Best Security Orchestration, Automation, and Response (SOAR) Software - Page 7

How Many Security Orchestration, Automation, and Response (SOAR) Software Products Does G2 Track?

Total Products under this Category: 101

Category Stats (Nov 2026)

  • Average Rating: 4.52/5 (↓0.01 vs Oct 2026) The average rating of products in this category, based on all submitted ratings
  • Top Trending Product: Singularity AI SIEM (+2.27%) - Among all products in this category, Singularity AI SIEM recorded the largest rating increase compared to last month

Last updated: November 01, 2026

How Does G2 Rank Security Orchestration, Automation, and Response (SOAR) Software Products?

Why You Can Trust G2's Software Rankings:

  • 30 Analysts and Data Experts
  • 3,800+ Authentic Reviews
  • 101+ Products
  • Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.

G2 Grid® for Security Orchestration, Automation, and Response (SOAR) Software

G2 Grid® for Security Orchestration, Automation, and Response (SOAR) Software plotting products by satisfaction and market presence

Highlighted products: Tines Stories, Google Security Operations, Torq AI SOC Platform, n8n, KnowBe4 PhishER/PhishER Plus, Palo Alto Cortex XSIAM, ServiceNow Security Operations, and Microsoft Sentinel.

Underlying data: [Grid® JSON](https://www.g2.com/categories/security-orchestration-automation-and-response-soar/grids.json?focus%5B%5D=tines-stories&focus%5B%5D=google-security-operations&focus%5B%5D=torq-ai-soc-platform&focus%5B%5D=n8n&focus%5B%5D=knowbe4-phisher-phisher-plus&focus%5B%5D=palo-alto-cortex-xsiam&focus%5B%5D=servicenow-security-operations&focus%5B%5D=microsoft-sentinel)

Sola

Sola is a self serve cybersecurity platform that enables teams to build, deploy, and manage custom security solutions without heavy engineering overhead. It allows organizations to address a wide range of security use cases through flexible, app based workflows, making security faster to implement and easier to scale.

Who Is the Company Behind Sola?

STORM

Who Is the Company Behind STORM?

  • Seller: OTRS Group
  • Year Founded: 2003
  • HQ Location: Oberursel, Germany
  • LinkedIn® Page: www.linkedin.com
    111 employees on LinkedIn®

StrikeReady

Transform your SOC team into a proactive cyber task force by streamlining and centralizing security operations, empowering your team to optimize intelligence, automate alert handling and expedite incident response. StrikeReady’s user centric design provides dynamic insights and real-time guidance enabling your team to make smarter, faster decisions. The platform also continuously learns and evolves ensuring security teams stay ahead of the ever-changing threat landscape.

Who Is the Company Behind StrikeReady?

AI can help you find the answers. G2 helps you trust them.

Connect G2 to Claude or ChatGPT for answers grounded in G2's trusted reviews, comparisons, and pricing from real user insights.

How it works

TotalHeal ResponseFlow

TotalHeal ResponseFlow is the SOAR & Automation product of TotalHeal, the security platform made in India by Freaquer Corporation Private Limited. Automate response with playbooks — and keep a human in the loop. It is managed from the TotalHeal console together with the other TotalHeal products, under one account and one bill. TotalHeal is available as a cloud service and for on-premises deployment. Every organisation can start a 30-day free trial from the console.

Who Is the Company Behind TotalHeal ResponseFlow?

Trickest Platform

Trickest provides an innovative approach to offensive cybersecurity automation, assets, and vulnerability discovery. The platform combines extensive adversary tactics and techniques with full transparency, hypercustomization, and hyperscalability, making it the go-to platform for offensive security operations. The Trickest platform comes with comprehensive tooling, scripting, managed infrastructure, scaling, ready-to-go solutions, and analytics, serving as a collaborative command center for Offensive Security, Penetration testing, Red teams, Security Analysts, and Security Service providers (MSSPs). What makes us different? Easy customization of logic, inputs, outputs, and integrations, making them adaptable to specific needs and thus producing superior-quality data compared to others. Some of the automation workflows and solutions that our customers deploy and execute: - Attack Surface Discovery - Vulnerability Scanning - Dynamic Application Security Testing (DAST) - Recon/Information Gathering (Passive & Active) - Organization OSINT - CVE scanning - Cloud Scanning - DNS recon & research - Subdomain Enumeration - Subdomain Takeover - Custom Security Automation and Orchestration Main components of the Trickest platform include: Solutions & Analytics - Ready-to-go and transparent solutions for Attack Surface Discovery, Vulnerability Scanning, Dynamic Application Security Testing (DAST), and Open-source intelligence OSINT, offering insight into every step of the process, easy customization, and Analytics on the top. The Builder - Access to 90+ workflow templates, 300+ open-source tools, Bash & Python scripting, CLI for building custom workflows to discover asset, vulnerabilities, scan network & apps, crawl, spider, enumerate, fuzz, bruteforce and much more. Hyperscalability - Whether scanning regional infrastructures with 100s of 1000s of assets or smaller organizational scopes, Trickest supports it all without per-asset costs.

Who Is the Company Behind Trickest Platform?

