Security orchestration automation and response software: AI search visibility ranking (2026)
How AI search engines rank security orchestration automation and response software by visibility and citations. 18 brands measured monthly across Google AI Mode: which brands the AI names in answers, which domains it cites as sources, and how the leaders compare. SOAR software used by security teams to automate investigations, orchestrate response workflows, connect security tools, and reduce incident handling time. Composite score: 70% visibility (% of AI answers naming the brand) + 30% citation rate (% citing the brand's domain). Full methodology →
Refreshed Jun 19, 2026Download this ranking as a PDF
We'll email it to you. One-off send — no list, no follow-up, no surprise marketing.
At a glance
What we observed in this categoryauto-generated
Splunk SOAR holds the top composite score (30.0) despite sharing identical visibility (37.5%) with Tines, Swimlane, and Torq. The separation comes from citation rate: Splunk SOAR is the only brand in the top four to earn any citations at all (12.5%), giving it a meaningful composite advantage over three peers locked at 26.2. In a category where the average visibility is just 11.1%, four brands simultaneously hitting 37.5% signals a clustered, highly contested top tier rather than a single dominant player.
Palo Alto Cortex XSOAR presents the sharpest divergence between named visibility and citation trust in the dataset. It records 0% visibility yet draws a 75.0% citation rate, the highest of any brand in the category, placing it fifth overall on composite score. This means AI responses frequently reference Cortex XSOAR as a source or evidence point without surfacing it as a named recommendation, a pattern that also appears for IBM QRadar SOAR (12.5% visibility, 25.0% citations) and suggests established enterprise vendors are treated as reference material rather than primary answers.
Google AI Mode is the top engine for every single brand in this dataset, indicating the audit is concentrated on that surface with no meaningful signal from other engines. The top cited sources include youtube.com, gartner.com, paloaltonetworks.com, ibm.com, softwarereviews.com, reddit.com, splunk.com, and underdefense.com. The presence of vendor-owned domains (paloaltonetworks.com, ibm.com, splunk.com) alongside analyst and community platforms in the citation list suggests AI is blending authoritative vendor documentation with third-party review and discussion content when constructing answers.
Movers & shakers since last refresh
Biggest visibility risers
-
Splunk SOAR 0% → 38% · rank #0 → #1+38pp
-
Tines 0% → 38% · rank #0 → #2+38pp
-
Swimlane 0% → 38% · rank #0 → #3+38pp
The ranking
| # | Brand | Visibility | Citation | Top engine |
|---|---|---|---|---|
| 1 |
splunk.com
|
38% | 12% | Google AI Mode |
Splunk SOAR leads with a composite score of 30.0, the only brand in the top four to earn citations (12.5%), pulling it above three peers sharing the same 37.5% visibility. |
||||
| 2 |
tines.com
|
38% | 0% | Google AI Mode |
Tines matches the category visibility high of 37.5%, more than three times the 11.1% average, but a 0.0% citation rate keeps its composite score at 26.2, behind Splunk SOAR. |
||||
| 3 |
swimlane.com
|
38% | 0% | Google AI Mode |
Swimlane sits joint second on visibility at 37.5% but records zero citations, producing a composite of 26.2 that is identical to Tines and Torq, with no differentiating signal between them. |
||||
| 4 |
torq.io
|
38% | 0% | Google AI Mode |
Torq shares the 37.5% visibility mark with three rivals but earns no citations, leaving it statistically indistinguishable from Tines and Swimlane at composite 26.2. |
||||
| 5 |
paloaltonetworks.com
|
0% | 75% | Google AI Mode |
Cortex XSOAR has 0.0% named visibility yet a 75.0% citation rate, the highest in the category, showing AI treats it as a reference source rather than a recommended solution. |
||||
| 6 |
microsoft.com
|
25% | 0% | Google AI Mode |
| 7 |
ibm.com
|
12% | 25% | Google AI Mode |
| 8 |
cloud.google.com
|
12% | 0% | Google AI Mode |
| 9 |
exabeam.com
|
0% | 12% | Google AI Mode |
| 10 |
fortinet.com
|
0% | 0% | Google AI Mode |
| 11 |
d3security.com
|
0% | 0% | Google AI Mode |
| 12 |
blinkops.com
|
0% | 0% | Google AI Mode |
| 13 |
servicenow.com
|
0% | 0% | Google AI Mode |
| 14 |
securonix.com
|
0% | 0% | Google AI Mode |
| 15 |
rapid7.com
|
0% | 0% | Google AI Mode |
| 16 |
logrhythm.com
|
0% | 0% | Google AI Mode |
| 17 |
dflabs.com
|
0% | 0% | Google AI Mode |
| 18 |
resolvesystems.com
|
0% | 0% | Google AI Mode |
Sources AI engines trust in this category
Across the 8 buyer-intent queries we ran on security orchestration automation and response software, these are the domains Google AI Mode cited most often. If you're not on this list — or if your competitors are — that's a concrete PR / linkbuilding target.
