No more typing reviews! Try our Samantha, our new voice AI agent.

D3 Security vs ServiceNow Security Operations comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 5, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Torq
Sponsored
Ranking in Security Orchestration Automation and Response (SOAR)
4th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
12
Ranking in other categories
AI-SOC (1st), AI-Powered Security Automation (1st)
D3 Security
Ranking in Security Orchestration Automation and Response (SOAR)
21st
Average Rating
9.0
Reviews Sentiment
7.5
Number of Reviews
2
Ranking in other categories
Security Incident Response (10th), AI-Powered Security Automation (6th)
ServiceNow Security Operations
Ranking in Security Orchestration Automation and Response (SOAR)
9th
Average Rating
8.0
Reviews Sentiment
6.5
Number of Reviews
24
Ranking in other categories
Security Incident Response (1st), Risk-Based Vulnerability Management (12th)
 

Featured Reviews

AD
Solutions Architect at Swimlane
Automation has streamlined multi-tenant SOC workflows and improves alert handling efficiency
Although the reporting within Torq is not that great, we did ask for many features regarding reporting in Torq, but due to some platform constraints, they could not make the whole dataset available for us to be used in reporting. Except for that, we used some basic reporting. When I used Torq, it was indeed in the early stages of AI capabilities. Only a few customers were allowed to use it, and we were among them. It functioned well as long as we summarized the data properly. If you input garbage, you would get garbage out. Thus, we had to do significant fine-tuning regarding what data context we provided to the AI orchestrator to get meaningful results. In terms of Torq's unified platform approach to AI SOC automation and case management compared to managing multiple point solutions across my security stack, I find it case-centric. The unified view in case management is good since it provides clarity, although there are limitations regarding how many items in case management can be modified at once. Bulk operations are very limited, potentially due to their back-end database or data retrieval processes that can be improved. Regarding improvements for Torq, when we were onboarded, there were aspects we were uncertain about, such as the number of cases that could be generated, what data we could bring in, how many clients we could onboard, and similar concerns. Initially, we also lacked clarity about the number of playbooks or workflows we could build. Different triggers like system triggers, case-based triggers, and others can be employed without restrictions, but when it comes to on-demand and scheduled jobs, there is a limitation based on the subscription and pricing tier that notably caps the number of workflows we can create. No bulk editing across cases was one issue, along with limited filtering related to single grouping constraints. Additionally, the out-of-the-box case templates provided require substantial modifications before they become usable. There is also a feature in the cases for notes that cannot be searched. They are only visible through the UI, which is another area for improvement. The workflow and execution-based charges seem misleading as this was not discussed initially. I am not sure if new customers are made aware of this. It seems that workflows revolving around cases hinder functionality outside of case management, as we have many use cases needing on-demand triggers and schedules for functions like reporting or polling devices. Creating additional workflows to achieve basic functionalities raises costs significantly, which disadvantages customers. While they facilitate optimization and scaling, the support received tends to be very basic. Improvements can be made in that area as well.
Muhammad Aamir Riaz - PeerSpot reviewer
Senior Manager Security Operation Center at The Bank of Punjab
Offers open API for integrating any available tools without any recurring costs
Before committing, I recommend a Proof of Concept (POC) or demo first. This way, you can see if the product aligns with your specific use cases and security needs. Knowledge transfer is key, and D3 Security's team excels in this area. During the POC, your analysts gain valuable product knowledge, putting them ahead of the curve for deployment. In our case, the learning curve was steep initially, but by the end of the POC, my team was already building playbooks independently. D3 Security also schedules dedicated knowledge transfer sessions during the POC, making it a win-win for both parties. Since technology transfer is crucial for government entities like ours, this approach eliminates the need for additional learning after deployment, unlike with certain competitors like the Fortinet FortiSOAR case. While Fortinet FortiSOAR achieved the desired tasks, its knowledge transfer process was lacking, leaving us with a shaky foundation. D3 Security's approach solidifies the learning and empowers our team. Overall, I would rate the solution an eight out of ten.
