McAfee ePolicy Orchestrator vs Splunk SOAR comparison

McAfee and Splunk are both solutions in the Security Orchestration Automation and Response (SOAR) category. McAfee is ranked #13 with an average rating of 8.2, while Splunk is ranked #2 with an average rating of 8.4. McAfee holds a 1.0% mindshare in SOAR, compared to Splunk’s 7.5% mindshare. Additionally, 82% of McAfee users are willing to recommend the solution, compared to 87% of Splunk users who would recommend it.

McAfee ePolicy Orchestrator

Read 43 McAfee ePolicy Orchestrator reviews

1,173 Views
739 Comparison Views

82% willing to recommend

Splunk SOAR

Read 51 Splunk SOAR reviews

4,423 Views
3,361 Comparison Views

87% willing to recommend

McAfee ePolicy Orchestrator

Splunk SOAR

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 28, 2025

McAfee ePolicy Orchestrator and Splunk SOAR are IT security management tools competing in the enhanced security sector. McAfee stands out for its pricing and support, while Splunk SOAR has a superior feature set that justifies its higher cost.

Features: McAfee ePolicy Orchestrator focuses on centralized management, automating security processes, and integrating with McAfee products for extensive risk coverage. It offers virus signature updates, central manager policies, and endpoint protection management. Splunk SOAR features advanced threat intelligence, playbook automation, and robust integration capabilities. It provides a flexible API, customizable playbooks, and an easy-to-use interface, with integration options.

Room for Improvement: McAfee could enhance its AI tools, reporting customization, and offer more advanced automation features. Users seek improvement in scalability, user interface intuitiveness, and expanded integration options for McAfee. Splunk SOAR can reduce complexity, enhance initial setup usability, and streamline broader integration capabilities. Efforts could be made to improve hardware demands, simplify automation processes, and offer expanded documentation.

Ease of Deployment and Customer Service: McAfee ePolicy Orchestrator is appreciated for straightforward deployment and responsive, effective support, enabling quick onboarding. Splunk SOAR requires more extensive configuration upfront due to its complexity, yet it offers comprehensive support that enhances the overall customer experience.

Pricing and ROI: McAfee ePolicy Orchestrator offers a less expensive pricing structure, delivering quicker ROI, appealing to budget-conscious users. Splunk SOAR involves a higher initial cost but promises long-term ROI improvements due to its advanced features and efficiency in threat resolution. The decision hinges on budget preferences versus the necessity for advanced functionalities.

To learn more, read our detailed McAfee ePolicy Orchestrator vs. Splunk SOAR Report (Updated: December 2025).

Buyer's Guide

McAfee ePolicy Orchestrator vs. Splunk SOAR

December 2025

Download the complete report

Helped 879,259 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

McAfee ePolicy Orchestrator

Ranking in Security Orchestration Automation and Response (SOAR)

13th

Average Rating

8.0

Reviews Sentiment

6.5

Number of Reviews

Ranking in other categories

No ranking in other categories

Splunk SOAR

Ranking in Security Orchestration Automation and Response (SOAR)

2nd

Average Rating

8.2

Reviews Sentiment

6.6

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of December 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of McAfee ePolicy Orchestrator is 1.0%, up from 0.7% compared to the previous year. The mindshare of Splunk SOAR is 7.5%, up from 7.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR) Market Share Distribution
Product	Market Share (%)
Splunk SOAR	7.5%
McAfee ePolicy Orchestrator	1.0%
Other	91.5%

Security Orchestration Automation and Response (SOAR)

Featured Reviews

Binu Haneef

System Administrator at Sky News Arabia

Comprehensive security management enabled through efficient integration and automation

McAfee ePolicy Orchestrator helps automate routine security tasks. We created customized automation. For example, when we did not have an EDR or XDR solution, we created tasks exclusively for detection and response automation and automatic segregation of infected PCs. The ability to customize the dashboard in McAfee ePolicy Orchestrator helps us significantly. The main feature is automation for auto-segmentation and segregation. As we are in an AI era, McAfee can focus on AI tools. Instead of putting manual effort into each security-related task, it can implement more advanced automation using AI. This enhancement could improve cybersecurity significantly. Regarding the reporting area in McAfee ePolicy Orchestrator, we are satisfied with what we currently have. Our cybersecurity team needs customized reports beyond the default ones. We have more than 20 separate reports for identifying threats, managing, and understanding the security posture of our company and assets.

Read full review

Shiboo Suren

Manager cybersecurity at Hexion Inc.

