Tines review: a workflow platform for building your own AI SOC

Tines calls itself "The secure environment for AI agents, apps and automation"; the current product is Tines 3B. Its AI SOC use case covers "alert intake, triage, and remediation, routing to an analyst when needed". Agents run in Task mode or Chat mode and are built no-code on the Storyboard; Workbench is a Tines-powered AI copilot and Cases is case and incident management with an audit trail. The Tines blog reports a $125M Series C at a $1.125B valuation in February 2025.

Enrichment, investigation and response workflows are built in natural language and combine agentic and deterministic steps. Examples in the Tines library include creating a case, escalating, resetting a password, suspending departing-user accounts in Gmail, Okta and Slack, and alert response with CrowdStrike and SentinelOne. Workflows can run "fully autonomous, deterministic, or with a human in the loop", with approvals and built-in oversight. AI is hosted on AWS Bedrock or on a provider you bring, and Tines says it is stateless, private, geo-bound and tenant-scoped, with no training and no logging.

• Investigation depth per alert · 20%

  6 / 10

  AI agents and workflows handle alert intake, triage, investigation and remediation, but depth depends on the workflows a team builds; no prebuilt AI SOC analyst is described.

• Explainability of verdicts · 15%

  6 / 10

  Tines states full visibility and auditability over every action taken; how agent reasoning behind a verdict is shown is less documented on the pages reviewed.

• Coverage of alert sources · 15%

  7 / 10

  Says it integrates with any vendor in your stack, with unlimited connectors even on the free edition, but publishes no integration count or catalogue.

• Human-in-the-loop controls · 15%

  8 / 10

  Fully autonomous, deterministic or human-in-the-loop modes, approvals and built-in oversight, and you control what goes live.

• Transition effort from an existing SOAR · 15%

  8 / 10

  Positions itself as a modern SOAR against legacy SOAR platforms, with no-code and natural-language building and agentic plus deterministic steps; playbooks are rebuilt rather than translated.

• Deployment model options · 10%

  9 / 10

  Shared stack, self-hosted or hybrid, with AI features available wherever Tines is deployed and AI described as geo-bound and tenant-scoped.

• Pricing transparency · 10%

  4 / 10

  A free edition with published limits (3 live workflows, a one-time $50 AI allowance); paid editions have no public price.

Weighted score: 6.85 / 10 (computed from the weights on /method#how-we-score)

• No prebuilt AI SOC analyst is described; your team designs the investigation logic.
• No integration count published.
• Paid editions have no public price.

Tines positions itself as a modern SOAR against legacy SOAR platforms. The route is a rebuild with no-code and natural-language building, not a translation of existing playbooks. Because the investigation logic is yours to design, plan time for your team to write it, and use the free edition (3 live workflows, a one-time $50 AI allowance) to test before a sales conversation.

Source: tines.com · tines.com/solutions/security/ai-soc · tines.com/solutions/security/soar · tines.com/stories/agents · tines.com/ai-in-tines · tines.com/pricing · tines.com/blog/series-c-fundraise · Reviewed Sep 2026

• The only AI SOC option here with self-hosted and hybrid deployment described.
• A free edition with published limits, so a team can build before talking to sales.
• Agentic and deterministic steps in one workflow builder, with your choice of LLM provider.

Teams that need self-hosted or hybrid deployment, teams that want to choose their own LLM provider, and teams with automation engineers who prefer to design their own investigation workflows. Teams that want a prebuilt AI SOC analyst, a published integration count or paid-edition prices should compare the alternatives.