European SOAR and Security Automation Platforms

#1 Shuffle

Oslo, Norway Founded 2019 Hosted plans and support are listed on the vendor site, whose pricing page loads client-side Demo via the vendor

Best for: Security teams and MSSPs looking for a self-runnable open source SOAR

• Operating company. Shuffle AS
• Jurisdiction. EEA, not EU (Norway)
• Where the data sits. Install it on servers you control, or use the hosted cloud at shuffler.io (cloud region unspecified)
• Source code. Closed source
• Replaces. Palo Alto Cortex XSOAR, Splunk SOAR

Shuffle is an open source automation platform for security teams, with its code on GitHub under the GNU Affero General Public License v3.0, and the README describes it as built for and by security professionals and as suited to MSSPs and other service providers. Follow the published guide to install it on your own servers, or sign up for the hosted cloud at shuffler.io. Workflows are built visually, with webhooks and app integrations as the triggers and actions.

Shuffle AS is registered in Oslo, and the Norwegian business register shows it as a computer programming company registered in July 2019. Norway belongs to the EEA but not the EU. Hosted plan prices stayed out of reach because the pricing page loads client-side, and the cloud's hosting region is not given.

The README points to Discord, email and training for support and asks for GitHub sponsorship, which suggests a small core team. The AGPL also puts obligations on anyone who modifies the code and offers it as a network service. Case handling is usually paired with TheHive, which the README covers in blog posts.

Standout feature. No other standalone SOAR in this group lets you read the source and deploy it yourself the way Shuffle does.

#2 SecureVisio

Rzeszow, Poland (German office in Kakenstorf) Quote-based; a site page outlines deployment, support and licensing Book a demo

Best for: Mid-sized SOC teams and public bodies needing detection and response linked to an asset inventory

• Operating company. Esecure Sp. z o.o.
• Jurisdiction. EU (Poland)
• Where the data sits. No data location given on the pages we checked
• Source code. Closed source
• Replaces. Palo Alto Cortex XSOAR, Splunk SOAR, Splunk

SecureVisio is a Polish platform in which the SOAR layer sits beside SIEM and UEBA, so an alert reaches the analyst attached to asset, vulnerability and business-process data. The site lists a CMDB and a business impact analysis module, and incident priority comes from a risk score that weighs asset criticality, applied safeguards and rule severity. A component called SVBot watches analyst decisions and automates some triage actions.

The contact page names Esecure Sp. z o.o. at ul. Hoffmanowej 19 in Rzeszow, Poland, plus a German office in Kakenstorf, so the contracting side is inside the EU.

The site claims up to 99 percent automation of actions and 250-plus clients and partners, both vendor figures we could not check. Pricing comes on request, and the pages we read name neither a hosting region nor a self-hosted option, nor a founding year. Reference material is mostly Central European, so check connectors for tools popular elsewhere. Against a pure workflow engine such as Shuffle, the asset context is the difference.

Standout feature. SecureVisio alone derives incident scores from a built-in asset inventory and business impact analysis.

#3 TheHive

France Yearly subscription starting at EUR 26,000 across Gold, Platinum and ONE; a reduced Community Edition costs nothing for non-commercial work Book a demo

Best for: CERTs, CSIRTs and SOC teams centred on structured case handling plus automated analysis

• Operating company. StrangeBee SAS
• Jurisdiction. EU (France)
• Where the data sits. Run it in your own data centre, or take the SaaS version on a dedicated AWS environment (region unspecified)
• Source code. Closed source
• Replaces. Palo Alto Cortex XSOAR (case management), Splunk SOAR

TheHive is a case, alert and incident management platform from StrangeBee SAS in France, and it covers the part of response that analysts spend their day in. Alerts become cases, observables are sent to Cortex analysers, and Cortex responders act on the results. The vendor puts its user base at over 5,000 analysts in 50-plus countries, a figure it reports itself. MISP, MITRE ATT&CK, IMAP, webhooks and Cortex actions appear in the Gold edition.

Editions are Gold, Platinum and ONE, with the yearly subscription starting at EUR 26,000 and varying with deployment, users and organisations.

Platinum adds case reports, Microsoft 365 and Google Workspace email intake, Slack, Teams and Kafka connectors, custom functions and SAML, and the ONE plan adds TheHive Flow, a native orchestration engine, plus AI capabilities. Deployment is on-premises, cloud images or a SaaS on a dedicated AWS environment whose region is not stated. A feature-limited Community Edition is free for non-commercial use. For a small team without that budget, Shuffle is the cheaper place to begin.

Standout feature. TheHive starts from the case and its Cortex analysers, with orchestration arriving later.

