QRadar SOAR Pricing 2026
Pricing at a glance
QRadar SOAR is the rebrand of IBM Resilient (acquired 2016). Palo Alto Networks closed its purchase of the QRadar SaaS assets on 31 August 2024, but IBM kept the on-premises line: IBM still sells and supports QRadar SOAR, and its product page publishes no rates at all. SaaS customers are the ones migrating to Palo Alto.
Source: www.ibm.com/products/qradar-soar · Verified 2026-09-23.
QRadar SOAR keeps every commercial rate behind a sales call. We do not infer numbers from third-party leaks. The only honest path is to contact the vendor for a quote.
Tier breakdown
The full published-and-known tier list for QRadar SOAR. Tiers marked "Quote only" require contact with sales.
| Tier | Published price | Notes |
|---|---|---|
QRadar SOAR (formerly Resilient) | Quote only | Per-user model. Quote only. |
QRadar SOAR for MSSPs | Quote only | Multi-tenant. Quote only. |
Cost scenarios
Three labelled scenarios. Where vendor data is insufficient to give a defensible figure we say so rather than guess. Worked numbers are flagged as illustrative.
Per-user subscription model. Quote-only. Mid-five-figure floor for sub-100-user deployments per public RFP references.
Migration in progress as of mid-2026. Pricing landing on Palo Alto's Cortex commercial model. Quote-only.
Multi-tenant version for service providers. Quote-only. IBM Cloud Pak for Security was the prior bundle vehicle; status post-acquisition is fluid.
(Illustrative example, not a real company.) All scenarios apply a uniform $4,500/yr per integration engineering line and $1,800/yr per analyst training line on top of the licence; real quotes vary.
Hidden costs beyond the licence
What gets added to the QRadar SOAR sticker number before you reach true TCO.
- Migration: customers on QRadar SaaS are transitioning to Palo Alto. Migration tooling and PS effort is the dominant near-term cost.
- Per-user metering: priced by named user, not by playbook or action; team growth costs.
- Cloud Pak for Security legacy: prior bundle pricing is being unwound. Renewals are an active negotiation moment.
- Integration recertification: bidirectional connectors to QRadar SIEM are being revisited under Palo Alto's stack.
Add-ons and bundles
Modules and bundle behaviour to factor into the total quote.
QRadar SIEM
Historically the upstream feeder. Post-acquisition the SIEM and SOAR are on diverging vendor paths.
Cortex platform
Palo Alto destination for migrating SaaS customers. Bundle pricing applies in deals that consolidate on Cortex.
What QRadar SOAR is best for
Existing IBM Resilient and QRadar SOAR customers navigating the Palo Alto transition, and on-prem-first SOCs that want IBM's incident-response heritage.
Independent benchmarks and references
- Resilient was a Gartner Leader-tier SOAR pre-acquisition.
- QRadar SOAR consistently rated in Gartner Peer Insights for case-management depth.
- Forrester Wave participation under IBM ownership.
Frequently asked questions
Is QRadar SOAR still sold by IBM?+
Yes. The Palo Alto deal that closed on 31 August 2024 covered the QRadar SaaS assets only and did not affect IBM's on-premises QRadar products. IBM continues to sell and support QRadar SOAR; SaaS customers are the ones migrating to Cortex.
What does the per-user model cost?+
Public RFP references put mid-five-figure floors for sub-100-user deployments. Real number requires a quote.
Should I migrate or stay on-prem?+
Depends on existing IBM commitment and the data-residency model you need. The Palo Alto migration changes the renewal economics materially.
The two vendors most similar by pricing model and fit that publish at least one rate.