  • Seller: Trickest
  • Year Founded: 2020
  • HQ Location: Dover, US
  • LinkedIn® Page: www.linkedin.com
    12 employees on LinkedIn®

UpGuard Risk Automations

UpGuard Risk Automations is a powerful risk orchestration solution that empowers risk professionals and security operations teams to automate discovery, notification, and resolution across their entire tech stack. As part of the UpGuard Cyber Risk Posture Management (CRPM) platform, it acts as the connective tissue for Vendor Risk, Breach Risk, and User Risk to provide a unified defense against modern cyber threats. As organizations scale, security teams are often overwhelmed by siloed data sources and disjointed tools. Traditional manual handoffs waste valuable time and delay response efforts, leaving critical risks lingering. Risk Automations solves this by combining pre-built integrations, targeted visibility, and intelligent workflow resolution into a single drag-and-drop platform. Key Capabilities: • Pre-Built Integrations: Break down silos and connect your technology. Unify your current tools and data sources to eliminate time-wasting manual handoffs. Sync 100+ tools with pre-built integrations—including ServiceNow, Splunk, Cloudflare, Jira, and Microsoft Entra—directly with UpGuard to achieve a connected security ecosystem. • Targeted Visibility: Decisive action over chasing noise. Integrate high-fidelity alerts, reports, and tickets directly into the tools your team already uses, like Jira, Slack, Zendesk, and Microsoft Teams. Our AI triages the data, delivering contextualized insights directly to the right decision-makers. • Intelligent Resolution: Start remediating instantly. Trigger automated workflows that take action—from triaging a vulnerability and opening a ticket, to actioning remediation—the moment a risk is discovered. Add human-in-the-loop checkpoints to ensure you get the right amount of visibility and control for your needs. By translating complex data streams into automated, actionable workflows, UpGuard Risk Automations enables security leaders to eliminate manual handoffs, reduce time-to-resolution from days to seconds, and achieve a proactive, autonomous security posture.

Who Is the Company Behind UpGuard Risk Automations?

  • Seller: UpGuard
  • Year Founded: 2012
  • HQ Location: Mountain View, California
  • LinkedIn® Page: www.linkedin.com
    402 employees on LinkedIn®

Uplevel Security

Uplevel is the first intelligent cybersecurity system powered by graph-based machine learning. Our platform centralizes and contextualizes security data to provide the insights required for an efficient, powerful response.

Who Is the Company Behind Uplevel Security?

U.S.T.A.

PRODAFT, which stands for "PROactive Defense Against Future Threats", is a Swiss cyber threat intelligence company focusing on preventing breaches before they happen. We provide actionable insights right from the source by monitoring darkweb/deepweb channels and cybercriminals' environments. Since 2012, we have been pioneering one of the first cyberthreat intelligence platforms ever developed. Our CTI platform U.S.T.A. (Unified Security Threat Alliance) entails a unique synergy of five main modules: Deep Sight, Brand Protection, Fraud Intelligence, Security Intelligence, and Attack Surface Management.

Average Rating: 4.9/5.0

Total Reviews: 9

How Do G2 Users Rate U.S.T.A.?

  • Quality of Support: 10.0/10 (Category avg: 9.0/10)
  • Ease of Admin: 9.4/10 (Category avg: 8.6/10)

Who Is the Company Behind U.S.T.A.?

  • Seller: PRODAFT
  • Year Founded: 2012
  • HQ Location: Yverdon-les-Bains, CH
  • LinkedIn® Page: www.linkedin.com
    57 employees on LinkedIn®

Who Uses This Product?

  • Company Size: 44% Large, 33% Medium

What Do G2 Reviewers Say About U.S.T.A.?

AI-generated summary from verified user reviews

Pros
  • Users value the accuracy of information provided by U.S.T.A., enabling swift decision-making and effective threat management.
  • Users value the timely alerts from U.S.T.A. that help prevent cybersecurity threats before they escalate.
  • Users value U.S.T.A. for its preventive cybersecurity capabilities, enabling proactive threat detection and automated security responses.
  • Users find U.S.T.A. remarkably easy to use, appreciating its clean interface and straightforward navigation for threat intel.
  • Users value U.S.T.A. for its preventive cybersecurity solutions, enhancing operational security and threat response capabilities.
Cons
  • Users note that incomplete information about global threat intelligence limits the effectiveness of U.S.T.A.'s attack surface management.
  • Users experience information overload due to insufficient filtering and organization, complicating data management within U.S.T.A.
  • Users desire limited features in U.S.T.A. to be enhanced for better data management and usability.

What Are Recent G2 Reviews of U.S.T.A.?

Valkyrie Security Automation

Most OT teams aren't short on dedication. They're short on time, spread across too many priorities, buried in alerts, and toggling between too many tools. Valkyrie takes on the work an experienced OT analyst would otherwise do by hand. It pulls host and network data together, correlates it automatically, and points your team toward what deserves attention first. Valkyrie runs in your environment, so there are typically no hosting fees and your data stays with you. Deploy it as persistent sensors managed through built-in fleet management, or use it for a one-time assessment from a packet capture. Remote sites get the same depth of analysis as the main plant, because out of sight doesn't mean out of mind for attackers. Heuristic reports work with no AI at all. For teams that want it, the optional Automated Assessment adds AI-assisted analysis with a human analyst in the loop. It's augmentation, not autopilot, and you choose the model, including edge and local options. Valkyrie 2.0 adds in-product AI tabletop exercises, vulnerability insights, and threat rules.

Who Is the Company Behind Valkyrie Security Automation?

Brandon Summers-Miller
BS
Researched and written by Brandon Summers-Miller
Updated October 3, 2024