Try our new research platform with insights from 80,000+ expert users

Exabeam vs Splunk SOAR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 28, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Torq
Sponsored
Ranking in Security Orchestration Automation and Response (SOAR)
8th
Average Rating
8.6
Reviews Sentiment
4.9
Number of Reviews
2
Ranking in other categories
AI-SOC (13th), AI-Powered Security Automation (2nd)
Exabeam
Ranking in Security Orchestration Automation and Response (SOAR)
12th
Average Rating
7.8
Reviews Sentiment
6.7
Number of Reviews
19
Ranking in other categories
Security Information and Event Management (SIEM) (20th), User Entity Behavior Analytics (UEBA) (2nd), Security Incident Response (5th), Threat Intelligence Platforms (TIP) (12th), AI-Powered Cybersecurity Platforms (10th)
Splunk SOAR
Ranking in Security Orchestration Automation and Response (SOAR)
2nd
Average Rating
8.2
Reviews Sentiment
6.6
Number of Reviews
51
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of January 2026, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Torq is 4.9%, up from 4.5% compared to the previous year. The mindshare of Exabeam is 2.6%, up from 1.8% compared to the previous year. The mindshare of Splunk SOAR is 7.8%, up from 7.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR) Market Share Distribution
ProductMarket Share (%)
Splunk SOAR7.8%
Torq4.9%
Exabeam2.6%
Other84.7%
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

Trevor R. - PeerSpot reviewer
Cybersecurity Engineer at a real estate/law firm with 10,001+ employees
Automation has transformed phishing triage and case management for our security team
In terms of increasing alert handling capability for our SecOps staff, Torq's Identic AI is really strong in analysis, and recently, we started using what's called the AI Step, having really great success. Using that one piece of AI, we auto-closed 511 cases in quarter four alone. Torq has changed the day-to-day experience for my security analysts by enhancing their workload management and how they feel about their job, as they can now operate cases more quickly and have a nicer centralized location for information that previously required manual work. Torq's unified platform approach to AI SOC automation and case management has significantly benefited us by integrating the case management platform with the automation, which saves time compared to managing multiple point solutions across our security stack.
reviewer2650449 - PeerSpot reviewer
Analyst at a government with 1,001-5,000 employees
Machine learning features improve security insight but on-prem limitations prompt consideration of migration
We only use Exabeam for Advanced Analytics. We don't do all those other aspects like ticketing plugins. We just use it for the integration purposes, which are kind of basic. We send alerts via the dashboard for our SOC to identify risky users Exabeam includes machine learning features and…
SS
Manager cybersecurity at Hexion Inc.
Automates threat response and reduces investigation time but needs better threat intelligence integration
One thing that we would like to see with Splunk SOAR is the expandability to the threat intelligence feed. Currently, we have limited ingestion to the threat intelligence feed for the correlation purpose. We would like to see it being integrated, with license cost or without license cost, to leading threat intelligence sources such as Recorded Future, Feedly, or Flare. That is something we would appreciate having integrated. The second thing on the improvement side is about exposed credential-related information. If we start ingesting those data to Splunk SOAR or SIEM with some sort of integration with threat intelligence feed, that will also improve our detection and prediction method or help us with the investigation.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"As an analyst, it has demonstrated potential to reduce workforce requirements and time needed for related activities."
"Using that one piece of AI, we auto-closed 511 cases in quarter four alone."
"The most valuable feature of Exabeam is the timeline creation based on log sources, which helps in security investigations."
"The most valuable feature of Exabeam Fusion SIEM is the easy-to-use user interface."
"Exabeam Fusion SIEM has a good performance and more advantages than traditional solutions."
"Exabeam is very easy to use, with a straightforward platform and workflow, unlike other tools that require more expertise."
"Exabeam includes machine learning features and out-of-the-box rules that we rely on."
"The setup is not difficult. It was easy."
"The Exabeam SIEM has a user friendly UI interface."
"I have customers that like the EUBA functionality of it. The solution has the ability to build a session, basically. It pulls a lot of information together, for example, everything a user does in a specific timeframe. It's quite helpful."
"The most valuable feature of the solution is the playbook automation just because it allows us to reduce the manual actions that SOC has to handle."
"The most valuable feature of Splunk SOAR is the automated playbooks, which saves analysts time."
"Very flexible integration with other tools"
"The features of Splunk SOAR that I appreciate most are the integrations with all the other applications and tools."
"Splunk SOAR helps reduce my mean time to detect significantly and enhances it very well; it reduces the mean time to detect by approximately 70%."
"I have found all the security automation platform features of Splunk SOAR to be good. The Automation playbook development is highly useful."
"The automation part of the product is great."
"Scalability is the best feature of the solution."
 