Kalyan Kothali - PeerSpot reviewer
Associate Vice President at Wissen infotech
Effectively manages vulnerabilities and reduces false positives
ServiceNow Security Operations provides significant control over vulnerabilities, allowing users to mark false alarms as false positives and ignore them, which is important because many vulnerabilities are not real but appear as such. There are many aspects that we could handle. For certain vulnerabilities, remediation requires spending extra on hardware or OS upgrades, or purchasing new versions, which implies a cost. For that reason, we can take an exception for a couple of months or days, and once that exception expires, that vulnerability automatically reappears. These features help us ensure that everything is under control, and when we discuss vulnerabilities, we can consolidate them into one central category, which means working on one vulnerability automatically resolves the rest, making it efficient with the features provided.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"What I appreciate most about Torq is that it is an essential part of our system."
"If I review about 100 vendors that I might work with, Torq is definitely in the top five that gave me personally investment back, just because every bit of effort I put into Torq eventually became a workflow that gave it back to me."
"Under one SOC tool in Torq, analysts get to know everything within the context of an alert or incident they are working on, and this ability to view the whole picture within Torq is one of the major breakthroughs and best offerings of Torq."
"As an analyst, it has demonstrated potential to reduce workforce requirements and time needed for related activities."
"Using that one piece of AI, we auto-closed 511 cases in quarter four alone."
"Once I started to use the system and I saw the potential, it changed all of our work in IT."
"Almost four or five hours of work is now completed in four or five minutes."
"Torq has helped a lot regarding SOC analyst efficiency."
"The solution's valuable feature is its GUI. It has more than 450 connectors, which are excellent for connecting devices and automating integration. The solution has all the features we need. We deployed it in our environment, and it's fully integrated. Thanks to their open APIs, the seamless integration makes everything work well together."
"It is an out-of-the-box automated integration with our 20 departments. We perform L1 LiveOps automatically through the portal."
"This product is a good value for the money."
"What I found most valuable in ServiceNow Security Operations is that it's very useful for any incoming vulnerability. For example, if my team finds any vulnerability on servers such as the CA and CMDB integrated with ServiceNow Security Operations, my team can make some changes. My team can map the vulnerabilities found on the CA server, make the changes required, and resolve the vulnerabilities before the system is attacked. You can avoid vulnerability attacks through ServiceNow Security Operations, so this is the best feature of the solution. ServiceNow Security Operations is beneficial mainly for vulnerability response and engagement purposes."
"It gives you the ability to bring data into the system. The workflows are out of the box, and it gives you the ability to auto-assign the incidents based on criteria and vulnerabilities."
"The ServiceNow platform provides tremendous value to organizations that not only want to implement SecOps, but when integrated with IT Service Management, IT Operations Management, Software Asset Management, Governance Risk and Compliance, and into their overall strategy for digital and business transformation."
"Basically, everything is consolidated into ServiceNow, so most organizations have configuration items in ServiceNow, ServiceNow has a vulnerability module as well, so it brings in data from third-party tools and it can utilize that data itself in Security Operations."
"It has helped optimize security costs by consolidating multiple tools into one platform."
"It streamlines processes; it collects data, takes that data and turns it into information, and allows you to manage through dashboards and work lists, improving every facet of the overall process."
"These features are very seamless, and the workspace along with the unified view of the entire application is something that is very impressive."
 