How to read this ranking
Four things worth knowing before you act on the numbers above. These are the same definitions across every industry page — for category-specific observations, see the What we observed section above (where available) and the per-brand insights inline in the ranking.
Visibility = being named
A brand's visibility % is the share of AI answers that mention it by name in the response prose. This is who AI engines actively recommend to the buyer.
Citation rate = being trusted
Citation rate is the share of AI answers that include the brand's domain as a clickable source link. This is what the AI treats as authoritative evidence — different from being named.
Top engine differs by brand
The "top engine" column shows which AI surface each brand performs best on. Big gaps between a brand's score across engines usually points to specific content or schema gaps.
Rankings move month to month
AI engines re-crawl and re-rank on shorter cycles than classical search. We re-audit every brand on this list at least every 30 days and refresh this page automatically.
Get your own security orchestration automation and response software brand audited
The brands above were curated from public market-leader lists. Want the same measurement against your own brand — including the queries you appear on, which competitors get named instead, and a prioritised fix list? Run a free preview.
Frequently asked about security orchestration automation and response software AI visibility
Who leads AI visibility in security orchestration automation and response software?
Splunk SOAR, Tines, Swimlane, and Torq all share the top visibility score of 37.5%, well above the category average of 11.1%. Splunk SOAR ranks first overall because it is the only one of those four to also earn citations (12.5%), giving it the highest composite score of 30.0.
Which SOAR brand is cited most often by AI even though it rarely appears as a named recommendation?
Palo Alto Cortex XSOAR has a 75.0% citation rate, the highest in the category, but 0.0% named visibility, indicating AI uses it as a reference or evidence source rather than surfacing it as a top answer.
What sources does AI cite most for SOAR category research?
The top cited sources are youtube.com, gartner.com, paloaltonetworks.com, ibm.com, softwarereviews.com, reddit.com, splunk.com, and underdefense.com. This mix spans vendor documentation, analyst platforms, and community discussion content.
How does citation rate differ from visibility in this category, and which brands show the biggest gap?
Palo Alto Cortex XSOAR shows the largest gap with 0% visibility against 75% citations, while Tines, Swimlane, and Torq show the inverse gap with 37.5% visibility and 0% citations. The category averages (11.1% visibility, 6.9% citation) confirm this divergence is a structural pattern rather than an outlier.
Which AI engine dominates this category and does any other engine provide meaningful signal?
Google AI Mode is listed as the top engine for all 18 brands in the dataset, meaning the audit currently provides no comparative signal from other engines in the SOAR category.
Are there any brands with strong composite scores but near-zero raw metrics?
Exabeam sits at rank 9 with 0% visibility and only 12.5% citations, producing a composite score of just 3.8. Fortinet FortiSOAR records 0% on all metrics, giving it a composite score of 0.0 despite being one of the 18 tracked brands.