integration set has to exist in the destination.
• Name conflicts. An import creates a timestamped copy or replaces the playbook, so state which you want.
• Intelligence products. Cyware sells them as separate modules from Orchestrate, so check which of your playbooks read intelligence data.
• Case data. Respond is sold as case management, and no export of case records was found on the pages read.
• Evidence quality. The Cyware page returned an empty shell on 2026-11-03, so every format fact here comes from a search summary.

Where to go from Cyware

• Torq. Torq documents a YAML workflow and a case module, and names no Cyware importer. Plan a rebuild. Cyware v Torq
• Tines. Tines documents story export and import as JSON and publishes a free edition for a proof of concept. No Cyware importer is documented. Cyware v Tines
• D3 Security. D3 Security publishes the only migration program with named sources in this set and does not list Cyware among its six, so ask for a written answer on Cyware JSON. Cyware v D3 Security

The documented paths, with their sources

• Cyware techdocs on exporting playbooks: the Manage Playbooks menu exports JSON, SVG or PNG, and the export can move playbooks between instances. Read through a search summary. techdocs.cyware.com, read 2026-11-03
• Cyware techdocs on importing custom playbooks in JSON format: import needs the Import Playbook permission, associated apps must be installed first, and a name conflict creates a timestamped copy or replaces. Read through a search summary. techdocs.cyware.com, read 2026-11-03
• The Cyware Orchestrate page lists 150+ playbook templates and a playbook version control feature, and names no migration offer. It is a vendor page. cyware.com, read 2026-11-03

A parallel run you can audit

Run the old and the new system on the same alerts until the new one matches. Keep a parity report, a rollback path and exit criteria written down before the switch. The checklist is the corner's list for this move.

• Export a playbook from a non-production instance and open the JSON.
• List the apps each playbook needs, and confirm the target has a connector for each.
• Ask Cyware in writing about ownership, because one deal aggregator lists an acquisition by Microsoft that no primary source confirms.
• Ask each candidate in writing whether it reads Cyware JSON, and which playbook types it converts.
• Move case data separately and check its fields on arrival.
• Run a proof of concept on three playbooks, one containment and one scheduled, before you sign.
• Run in parallel and keep Cyware live until a parity result is signed.