How we score

The nine rows and their weights

Migration row rule. 8.0 to 9.5: a vendor page names the source platforms it takes playbooks from and lists what does not port. 6.0 to 7.0: a vendor page read in full names a source platform it takes playbooks from or a file format it exports or imports (7.0 for a dated guide that maps components). 5.0: a vendor claim of translation that names no source platform and no format, which is the same as no documented path in the portability matrix. 2.0 to 4.0: no such page was read.

The scale

0.0 to 10.0 per criterion, one decimal; nobody gets 10; weighted total is the sum of score x weight / 100 and is shown to two decimals.

• documented. Score 8.0 to 9.5. A primary page or doc states the capability with substance: names, limits, or a number with a source. Use 9.0 to 9.5 only when limits are also stated and nothing important is missing.
• partial. Score 5.0 to 7.0. The capability is stated but thin, vendor-claim only, missing a part of the question (for example a count with no custom path), or read through a secondary source.
• not documented. Score 2.0 to 4.0. Nothing found on the pages read. 4.0 when the product category normally has the feature and the vendor's docs were not read (flagged needs_reread); 2.0 to 3.0 when the page read says nothing or the product is not offered.
• gaps. Scores between 7.0 and 8.0 are not used. 10.0 is never awarded. Below 2.0 is reserved for a vendor documenting that it does not do the thing.

How a total is computed

The total is the sum of each score times its weight, divided by 100, shown to two decimals. The build refuses to run if the weights do not sum to 100, and it refuses if any published total differs from the sum of its parts. The profile of each platform shows the part for every row.

Bands, not ladders

A band opens at the highest total not yet placed and holds every total within 0.25 of it. A head-to-head page says "band" when the two totals are within 0.25. On the current data the top three are separated by 0.56 points, and each score rests largely on the vendor's own pages.

Cyware (7.24), Torq (6.77) and Splunk SOAR (6.68) lead, with D3 Security (6.67) a hundredth behind Splunk SOAR, and the four are separated by 0.57 points, and each score rests largely on the vendor's own pages. Cyware leads because its Orchestrate page documents authoring, a 400+ integration count, mobile approvals and AI tools in one place; that is vendor-claim evidence, mostly one page. Torq leads on case management and approvals, and holds the highest ownership score for an independent with a January 2026 USD 140M round. D3 leads on migration (8.5) because it publishes the only migration program with named source platforms and a list of what is not portable, but that is also a claim by a seller that wants the migrating customer. Cyware stands 0.47 points clear of Torq and alone in the top band; treat Torq, Splunk SOAR and D3 Security as a tie, and read the lead as resting on one vendor page. Head-to-head pages should lead with the deciding criteria, not the total. If every needs_reread item is lifted to 6.0, Cyware stays first and Torq and D3 tie for second.

What counts as evidence

Anything a vendor says about itself carries vendor_claim true. A count or percent on a vendor page can reach 8.0 only if it names what is counted; accuracy and closure percentages never lift a score above 8.0 without published method, sample and who measured.

Scores come from pages read on 2026-11-03 only. Where the vendor's own docs were not opened the score is 4.0 or lower with needs_reread true. Sources marked search_summary_only came from a search result summary and the page was not opened. Vendor facts cited here are for the site builders; competitor-owned pages (D3 about Splunk or Palo Alto) are named as such and are never the sole basis for a score.

Every vendor fact carries its source link and read date. Anything a vendor says about itself is labelled as a vendor claim.

Evidence grade for vendor claims

Vendor claims on a profile are not scored. Each carries an evidence grade, which says how far the figure can be checked, not whether it is true.

• A. Measured by a third party, with the method published.
• B. Measured by the vendor, with the sample and the method stated.
• C. A vendor figure with no published method.
• D. A figure that cannot be checked: no source for the number, or the page does not say what was measured.

The grade is set from the page read on the date shown beside the claim. No claim in the current data reaches A.

Products that are not SOARs

No criterion is skipped. Where a product is not a SOAR (Mate Security), each criterion is scored on what the vendor documents as its answer to that job: Gamebooks for authoring, categories of integration for the integration count, ticket and dashboard for case management, autonomy modes for approvals, and so on. What the vendor does not document scores as not documented. The page for that vendor must say which criteria are answered by a different mechanism.

Mate Security lands 6th of 14 scored at 6.22, behind Cyware, Torq, Splunk SOAR (Cisco), D3 Security, Tines. Where Mate is behind, the page says so, and the reason is on the profile row by row.

Mate Security places 6th of 14 (6.22), 1.02 behind Cyware and 0.20 behind Tines (6.42) and 0.46 behind Splunk SOAR (6.68). It is 0.01 ahead of Microsoft Sentinel and ahead of Swimlane, Cortex XSOAR, Google SecOps, Blink Ops and ServiceNow. Why: its highest score is approvals (8.5, three documented autonomy modes) and AI (8.0). It loses ground on hosting (3.5, nothing documented on deployment or residency), integrations (5.0, ten categories and no count), case management (5.0, no case product) and migration (5.0, translation claimed, no source platform or format named, no export, which the migration rule scores as no documented path). Mate is not a SOAR, so five criteria are answered by a different mechanism: authoring (Gamebooks), integrations (Flows and categories), case management (dashboard and ticket context), migration (translation of SOAR playbooks into Gamebooks) and hosting (not stated). The rubric scores each on the documented answer and never skips; that lowers Mate on cases and hosting because the documentation is silent, not because the job is different. Without the migration and ownership criteria Mate moves up to 4th (6.34); if every needs_reread item is lifted to 6.0 Mate is 8th (6.42); see order_without_migration_and_ownership. Mate's 98.7 percent accuracy figure is not scored: it is an unaudited vendor claim and is capped at the AI criterion's 8.0.