#4 Tines

Dublin, Ireland Founded 2018 No-cost tier with 3 live workflows and unlimited users; higher plans quoted individually Book a demo

Best for: Security and IT teams after an auditable no-code workflow tool with a free starting edition

• Operating company. Tines Limited
• Jurisdiction. EU (Ireland)
• Source code. Closed source
• Replaces. Splunk SOAR, Swimlane, Zapier

Tines is a Dublin-founded workflow automation tool aimed at security and IT operations. Workflows are drawn as a directed graph of actions, a good match for incident response, where a false positive can close itself and a real alert reaches a person. By its own account the company dates from 2018, was started by two former security operators, and has SOC 2 Type II compliance with an annual audit.

Tines Limited in Dublin signs for customers outside North America, so a European buyer should see that entity on the order, since a US company handles North America. Three live workflows, unlimited users and connectors, and no credit card make the free edition enough to build a working pipeline before any purchasing talk.

Higher plans lift the workflow cap, with no price listed. The connector catalogue for general business tools is narrower than Make or n8n, and the product is meant for security and IT work, not for sales or marketing automation. Hosting options are mentioned by the vendor as something to discuss with its team.

Standout feature. Among these tools, only Tines lets a free edition with unlimited users run a genuine security workflow.

#5 Logpoint

Copenhagen, Denmark Licensed by node or by device Book a demo

Best for: European enterprises and public bodies moving off Splunk or QRadar

• Operating company. Logpoint
• Jurisdiction. EU (Denmark)
• Source code. Closed source
• Replaces. Splunk, Microsoft Sentinel, IBM QRadar

Guardsix, formerly Logpoint, is a SIEM from Copenhagen in Denmark with UEBA and SOAR built into a single platform. Its card here describes playbooks running locally within that platform, a deployment that can be air-gapped, and an action record meant for NIS2 and DORA reporting. The product comes as software, an appliance or SaaS, and the tool page lists compliance reporting for NIS2, GDPR and ISO 27001.

Licences are counted in nodes or devices, not gigabytes ingested, so adding a log source does not raise the bill. As a Danish company Logpoint contracts from inside the EU, and its tool page lists EU-only deployment options and EU security certifications. On the downside, its detection library is smaller than Sekoia's, node counts need checking on a large estate, third-party tooling is thinner than around Splunk, and sales are aimed at enterprises.

Standout feature. Guardsix describes its SOAR and its SIEM both running inside one installation that can be air-gapped, which no other platform on this list does.

#6 SEKOIA.IO

Paris, France Hosted subscription Book a demo

Best for: SOC teams and MSSPs that prefer the vendor to maintain detection content

• Operating company. SEKOIA.IO
• Jurisdiction. EU (France)
• Source code. Closed source
• Replaces. Microsoft Sentinel, Splunk, CrowdStrike Falcon LogScale

Sekoia, listed on this site as SEKOIA.IO, is a SOC platform from Paris pairing SIEM-like detection with in-house cyber threat intelligence. According to the tool page, the intelligence team's tracking of active threat actors feeds its detection rules, which map to MITRE ATT&CK, and case management plus automated response come with it. The card on this page adds that the automated incident response use case runs inside the same platform.

The company has its headquarters in Paris, hosts in France and presents itself as a sovereign choice for European SOCs. Multi-tenancy suits managed security providers. The price is a hosted subscription, typically by assets or events, so you must model it before comparing.

The tool page calls it SaaS only, though the card mentions an announced self-hosted option. The company is younger than the long-standing SIEM vendors, and its customer base is concentrated in France. The website moved to sekoia.com, and little beyond the homepage was readable when we checked.

Standout feature. Sekoia links its response layer to detection rules written by an in-house threat intelligence team, something the other platforms here do not.

#7 Torq

Tel Aviv, Israel (Americas HQ in Denver) Not given on the vendor homepage Book a demo

Best for: Mid-sized and large SOC teams shifting from scripted playbooks to supervised AI agents

• Operating company. Torq Technologies Ltd.
• Jurisdiction. Israel (outside the EU/EEA)
• Where the data sits. No data location given on the pages we checked
• Source code. Closed source
• Replaces. Palo Alto Cortex XSOAR, Splunk SOAR

Torq is a security automation vendor that has recast itself as an AI SOC platform. Its homepage says agents de-duplicate events, build verdicts grounded in the team's past decisions, open cases and respond, either autonomously or with a person on the loop. Product names on the site include Auto Triage, HyperAgents, Socrates, Case Management and Hyperautomation, and the vendor mentions audit logs and a manual override. It also supports agentic runbooks for threat hunting.

The privacy policy lists Torq Technologies Ltd., an Israeli-law company in Tel Aviv, as controller, and Israeli law governs the website terms. Torq Technologies, Inc., a US subsidiary, carries the EU-US Data Privacy Framework certification and operates the Americas headquarters in Denver.