Automates threat response and reduces investigation time but needs better threat intelligence integration

One thing that we would like to see with Splunk SOAR is the expandability to the threat intelligence feed. Currently, we have limited ingestion to the threat intelligence feed for the correlation purpose. We would like to see it being integrated, with license cost or without license cost, to leading threat intelligence sources such as Recorded Future, Feedly, or Flare. That is something we would appreciate having integrated. The second thing on the improvement side is about exposed credential-related information. If we start ingesting those data to Splunk SOAR or SIEM with some sort of integration with threat intelligence feed, that will also improve our detection and prediction method or help us with the investigation.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"McAfee is helping us to clean all of the viruses from the machines, protecting our desktops from the latest threats."

"Their support is really good. I would rate it a nine out of ten. I have never any issues with their support. They always reply and follow our queries on time."

"I like the solution's feasibility. McAfee ePolicy Orchestrator is also better and easier to use than other ePOs."

"The most valuable features of McAfee ePolicy Orchestrator are the easy-to-use console, and lots of reports, such as customized reports and inventory reports. Additionally, overall the centralized management is very good where you can see the compliance levels and inventory."

"The best part is management in McAfee ePolicy Orchestrator."

"The general endpoint protection is valuable, and it is easy to manage."

"The solution's best part is that it is very easy to manage McAfee Agent."

"The policy auditing, policy management, and device auditing are all valuable features. Our customers appreciated the ability to get alerts to system-wide events from a single view."

More McAfee ePolicy Orchestrator pros

"The solution allows us to customize playbooks and incorporate custom code, allowing us to drag and drop elements while still writing code to build the integrations we need."

"Its ability to integrate with other systems and applications in our environment is pretty easy. Sometimes if we see any complexity we try to involve a consultant to help us. Everything is through the built-in app. Splunk can connect to any assets through the built-in app. It could be in a platform, firewalls, or endpoints. It's easy if it's an app integration."

"The product provides 100% automation for certain processes."

"Technical support is helpful."

"SOAR allows custom code to be written and integrates with various technologies through pre-built apps like Windows Remote Management or custom apps we can build ourselves like a secret retrieval app from our vault."

"The most valuable features of Splunk SOAR are the easy integration with other solutions, including other Splunk solutions. The most important playbooks we need on the market come already on the Frontend. However, nowadays, Splunk changed its name, it's not Frontend anymore, it's Splunk Store. This is a very strong point."

"The most valuable feature of Splunk SOAR is the automated playbooks, which saves analysts time."

"I like the integration capabilities of Phantom. It has a lot of integrations with other products. Its searching methodologies are also good. It is also easy to understand and easy to create playbooks."

More Splunk SOAR pros

Cons

"We would like to see more integration with different platforms and extend this to other platforms. We are migrating to the cloud and want to extend it from our on-premises setup to the cloud."

"McAfee ePolicy Orchestrator could improve by supporting container microservices, such as Docker and Kubernetes."

"While there are bugs and a few functionality issues, it is just a matter of raising them with the support team. However, support is part of the problem as well. You want everything to be seamless in a perfect world, but the support is spread across different countries. They have Level 1, 2, and 3. Level 1 is most likely in a developing country. They don't provide the best service."

"Sometimes agents hang. We have to reinstall the agents."

"There needs to be support for Mac computers. Currently, McAfee does not work on iOS."

"Some drawbacks include difficulty in supporting improvements because we don't get proper response from Trellix support, so there is a need to improve the support."

"I would like to see McAfee reduce the amount of manual work required."

"The Virtual Patching feature needs to be improved."

More McAfee ePolicy Orchestrator cons

"Providing Splunk app developers and playbook developers Python Stub files so that way when they create custom code through their IDE, they can have IntelliCode suggestions."

"There is a lot of room for improvement with the UI."

"Splunk SOAR should improve its ease of upgrade, which is a pain point for us right now."

"The pricing could be a bit more reasonable. It would be great if it were feasible for smaller organizations."

"I haven't had any issues with the solution so far."

"It would be ideal for us if Splunk SOAR could integrate with Teams."

"The dashboard could be improved and some other features. SOAR should integrate network capabilities, allowing us to also monitor the WLAN network. Splunk is also expensive and difficult for beginners to learn. It's hard for a new user to figure out how to visualize old threat data. It took two to three months to learn with hands-on experience how to use the dashboard, visualize events, and analyze threats."

"I'm not an expert on Splunk SOAR, but I'm sure our team members know what areas could be improved."

More Splunk SOAR cons

Pricing and Cost Advice

"It's an expensive solution"

"On a scale from one to ten, where one is cheap, and ten is expensive, I rate the solution's pricing a three out of ten."

