Splunk SOAR Pricing 2026
Pricing at a glance
Splunk SOAR (formerly Phantom) is sold by Cisco following the Splunk acquisition that completed March 2024. The Community Edition is genuinely free with a 100 licensed actions/day cap. Commercial editions are quote-only and typically bundled into Cisco security deals.
Source: www.splunk.com/en_us/download/soar-free-trial.html · Verified 2026-06-19.
Splunk SOAR publishes a $0 entry tier, putting it at the cheapest end of the cluster.
Tier breakdown
The full published-and-known tier list for Splunk SOAR. Tiers marked "Quote only" require contact with sales.
| Tier | Published price | Notes |
|---|---|---|
Community Edition | $0 | 100 licensed actions/day, 1 tenant, 5 cases in New/Open. Free download. |
SOAR on-premises | Quote only | Action-volume tiered. Quote only. |
SOAR Cloud | Quote only | Cisco bundle deals available post-2024. Quote only. |
Free / Community / Trial
Splunk SOAR Community Edition: 100 licensed actions per day, 1 tenant, 5 cases in New/Open at a time, single instance. Free download from the Splunk site. Full feature set is intact; the cap on actions is the only meaningful limit for sandbox use.
Cost scenarios
Three labelled scenarios. Where vendor data is insufficient to give a defensible figure we say so rather than guess. Worked numbers are flagged as illustrative.
Community Edition handles up to ~3,000 actions/month inside the 100/day cap. Plenty for a small SOC running a handful of playbooks. Year-one cost is $0 licence plus an engineer's part-time effort.
Commercial cloud or on-prem licence required once you exceed 100 actions/day. Quote only. Cisco bundle discounts are increasingly common where you already buy Splunk Enterprise Security or Cisco XDR.
100+ integrations, 24x7 SOC, tens of thousands of daily actions. Five-to-seven-figure annual licence is realistic per public RFP references. Real number requires a quote.
(Illustrative example, not a real company.) All scenarios apply a uniform $4,500/yr per integration engineering line and $1,800/yr per analyst training line on top of the licence; real quotes vary.
Hidden costs beyond the licence
What gets added to the Splunk SOAR sticker number before you reach true TCO.
- Action-volume overage: the meter is the unit of cost on the commercial editions. Spikes in alerts mean spikes in spend.
- Splunk Enterprise Security or Splunk Cloud Platform are typical co-purchases; SOAR rarely stands alone in a Splunk shop.
- Cisco bundling: post-acquisition the SOAR licence is often rolled into a Cisco security agreement. The standalone list price becomes harder to negotiate.
- Professional services: Splunk-certified PS work for integration build-out runs $250 to $400/hr in published rate-cards from Splunk partners.
Add-ons and bundles
Modules and bundle behaviour to factor into the total quote.
Splunk Enterprise Security (SIEM)
The native upstream feeder. Bundle pricing is the lever Cisco uses most often. See sister site siemcostcalculator.com for the SIEM-side anchor.
Cisco XDR / Secure Endpoint
Post-acquisition Cisco increasingly cross-sells. SOAR licence can fold into a broader Cisco security ELA.
What Splunk SOAR is best for
Splunk Enterprise Security shops that want native bidirectional integration, Cisco-aligned enterprises looking to consolidate, and teams that need the Splunk-certified integration catalogue with vendor-backed support.
Independent benchmarks and references
- Splunk SOAR is a named Leader-tier vendor in successive Gartner SOAR Magic Quadrants.
- Gartner Peer Insights and G2 SOAR category both list Splunk SOAR in the top five by review volume.
- PeerSpot reviews cite seven-figure deals for large enterprises with multi-tenant deployments.
Frequently asked questions
Is Splunk SOAR really free?+
Community Edition is free with a 100 actions/day cap and a 5-cases New/Open limit. For production scale you need the commercial cloud or on-prem licence, which is quote-only.
Did the Cisco acquisition change Splunk SOAR pricing?+
Officially no, but in practice many deals are now structured inside a broader Cisco security agreement. Standalone Splunk SOAR procurement still exists; bundle terms are negotiable.
How does action-based pricing work?+
Every executed automation action against an external system counts against the meter. Routine alerts can consume tens of actions each. The commercial tiers are sized to the volume you expect to run.
The two vendors most similar by pricing model and fit that publish at least one rate.