Replace, work alongside or evolve in place: the SOAR Stance Index explained

For each platform we record five things from its public pages: its stance on SOAR, whether it translates existing playbooks, where response actions run, whether it publishes an integration count, and whether it publishes a pricing unit, plus a source link. The full table is on the comparison page and as a CSV download.

Stance is our reading, not a vendor label. Where a vendor says it replaces SOAR, or runs response natively and needs no SOAR, we list it as Replaces SOAR. Where response runs through an existing SOAR, or the vendor says it complements the tools a team already owns, we list it as Works alongside SOAR. The incumbents, which add AI inside their own playbook engines, are listed as Evolves the SOAR in place.

Mate Security, Artemis Security, Torq AI SOC Platform, Prophet Security, Exaforce, Tines and Conifers CognitiveSOC are positioned to replace SOAR.

Mate Security is the only one whose public material describes translating SOAR playbooks into its own format.

They differ on what happens to your playbooks. Mate Security translates them into Gamebooks. Torq rebuilds them in Hyperautomation, with natural-language workflow creation. Prophet Security and Conifers run response natively, through scoped Agent Actions and CognitiveSOC's response agents, but describe no playbook translation. Tines, Exaforce and Artemis Security rebuild them: Tines in its no-code workflows, Exaforce in natural-language playbooks, and Artemis in its AI-native SOAR builder, which proposes playbook updates.

Dropzone AI, 7AI and Intezer are built to work alongside a SOAR.

Dropzone AI executes response through connected SOAR platforms. Intezer runs its own remediation or routes to a connected SOAR. 7AI runs actions against existing tools and calls itself "a force multiplier, not a replacement". For a team whose SOAR works for response, these add AI investigation without a migration, at the cost of keeping, and paying for, the SOAR.

Cortex XSOAR and Splunk SOAR are the incumbents. Palo Alto describes Cortex AgentiX as the next generation of Cortex XSOAR, with agents that act within existing roles and permissions and AI prompts inside playbooks. Splunk has made SOAR a native capability of Splunk Enterprise Security, which it describes as integrated with agentic AI. For their customers the first option is to add AI where they are; our Cortex XSOAR vs Mate Security page sets out when moving makes more sense.

Three of the twelve publish no integration count, and two publish a pricing unit (Dropzone AI and Intezer). Integration lists and pricing units are the two facts buyers most often need before a first call, so the gaps are the first questions to ask.

• If your SOAR contract renews soon and playbook maintenance is the pain, start with the platforms that replace SOAR, and ask each how your playbooks would move.
• If your SOAR works for response and investigation time is the pain, start with the platforms that work alongside it.
• If your playbooks are stable and your alert volume is manageable, price the in-place option from your incumbent first.
• Whatever the stance, run a proof of value on your own alerts before deciding.

We reviewed the original rows in September 2026 and added Tines, Exaforce and Artemis Security on 13 October 2026. We will revise the index when vendors change their public positioning. If you spot a change, write to editors@cyberaicomparison.com.