Tracecat

Tracecat enters the SOAR market with a fresh, agent-first philosophy. Instead of static workflows, you build AI agents that can triage alerts, correlate data, and propose actions — all with human approval gates. This is ideal for teams that want to scale without hiring more analysts. When to pick this: You're a security team that already uses modern stacks (CrowdStrike, Wiz, Sentinel, etc.) and wants to automate cloud alert enrichment, phishing triage, endpoint isolation, or OAuth app reviews. The open-source model means no vendor lock-in, and the MCP server integration list is impressive for an early product. When to pass: If you need a mature, battle-tested SOAR with hundreds of pre-built playbooks, Tracecat is still building its community content. Also, the self-hosted version may require significant DevOps effort. If you lack in-house automation skills, you'll likely need the Enterprise plan with the forward-deployed engineer. Comparison to Splunk SOAR or Palo Alto XSOAR: Tracecat is lighter, more developer-friendly, and AI-native. But it doesn't have the same breadth of integrations or regulatory compliance certifications (yet). It's a bet on where SOAR is going, not where it's been. Real-world caveats: The website shows a polished demo, but actual deployment at scale is unproven. The "AI-native" claim depends on model quality and your data. Human-in-the-loop is great for safety, but could slow fully automated scenarios. Community support for open source is a plus, but enterprise SLAs require paid tier.

Tracecat is an open source security automation platform designed for AI-native security teams. It enables teams to build agents, automate workflows, and triage alerts across their entire security stack. Tracecat replaces legacy SOAR with a modern, agent-driven approach that lets a team of 5 do the work of 50. Key features include a visual workflow builder with limitless control flow (loops, if-conditions, parallel subflows, and scripts), pre-built MCP servers for over 100 integrations, and human-in-the-loop agents with explicit tool approvals. The platform also provides a cases module for tracking investigations alongside AI agents that collect evidence, summarize findings, and prepare next actions. Tracecat supports hosted MCP servers to connect AI security agents to SIEM, EDR, MDM, CSPM, and more. The Enterprise plan includes a dedicated forward-deployed security engineer who helps connect tools and build custom agents over the first 3 weeks. With open source at its core, Tracecat gives teams full control and customization over their security automation. Unlike traditional SOAR solutions that rely on static playbooks, Tracecat empowers security teams to build custom agents that adapt to their specific alert queues and runbooks, offering a more flexible and scalable approach to security operations.