IBM Resilient vs Splunk SOAR comparison

IBM and Splunk are both solutions in the Security Orchestration Automation and Response (SOAR) category. IBM is ranked #11 with an average rating of 7.7, while Splunk is ranked #3 with an average rating of 8.3. IBM holds a 1.9% mindshare in SOAR, compared to Splunk’s 7.8% mindshare. Additionally, 75% of IBM users are willing to recommend the solution, compared to 86% of Splunk users who would recommend it.

IBM Resilient

Read 18 IBM Resilient reviews

1,338 Views
1,204 Comparison Views

75% willing to recommend

Splunk SOAR

Read 46 Splunk SOAR reviews

5,266 Views
4,002 Comparison Views

86% willing to recommend

IBM Resilient

Splunk SOAR

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jun 15, 2025

IBM Resilient and Splunk SOAR are prominent players in the field of incident response and security orchestration. Splunk SOAR appears to have an advantage due to its extensive integration capabilities and mature automation modules.

Features: IBM Resilient provides comprehensive incident response capabilities with dynamic playbooks for quick actions. It integrates well with other IBM products like QRadar, offering a mature solution requiring fewer third-party products. Splunk SOAR excels in integration with non-Splunk solutions, has a vast library of pre-built integrations, and supports advanced automation and orchestration modules, allowing for scalable security management with customizable playbooks.

Room for Improvement: IBM Resilient could improve by enhancing integration with third-party products and offering more built-in connectors. Users suggest better technical support and documentation for smoother deployment. Pricing strategies also need reevaluation. Splunk SOAR could benefit from improved case management, reporting capabilities, and better support for emerging technologies like IoT/OT security while also addressing high pricing concerns.

Ease of Deployment and Customer Service: IBM Resilient primarily supports on-premises deployment, with users noting complex initial configurations. Customer support experiences are mixed. Splunk SOAR offers flexible deployment options, including hybrid and cloud, serving different organizational needs but receiving average ratings in technical support, with noted delays. Both solutions have opportunities to enhance response times in customer service.

Pricing and ROI: IBM Resilient is considered expensive, with user-based licensing. Some users see moderate ROI in time savings. Splunk SOAR is similarly priced high, posing a challenge for smaller organizations. Despite the cost, many users justify the investment given Splunk's powerful integration and automation. There is a call for more competitive and flexible pricing models for both to accommodate various organizational sizes and budgets.

To learn more, read our detailed IBM Resilient vs. Splunk SOAR Report (Updated: July 2025).

Buyer's Guide

IBM Resilient vs. Splunk SOAR

July 2025

Download the complete report

Helped 864,053 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

IBM Resilient

Ranking in Security Orchestration Automation and Response (SOAR)

11th

Average Rating

7.4

Reviews Sentiment

6.6

Number of Reviews

Ranking in other categories

Security Incident Response (3rd)

Splunk SOAR

Ranking in Security Orchestration Automation and Response (SOAR)

3rd

Average Rating

8.0

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of August 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of IBM Resilient is 1.9%, down from 2.7% compared to the previous year. The mindshare of Splunk SOAR is 7.8%, down from 8.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR)

Featured Reviews

Usman Bhatti

Senior Officer Security Operations Center at a financial services firm with 10,001+ employees

Simple deployment, scalable, but lacking third-party solution compatibility

Integrating IBM Resilient with other applications can be very difficult and technically challenging. Often, they use the excuse that you are using the latest version of an application, such as an endpoint security system, and they don't have an API or support for it at the moment. There is no automation in the SOAR solution. It's worth noting that many third-party add-on applications needed to be purchased separately to integrate with IBM Resilient. While there were built-in applications available for incident remediation, the selection was limited. Additionally, integrating third-party applications was often a difficult and time-consuming process due to the technical complexity involved.

Read full review

Hamada Elewa

System Engineer - Security Presales at Raya Integration

Playbook complexity challenges integration but customization enables professional operation

We work with Splunk SOAR from a security perspective, focusing on User Behavior Analytics (UBA) and Security Orchestration, Automation, and Response (SOAR) The customization of the playbook in Splunk SOAR is very beneficial. After building the playbook, it operates professionally. There is an AI…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable thing about it is how easy it is to navigate the user interface."

"The solution is reliable in our usage."

"The UBA, User Behavior Analytics, is very good."

"What I like most about IBM Resilient is that it has a complete stack, which means you don't need to use different OEM products because you have all you need under the IBM Resilient umbrella. You don't need to worry much about integrations and components because you're working with tested and proven architecture."

"This is a good solution that we recommend for customers."

"It is a stable solution...It is a scalable solution."

"The solution is simple to use and to integrate with IBM QRadar."

"The most valuable features of IBM Resilient are its flexibility and customization options for incident response."

More IBM Resilient pros

"The most valuable features of Splunk SOAR are the easy integration with other solutions, including other Splunk solutions. The most important playbooks we need on the market come already on the Frontend. However, nowadays, Splunk changed its name, it's not Frontend anymore, it's Splunk Store. This is a very strong point."

"The most valuable feature of the solution is the playbook automation just because it allows us to reduce the manual actions that SOC has to handle."

"The playbooks are valuable. They are the core component. Being able to implement and build a code process to work through and scale out what we want to do is valuable."

"Splunk SOAR's quick response to incidents is the most valuable part."

"Before its use, analyzing each email would take at least 15 to 20 minutes, with some complex cases taking up to 30 minutes...With the automation provided by Splunk Phantom, we could significantly reduce the amount of time and human effort required to complete this task."

"I'm just a beginner on the solution and it's pretty easy for me to use."

"Splunk SOAR has made a huge impact across security operations and the business overall."

