Splunk SOAR (Now Cisco)

Cisco Bought Splunk for $28B.

Your SOAR Isn't the Priority.

Splunk SOAR was solid. Phantom was a pioneer. But Cisco didn't pay $28 billion for your SOAR playbooks. They bought Splunk Enterprise and the data platform.
SOAR is a side dish. Meanwhile, the product still requires Python for anything real, has no agentic AI, and reviewers are calling out the missing capabilities. You're running on a platform that's coasting.

See BlinkOps in Action
let-blink-micro-agents

What Practitioners Think of Splunk SOAR

Real feedback from verified users. Not our words.


"Lack of Agentic AI capabilities, which are a must needed to keep up with new products in the market."
Gartner Peer Insights
View Review
/01
"Looks like a great problem, but it is difficult to implement as most of the documentation is outdated and there aren't many plugins supported."
Gartner Peer Insights
View Review
/02
"Product very expensive. Not easy to implement. Complex security architecture. Skills shortage of staff."
G2
View Review
/03
"Integration is quite easy within the Splunk ecosystem but integration with other tools outside Splunk Ecospace is a little tedious job to do and also the documentation is not as rich as it should be."
G2
View Review
/04
"Have put a number of ideas on the ideas.splunk.com site for feature requests for the Splunk SOAR product. I posted one of them about three years ago, which finally got implemented in the latest release that just got announced, so the time to implement new features and things like that is a little bit concerning."
PeerSpot
View Review
/05

 What Practitioners Think of Blink 

From teams that made the switch.

"The ease of use of the product plus support creates the most powerful security orchestration and automation platform. The team built a product with support to make sure the product is not stagnant but actually providing outcomes which we did not get with Splunk, Palo Alto (Demisto) or Tines which we have owned or tried. Already paying for itself within a couple of months."
G2 Verified Review
/01
"The platform is straightforward to use. It was quite intuitive for my team to get started. The skill level required is much lower than we needed with our SOAR."
G2 Verified Review
/02
"What truly sets Blink Ops apart is their unparalleled speed with the fastest TTA (Time to Automation) in the market, surpassing competitors by as much as a hundred fold."
Tal Morgenstern, Partner at Lightspeed Venture Partners
/03
"Perfect 5-star rating in GigaOm's 2024 SOAR Radar Report for implementation of AI Security Automation. 400% year-over-year revenue growth."
GigaOm Radar Report 2024
/04

The Splunk SOAR Reality Check

What Cisco's $28B acquisition means for your SOAR investment.

1

Cisco Bought the Data Platform

Cisco paid for Splunk Enterprise, the SIEM, and the data pipeline. SOAR is a feature, not the product. Expect resources and roadmap to follow the money.

2

Playbooks = Python Scripts

Splunk SOAR playbooks are Python scripts. The visual editor is a wrapper. Anything beyond basic flows needs a developer. And they just forced a Python 3.13 migration. 

3

Agentic AI Capabilities

Zero AI agents. Zero reasoning. Zero adaptive workflows. Even Gartner reviewers are calling it out. The market moved. Splunk SOAR didn't. 

The Real Problems with Splunk SOAR

From actual users on Gartner, PeerSpot, and G2. Not our opinion.

lock

Everything Is Python Under the Hood

Splunk SOAR playbooks are Python scripts. The visual editor exists but it's a thin layer. Custom functions, data transforms, conditional logic, it all drops you into Python. Splunk just forced a migration from Python 3.9 to 3.13. If your code doesn't pass linting, it doesn't run. That's not low-code. That's a full development lifecycle for automation.
"Integration with other tools outside Splunk Ecospace is a little tedious job to do and also the documentation is not as rich as it should be." — G2 Verified Review
plug

No Agentic AI. Not Even Close.

Splunk SOAR has no AI agents, no reasoning engine, no adaptive workflows. Reviewers are explicitly calling this out. In 2025, every other platform is shipping AI triage agents and investigation copilots. Splunk SOAR is still running Python scripts in sequence. The architecture is fundamentally pre-AI.
"Lack of Agentic AI capabilities, which are a must needed to keep up with new products in the market." — Gartner Peer Insights
gear

High Cost. Complex Licensing.

