Leaders

High Performers

Contenders

Niche

Market Presence

Satisfaction

See Reviews

G2 Grid® Scoring

Security Orchestration, Automation, and Response (SOAR) Software Definition

Security orchestration, automation, and response (SOAR) software products are tools used to help integrate security technologies and automate incident-related tasks. These tools integrate with a company’s existing security solutions to help users build and automate workflows, simplifying the incident response process and reducing the amount of human intervention necessary to handle security incidents. Companies use these tools to create a centralized system complete with visibility into a company’s security software and operational processes. These tools also reduce the time it takes to respond to incidents, as well as the potential for human error in remediating security threats and vulnerabilities.

SOAR platforms combine aspects of vulnerability management, incident response, and security information and event management (SIEM) solutions. SOAR products are designed to provide some of each tool’s respective functionality or integrate with third-party tools. Once integrated, processes can be designed to identify incidents and automate remediation tasks.

To qualify for inclusion in the Security Orchestration, Automation, and Response (SOAR) category, a product must:

• Integrate security information and incident response tools
• Allow security professionals to build response workflows
• Automate incident management and response tasks within workflows
• Provide formalized incident, workflow, and performance reports

Security Orchestration, Automation, and Response (SOAR) Grid® Scoring Description

• Products in the Leader quadrant are rated highly by G2 users and have substantial Market Presence scores. Leaders include: KnowBe4 PhishER/PhishER Plus, Microsoft Sentinel, Torq, Tines, and Swimlane
• High Performing products have high customer Satisfaction scores and low Market Presence compared to the rest of the category. High Performers include: Barracuda Incident Response, Logpoint, Blink, Blumira Automated Detection & Response, CrowdSec, SIRP, and Shuffle
• Contender products have relatively low customer Satisfaction scores and high Market Presence compared to the rest of the category. While they may have positive reviews, they do not have enough reviews to validate those ratings. Contenders include: Splunk SOAR (Security Orchestration, Automation and Response), Palo Alto Networks Cortex XSOAR, Google Security Operations, and IBM Security QRadar SOAR
• Niche products have relatively low Satisfaction scores and low Market Presence compared to the rest of the category. While they may have positive reviews, they do not have enough reviews to validate those ratings. Niche products include: Demisto, Sumo Logic, Intezer, n8n, D3 Security, and LogicHub