SOAR Platform Pricing 2026: Vendor Costs, Models, and What Is Actually Published
A vendor-neutral reference covering 16 Security Orchestration, Automation, and Response platforms. Verified rates where published, quote-only flagged where not, with the per-asset, per-action, per-playbook, and platform-tier models explained side by side.
4 free or open-source entry tiers visible, 12 vendors keep all commercial pricing behind a sales call.
What SOAR vendors actually publish
No SOAR vendor we track publishes a paid list price. Four publish the terms of a free tier, each read from the vendor's own page or documentation on 19 October 2026. Everything above these tiers is a quote.
Torq publishes no tiers and no free plan: torq.io/pricing returned a page-not-found on 19 October 2026 and the site offers only a demo.
Vendor matrix
Sixteen vendors, sorted with published rates first. Click any vendor for the full pricing breakdown including free-tier limits, add-on modules, and known bundle behaviour.
| Vendor | Pricing model | Cheapest published rate | Posture |
|---|---|---|---|
| Shuffle | Metered on app runs: free cloud and on-prem plans with hard limits, Custom-priced Business and Enterprise | Free: 2,000 app runs/month cloud, 25,000 on-prem | Published |
| Splunk SOAR | Action-based, on-prem or cloud, free Community Edition (100 actions/day) | $0 Community Edition (100 actions/day cap) | QUOTE-ONLY |
| Cortex XSOAR | Commercial meter not published; free Community Edition (30 days full, then 166 automation commands/day) | $0 Community Edition (166 automation commands/day after 30 days) | QUOTE-ONLY |
| Tines | Paid editions not published (Get pricing); Free edition capped at 3 live workflows | $0 Free edition (unlimited users, 3 live workflows) | Published |
| Torq | Not published: no tiers, meter or rates on torq.io | Quote only, contact vendor | QUOTE-ONLY |
| Chronicle SOAR | Packages sized on ingestion volume, SIEM and SOAR sold together in Google SecOps | Quote only, contact vendor | QUOTE-ONLY |
| Swimlane Turbine | Platform subscription, sized to ingest volume and named users | Quote only, contact vendor | QUOTE-ONLY |
| FortiSOAR | Subscription, per-user or per-asset, discounted inside Security Fabric bundle | Quote only, contact Fortinet partner | QUOTE-ONLY |
| QRadar SOAR | Per-user subscription, sold standalone or via Cortex platform | Quote only, contact vendor | QUOTE-ONLY |
| Rapid7 InsightConnect | Job-volume tiered, often bundled with InsightIDR SIEM | Quote only, contact vendor | QUOTE-ONLY |
| D3 Smart SOAR (Morpheus) | Annual module licence by daily alert volume tier, plus named user licences, plus a flat per-alert rate above the tier | Quote only, contact vendor | QUOTE-ONLY |
| ServiceNow Security Operations | Per-fulfiller-user, three modules (SIR, VR, TI) sold separately or together | Quote only, contact vendor | QUOTE-ONLY |
| LogRhythm Axon SOAR | Bundled with Axon SIEM, standalone option exists but rarely sold | Quote only, contact vendor | QUOTE-ONLY |
| Exabeam New Scale Security Operations | Platform subscription, SOAR included in upper tiers | Quote only, contact vendor | QUOTE-ONLY |
| Securonix SOAR | Bundled inside Unified Defense SIEM, Snowflake-native compute | Quote only, contact vendor | QUOTE-ONLY |
| Cyware Orchestrate | Platform subscription, often bundled with Intel Exchange (CTIX) | Quote only, contact vendor | QUOTE-ONLY |
Interactive cost estimator
The licence is either a published free tier or a quote, so the part you can price yourself is your team's time. Enter your integration count, the hours each one takes a year, your analyst headcount, training hours and your loaded hourly rate. Quote-only vendors are flagged, not faked.
| Vendor | Published licence entry point |
|---|---|
| Shuffle | Free: 2,000 app runs/month cloud, 25,000 on-prem |
| Splunk SOAR | $0 Community Edition (100 actions/day cap) |
| Cortex XSOAR | $0 Community Edition (166 automation commands/day after 30 days) |
| Tines | $0 Free edition (unlimited users, 3 live workflows) |
| Torq | QUOTE-ONLY |
| Chronicle SOAR | QUOTE-ONLY |
| Swimlane Turbine | QUOTE-ONLY |
| FortiSOAR | QUOTE-ONLY |
| QRadar SOAR | QUOTE-ONLY |
| Rapid7 InsightConnect | QUOTE-ONLY |
| D3 Smart SOAR (Morpheus) | QUOTE-ONLY |
| ServiceNow Security Operations | QUOTE-ONLY |
| LogRhythm Axon SOAR | QUOTE-ONLY |
| Exabeam New Scale Security Operations | QUOTE-ONLY |
| Securonix SOAR | QUOTE-ONLY |
| Cyware Orchestrate | QUOTE-ONLY |
Across the SOC stack
The Digital Signet sister sites with verified pricing for the layers around SOAR. SIEM is the upstream feeder. XDR and EDR are the detection layers SOAR automates response for. MDR is the buy-side alternative for SOCs that do not want to staff the platform.