"The most valuable feature is the API connector, depending on how it's formatted and who made the actual app offering for it. The REST API is my favorite component. It's very easy to use. The filters are also really valuable. Those are the two primary features but I enjoy using the rest of it."

More Splunk SOAR pros

Cons

"One thing to improve is how it handles data formats, which currently might require scripting for conversion to CSV before uploading."

"IBM Resilient could integrate better with my tools."

"The product must provide more integration with other tools."

"The ability to analyze incidents needs to be improved in the solution."

"Integration with some devices, including Cisco PowerPower and certain antivirus products, has limitations."

"This product could be improved with better customization. This product isn't the best on the market like QRadar, but it's actually a good solution. However, some competitors' solutions contain more integration, support, automation, or flexibility."

"The product needs a bit more development."

"The implementation could be a bit simpler."

More IBM Resilient cons

"Creating playbooks using the solution’s playbook editor, for me, is very cumbersome. There have been instances where I have said to myself that I just don't want to use this editor. I might just use a code block and write my own code within it... The functionality in the playbook editor is 80 percent there, but that 20 percent is still lacking. They could make it more efficient."

"Improving the integration ecosystem can raise the quality of the bottom tier of the integrations so that they can work better out of the box."

"It would be ideal for us if Splunk SOAR could integrate with Teams."

"SOAR is probably the most unreliable product Splunk has and that's because most of it is content driven from what you put into it. There are certain parts of it that have a little bit of difficulty at volume too. It's always changing. There is new stuff coming out for it that's going to make it a little bit better, but it does have some drawbacks."

"Some of the training materials are on a basic level."

"The algorithm and machine learning have room for improvement and can be more user-friendly."

"While there have been improvements to the investigation process, particularly with the playbook data, the current log review method is cumbersome."

"We've run into a few minor issues. Some of the playbook writing is a bit complicated. We've had a few hiccups with the source control. We'd really like to use GitHub deployment keys for a dedicated account. We haven't been able to do that. I think those are some of the major ones."

More Splunk SOAR cons

Pricing and Cost Advice

"I would rate the tool’s pricing a three out of ten. The tool’s pricing is on a yearly basis."

"Pricing for the solution is good, in my opinion."

"We could create unlimited users using the license we had purchased."

"It is very expensive."

"I feel it is an expensive product when my company pays annually for renewal, support, and follow-up."

"The cost of the product is quite high."

"There is a license you need to pay for in order to use this product."

"There are no costs except for the support services that our company pays in addition to the licensing charges attached to the solution."

More IBM Resilient pricing and cost advice

"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."

"The cost is high and the licensing is on an annual basis."

"Splunk SOAR is more expensive compared to other options for SOAR."

"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."

"I don't know the exact price, but for my region, it is very expensive."

"The licensing cost is reasonable."

"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."

"I found the price of Splunk SOAR to be good."

More Splunk SOAR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

864,053 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

33%

Computer Software Company

12%

Manufacturing Company

Government

Computer Software Company

14%

Financial Services Firm

12%

Manufacturing Company

11%

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about IBM Resilient?

It is a stable solution...It is a scalable solution.

See all answers

What is your experience regarding pricing and costs for IBM Resilient?

I am not the one in charge of pricing, so I am not sure about the costs.

See all answers

What needs improvement with IBM Resilient?

Integration with some devices, including Cisco PowerPower and certain antivirus products, has limitations.

See all answers

What do you like most about Splunk Phantom?

Splunk SOAR's quick response to incidents is the most valuable part.

See all answers

What is your experience regarding pricing and costs for Splunk Phantom?

Splunk SOAR is moderately priced, neither cheap nor overly expensive.

See all answers

What needs improvement with Splunk Phantom?

There are areas in Splunk SOAR that have room for improvement. To make Splunk SOAR a better solution, there could be better built-in debugging tools, smarter playbook suggestions, and enhanced life...

See all answers

Comparisons

Palo Alto Networks Cortex XSOAR vs IBM Resilient

Compared 36% of the time

IBM Security QRadar vs IBM Resilient

Compared 19% of the time

Fortinet FortiSOAR vs IBM Resilient

Compared 10% of the time

ServiceNow Security Operations vs IBM Resilient

Compared 9% of the time

Proofpoint Threat Response vs IBM Resilient

Compared 6% of the time

More IBM Resilient Competitors

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Compared 18% of the time

Cortex XSIAM vs Splunk SOAR

Compared 13% of the time

Fortinet FortiSOAR vs Splunk SOAR

Compared 11% of the time

ServiceNow Security Operations vs Splunk SOAR

Compared 10% of the time

IBM Security QRadar vs Splunk SOAR

Compared 2% of the time

More Splunk SOAR Competitors

Product Reports

Buyer's Guide

IBM Resilient

July 2025

Download IBM Resilient product report

Buyer's Guide

Splunk SOAR

July 2025

Download Splunk SOAR product report

Also Known As

No data available

Phantom

Overview

The Resilient Incident Response Platform (IRP) is the leading platform for orchestrating and automating incident response processes.

The Resilient IRP quickly and easily integrates with your organization’s existing security and IT investments. It makes security alerts instantly actionable, provides valuable intelligence and incident context, and enables adaptive response to complex cyber threats.

IBM

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk

Sample Customers

Golden Living, Health Equity, USA Funds

Recorded Future, Blackstone

Buyer's Guide

IBM Resilient vs. Splunk SOAR

July 2025

Free Report: IBM Resilient vs. Splunk SOAR

Find out what your peers are saying about IBM Resilient vs. Splunk SOAR and other solutions. Updated: July 2025.

DOWNLOAD NOW

864,053 professionals have used our research since 2012.

See our IBM Resilient vs. Splunk SOAR report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.