Cons

"It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet."
"Regarding stability, I have noticed some lagging, crashing, and downtime, which is one of my largest gripes."
"Updating the new release of Exabeam Fusion SIEM takes time and slows our performance."
"They need to focus on more of the MITRE ATT&CK Framework and coverage. They claim they cover about 70 to 80%. I'm not sure if it's really quite that much, however."
"The only problem is that the UI is not very impressive."
"Exabeam needs to improve its adaptive nature towards rules and its capability to understand the entire client environment faster."
"Exabeam's reporting dashboard could have included a filtering option to filter by the most recent detection."
"Exabeam needs to improve its documentation and provide more customization for dashboards and case management."
"We had a large volume right from the beginning and they weren't quite prepared for that. That's something that they should think about when it comes to customers that have a large volume to start off with."
"Adding to the number of certifications that they have, for example, ISO 27001, would be helpful."
"In the beginning, we couldn't find any specific documents for every function. It wasn't easy to navigate to what we needed."
"The tool's response is slower because it has to search through a huge dataset, which can be improved for latency."
"Splunk SOAR has room to improve its offering for small-sized customers. The price is not fair for smaller-sized customers."
"SOAR is probably the most unreliable product Splunk has and that's because most of it is content driven from what you put into it. There are certain parts of it that have a little bit of difficulty at volume too. It's always changing. There is new stuff coming out for it that's going to make it a little bit better, but it does have some drawbacks."
"While there have been improvements to the investigation process, particularly with the playbook data, the current log review method is cumbersome."
"Splunk's support for integration is subpar and has room for improvement."
"We want to see improvements made to the APIs such that we can connect to many different systems and data sources."
"What we have seen is if the workflow gets halted or if we want to halt a workflow, it cannot be resumed."
 

Pricing and Cost Advice

Information not available
"There is an annual license required to use Exabeam Fusion SIEM. The price of the solution should be reduced."
"The solution is expensive."
"They have a great model for pricing that can be based either on user count or gigabits per day."
"Exabeam is not a cheap solution."
"Exabeam Fusion SIEM's pricing is reasonable."
"The platform is not extremely expensive compared to its direct competitors; I would rate its pricing around six out of ten."
"The licensing cost is reasonable."
"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."
"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."
"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."
"I don't know the exact price, but for my region, it is very expensive."
"Splunk SOAR is moderately priced, neither cheap nor overly expensive."
"Splunk SOAR is an expensive solution for an organization of our size."
"I found the price of Splunk SOAR to be good."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
880,511 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Computer Software Company
8%
Manufacturing Company
7%
Healthcare Company
7%
Financial Services Firm
12%
Computer Software Company
10%
Manufacturing Company
9%
Healthcare Company
6%
Financial Services Firm
12%
Manufacturing Company
11%
Computer Software Company
9%
University
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business12
Midsize Enterprise3
Large Enterprise7
By reviewers
Company SizeCount
Small Business12
Midsize Enterprise7
Large Enterprise32
 

Questions from the Community

What needs improvement with Torq?
From our research and testing with the tool, we determined there need to be modifications and changes to train the LL...
What is your primary use case for Torq?
I used Torq for conducting one of the proof of evaluations for a vendor we are connected with. I am currently working...
What advice do you have for others considering Torq?
One of our members uses AWS, and we receive their feed. This involves triaging AWS-related logs. While I do not have ...
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendli...
What is your experience regarding pricing and costs for Exabeam Fusion SIEM?
I do not have much information about the pricing. However, I am aware that Exabeam is cheaper than Palo Alto based on...
What needs improvement with Exabeam Fusion SIEM?
We use the on-prem Exabeam product and face limitations using the web UI and administration of custom models and rule...
What do you like most about Splunk Phantom?
Splunk SOAR's quick response to incidents is the most valuable part.
What is your experience regarding pricing and costs for Splunk Phantom?
I am familiar with the pricing aspect, setup cost, and licensing cost of Splunk SOAR, and it is pretty much similar t...
What needs improvement with Splunk Phantom?
The visibility of Splunk SOAR's playbook viewer is rather unclear to me; I wonder what the visibility is for. There a...
 

Comparisons

 

Also Known As

No data available
No data available
Phantom
 

Overview

 

Sample Customers

Information Not Available
Hulu, ADP, Safeway, BBCN Bank
Recorded Future, Blackstone
Find out what your peers are saying about Exabeam vs. Splunk SOAR and other solutions. Updated: December 2025.
880,511 professionals have used our research since 2012.