Cons

"The initial deployment of Torq was not easy."
"Even now, we have workflows that are in production that use AI steps and I get different results, making it unusable to some degree."
"Regarding stability, I have noticed some lagging, crashing, and downtime, which is one of my largest gripes."
"The initial deployment of Torq was not easy."
"Additionally, the documentation for Torq is not very clear. Most of the information is presented in videos, which are not ideal for reading; there are mostly paragraphs and other text-based content."
"Torq does extensive marketing saying that SOAR is dead and markets itself as an all-in-one solution, but this is not actually true."
"We have MCP that we are working with our cloud security platform, and we wanted to connect this MCP to the case management."
"I wish Torq's AI assistant for building templated workflows from scratch worked better; when you start with a blank slate, asking AI to help you build or template the workflow out does not go well."
"The reporting, especially custom reporting, needs to be improved. Additionally, it would be better if it could be hosted on Linux."
"Reporting needs improvement. MTTR and MTTD metrics aren't directly available in playbooks and require manual effort to achieve."
"I would rate technical support for ServiceNow Security Operations as a six out of ten in terms of faster resolution."
"One area for improvement for the product is the need to tailor and alter some codes for customization, which can cause issues during upgrades. It does not support customized operations."
"Report generation within ServiceNow can take some time."
"There are limitations for the third-parties that are providing the inputs. They should increase the robustness of the solution."
"It's very slow. When you click a button or update a field, it takes forever to actually react."
"An area for improvement I observed in ServiceNow Security Operations is the need to maintain correct CMDB data because if you're unable to do this, you can't perfectly maintain the vulnerability data. CMDB data in ServiceNow Security Operations needs to be accurate. As I've been working on ServiceNow Security Operations for only seven months, I still need more time to try all its modules before I can give recommendations regarding additional features I'd like to see in the solution."
"There are limitations for the third-parties that are providing the inputs. They should increase the robustness of the solution."
"The initial setup is difficult."
 

Pricing and Cost Advice

Information not available
Information not available
"Compared to competitor tools, ServiceNow Security Operations is more affordable"
"The solution is more expensive than BMC Remedy, the other ITSM tool available in the market."
"This product is a good value for the money."
"It is an expensive product."
"The product is more expensive than other solutions."
"If you're going to implement it on your own, there would be internal costs. If you're going to implement it through a contractor or consultant, you have to pay for that."
report
Use our free recommendation engine to learn which Security Incident Response solutions are best for your needs.
896,563 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Comms Service Provider
10%
Construction Company
9%
Manufacturing Company
9%
Comms Service Provider
25%
Computer Software Company
15%
Outsourcing Company
10%
Construction Company
9%
Financial Services Firm
17%
Manufacturing Company
13%
Government
5%
Computer Software Company
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise5
Large Enterprise5
No data available
By reviewers
Company SizeCount
Small Business6
Midsize Enterprise2
Large Enterprise17
 

Questions from the Community

What needs improvement with Torq?
To improve alert handling capability, there are ready-to-use playbooks available, but there are very few. Torq should...
What is your primary use case for Torq?
Torq is primarily used for security operations, mainly for the SOC team. I develop use cases based on requirements fr...
What advice do you have for others considering Torq?
The maintenance side is very good because we are using the product to reduce activities. For instance, sometimes ther...
What needs improvement with D3 Security?
The reporting, especially custom reporting, needs to be improved. Additionally, it would be better if it could be hos...
What is your primary use case for D3 Security?
We use the tool for automation and reporting. It helps to automate our playbooks.
What advice do you have for others considering D3 Security?
It was easy to integrate the tool with our infrastructure because all the APIs are pre-built. We just created a drag-...
What is your experience regarding pricing and costs for ServiceNow Security Operations?
In my opinion, the pricing is quite affordable considering the features, and I do not find it expensive. I would not ...
What needs improvement with ServiceNow Security Operations?
I would like to see new features added, particularly regarding the incident upgrading part. For instance, if you have...
What advice do you have for others considering ServiceNow Security Operations?
For someone looking to use ServiceNow Security Operations, I recommend that they read about the documentation and spe...
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

Information Not Available
S&P Global, Scotiabank, Cybereason, Cummins
DXC Technology, Freedom Security Alliance, Prime Therapeutics, Seton Hall University, York Risk Services
Find out what your peers are saying about D3 Security vs. ServiceNow Security Operations and other solutions. Updated: April 2026.
896,563 professionals have used our research since 2012.