Israel falls outside the EU and the EEA, and with the customer agreement unread the signing entity is unconfirmed. Pricing, self-hosting and data location are all absent from the pages we reviewed. Teams wanting scripted, deterministic playbooks may get less from the agent focus.

Standout feature. Torq builds its main interface around an AI agent that works under a human override, unlike any other vendor here.

#8 Cynet

Israel (Tel Aviv-Yaffo courts) Quote after a demo form Book a demo

Best for: Lean IT security teams buying detection and automated response from a single vendor

• Operating company. Cynet Security Ltd.
• Jurisdiction. Israel (outside the EU/EEA)
• Where the data sits. No data location given on the pages we checked
• Source code. Closed source
• Replaces. Palo Alto Cortex XSOAR, Splunk SOAR

Cynet comes from an Israeli endpoint and XDR vendor and carries its SOAR layer inside the platform, so no separate SOAR needs licensing or upkeep. Automated investigation starts when a detection fires, and the platform produces a graphical timeline, root cause analysis and an audit trail. Playbooks come prebuilt or are assembled in a drag-and-drop editor, and a phishing example on the SOAR page runs through trigger, investigate, contain, notify and verify.

Cynet Security Ltd. is the counterparty in the website terms, under Israeli law with Tel Aviv-Yaffo courts. We read only those terms, so the signing entity on customer contracts is unconfirmed. Pricing follows a demo request, and no data location is given.

Speed and automation percentages on its pages are the vendor's own measurements. The page says playbooks reach switches, firewalls and directories, but the list of supported products was not shown. Teams that want Cynet staff to watch alerts around the clock can add a 24x7 MDR option, which the other tools on this page do not match.

Standout feature. Cynet packages an endpoint product, SOAR and a managed 24x7 service from a single Israeli vendor, a combination no other tool here offers.

#9 Intezer

Israel (with a US affiliate) Starter and Complete tiers are charged per endpoint, figures only via sales Book a demo

Best for: SOC teams handing off Tier 1 and Tier 2 alert investigation instead of building playbooks

• Operating company. Intezer Labs Ltd. and Intezer Labs Inc.
• Jurisdiction. Israel (outside the EU/EEA)
• Where the data sits. No data location given on the pages we checked
• Source code. Closed source
• Replaces. Palo Alto Cortex XSOAR (triage playbooks)

Intezer sells an AI SOC that investigates alerts from endpoint, phishing, SIEM, cloud and identity sources, removes false positives, and escalates real threats for human review or automatic remediation. Its own navigation lists SIEM and SOAR as topics and its blog describes plugging the product into SOAR tools, so it often complements an orchestrator rather than replacing one. Starter covers one alert source and Complete covers all of them.

Both plans are charged per endpoint, with amounts available from sales. Starter includes automatic collection of files and URLs, deep investigations with sandboxing and AI, and auto-resolution of false positives, and Complete adds custom response workflows, an optional managed SIEM add-on and on-demand experts.

The terms of use name Intezer Labs Ltd. and Intezer Labs Inc. together under Israeli law, so the order must confirm which one contracts with you. We found no data location or self-hosting statement. It is not a general SOAR, because playbook breadth across arbitrary tools exists only in the Complete plan's custom workflows.

Standout feature. Intezer is sold as an investigation service for each alert, low-severity ones included, which sets it apart on this list.

#10 Hunters

Israel Quoted individually Book a demo

Best for: Small SecOps teams wanting automated investigation with no detections or playbooks to write

• Operating company. Cyber Hunters Ltd.
• Jurisdiction. Israel (outside the EU/EEA)
• Where the data sits. No data location given on the pages we checked
• Source code. Closed source
• Replaces. Palo Alto Cortex XSOAR (triage automation)

Hunters presents itself as a next-generation SIEM for small SecOps teams. The homepage credits Team Axon, its own staff, with building, managing and tuning detections, that scoring, correlation and enrichment run automatically, and that the platform covers everything from ingestion to response in one solution. It has no playbook editor on the pages we read, so it replaces part of a SOAR rather than the whole.

Cyber Hunters Ltd. and affiliated companies appear in the privacy policy, and the website terms fall under the laws of the State of Israel.

The navigation lists Hunters for Snowflake, Hunters for AWS and an MSSP solution, but those platform pages returned an error, so depth was judged from the homepage only. Pricing is quote-based and no data location is given. A team that already owns a SIEM and wants orchestration across its tools will get more from Shuffle or Torq, which is why Hunters ranks last on this page.

Standout feature. Hunters leaves the rules behind its automation to the vendor's own detection team instead of the customer, which sets it apart here.