Splunk SOAR pricing is subscription-based and varies by deployment size, automation actions, and whether you're cloud or on-prem. Multiple reviewers flag cost as a real problem, especially for smaller orgs. Add Splunk Enterprise licensing on top and you're in deep. Cisco acquisitions are not known for pricing getting cheaper. 
"Product very expensive. Not easy to implement. Complex security architecture." — G2 Verified Review
wand

Cisco Bought Splunk. Not Your SOAR.

Cisco paid $28 billion for Splunk's data platform, the SIEM, the observability stack. SOAR is a checkbox in a bigger play. The integration roadmap is focused on merging Splunk into Cisco's security portfolio. Where does standalone SOAR investment land in that priority list? Ask yourself that question seriously.
area

Documentation and Onboarding Are Pain Points

Multiple reviewers call out weak documentation, lack of tutorials, and a steep learning curve. If you're not already a Splunk power user, getting productive takes time. Video tutorials, guided setup, quick-start playbooks, things other platforms ship by default, are missing or inadequate.
"Difficult to implement as most of the documentation is outdated and there aren't many plugins supported." — Gartner Peer Insights
raft

Case Management and Reporting Need Work

Splunk SOAR has case management. But reviewers flag it as needing improvement alongside reporting, IAM integration, and API capabilities. The product was built as an automation engine first, case management second. And it shows. If your SOC needs a proper investigation hub, you'll feel the gaps.

Splunk SOAR vs. BlinkOps

One needs Python developers to maintain. The other gives your team AI agents out of the box.

Capability BlinkOps Splunk SOAR
AI Agent Builder No-code agent builder. Define role, responsibilities, abilities, constraints. Deploy custom AI agents for triage, enrichment, response. No agent builder. No AI agents. Playbooks are Python scripts executed in sequence.
AI Workflow Builder Builder Copilot. Describe what you want in plain English. AI generates full multi-step workflows in seconds. Visual editor wraps Python. Anything complex requires coding. No AI-assisted generation.
Agentic Workflows Hybrid: deterministic steps + micro-agent reasoning in the same workflow. Agent handles ambiguity, automation handles speed. Playbook-only. All logic is pre-defined Python. No reasoning or adaptive capability.
Analyst Copilot AI copilot inside case management. Full incident context, enrichment, response actions via chat. No dedicated copilot. Analysts work cases manually through the SOAR interface.
Integrations 30,000+ built-in integrations. Custom integrations in minutes via natural language. SplunkBase apps for integrations. Decent coverage but requires Python for custom connectors.
Coding Required Zero code. Natural language prompts generate workflows, agents, and integrations. Python required for custom functions, complex playbooks, and integration development.
Case Management Built-in with investigative copilot. Cases arrive pre-investigated with context and timeline. Basic case management. Reviewers flag it as needing improvement.
Self-Service Portal Any workflow as a self-service app. Web Forms. Available via portal, Slack, Teams, Zoom. No self-service portal. SOC-facing only.
Vendor Trajectory 400% YoY growth. GigaOm 5-star rating. Purpose-built for agentic security automation. Acquired by Cisco for $28B. SOAR is not the strategic priority. Roadmap unclear for standalone product.

Your Migration Path

Moving off Splunk SOAR doesn't mean starting from scratch. Your playbook logic transfers. Your integrations reconnect faster. And you stop writing Python.

1-1

Audit & Map

We analyze your Splunk SOAR playbooks, custom functions, and SplunkBase apps. Blink's import tooling maps your existing automation logic automatically.
Week 1
2-1

Build & Connect

Recreate workflows using Builder Copilot. No Python needed. Your tool stack connects through 30,000+ integrations. Custom connectors built in minutes, not days.
Week 2-3
3-1

Deploy & Expand

Go live. Then unlock what Splunk SOAR never offered: AI agents for triage, analyst copilot, self-service portal, and agentic workflows that reason through ambiguity.
Week 4