"McAfee ePolicy Orchestrator is a cheaply priced product, meaning it is not expensive since McAfee provides a free version of ePO, which includes phone support as well."

"$The price of McAfee ePolicy Orchestrator is expensive, it is approximately $6,000 to $9,000 per license annually."

"This solution is priced in the mid-range."

"McAfee ePolicy Orchestrator is not an expensive solution."

"For large enterprise companies, the price should be alright, but for small businesses, the uptake might be slow because, for these clients, the price doesn't look very attractive."

"There is a license required to use this solution. If we use the additional components, such as DLP encryption, there is an additional cost. However, it is similar to a separate product altogether. If you want to use that or not, it is optional, but when you use it, it will cost you additional pricing."

More McAfee ePolicy Orchestrator pricing and cost advice

"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."

"Splunk SOAR is an expensive solution for an organization of our size."

"Splunk SOAR is moderately priced, neither cheap nor overly expensive."

"The cost is high and the licensing is on an annual basis."

"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."

"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."

"I found the price of Splunk SOAR to be good."

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."

More Splunk SOAR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

879,259 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

Performing Arts

Computer Software Company

Financial Services Firm

12%

Manufacturing Company

10%

Computer Software Company

10%

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	13
Midsize Enterprise	11
Large Enterprise	19

By reviewers
Company Size	Count
Small Business	12
Midsize Enterprise	7
Large Enterprise	31

Questions from the Community

Which is better - Mcafee's MVision ePO or ePolicy Orchestrator?

Our organization ran comparison tests to determine whether Mcafee's MVision ePO or ePolicy Orchestrator network security software was the better fit for us. We decided to go with Mcafee's ePolicy O...

See all answers

What do you like most about McAfee MVISION ePO?

McAfee ePolicy Orchestrator's performance is good.

See all answers

What is your experience regarding pricing and costs for McAfee MVISION ePO?

It's an expensive solution.

See all answers

What do you like most about Splunk Phantom?

Splunk SOAR's quick response to incidents is the most valuable part.

See all answers

What is your experience regarding pricing and costs for Splunk Phantom?

I am familiar with the pricing aspect, setup cost, and licensing cost of Splunk SOAR, and it is pretty much similar to what industries are offering these days. We never had any issue when we had to...

See all answers

What needs improvement with Splunk Phantom?

The visibility of Splunk SOAR's playbook viewer is rather unclear to me; I wonder what the visibility is for. There are indeed some problems with integrating Splunk SOAR with other Splunk products ...

See all answers

Comparisons

Palo Alto Networks Cortex XSOAR vs McAfee ePolicy Orchestrator

Compared 17% of the time

Forcepoint Data Loss Prevention vs McAfee ePolicy Orchestrator

Compared 15% of the time

Symantec Data Loss Prevention vs McAfee ePolicy Orchestrator

Compared 15% of the time

IBM Security QRadar vs McAfee ePolicy Orchestrator

Compared 12% of the time

GTB Technologies Inspector vs McAfee ePolicy Orchestrator

Compared 11% of the time

More McAfee ePolicy Orchestrator Competitors

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Compared 16% of the time

Fortinet FortiSOAR vs Splunk SOAR

Compared 11% of the time

ServiceNow Security Operations vs Splunk SOAR

Compared 9% of the time

Tines vs Splunk SOAR

Compared 8% of the time

D3 Security vs Splunk SOAR

Compared 2% of the time

More Splunk SOAR Competitors

Product Reports

Buyer's Guide

McAfee ePolicy Orchestrator

December 2025

Download McAfee ePolicy Orchestrator product report

Buyer's Guide

Splunk SOAR

December 2025

Download Splunk SOAR product report

Also Known As

McAfee ePO, ePolicy Orchestrator, Intel Security ePolicy Orchestrator, McAfee MVISION ePO

Phantom

Overview

McAfee ePolicy Orchestrator (McAfee ePO) is the most advanced, extensible, and scalable centralized security management software in the industry. Unifying security management through an open platform, McAfee ePO makes risk and compliance management simpler and more successful for organizations of all sizes.

McAfee

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk

Sample Customers

Brelje & Race, Cognizant, Sutherland Global Services, Eagle Rock Energy, Arab National Bank, Bank Central Asia, Kleberg Bank, Leading Mexican Bank, SF Police Credit Union, Macquarie Telecom, Seagate Technology, Blackburn & Darwen Council, California Department of Corrections & Rehabilitation, IRCEP, Major U.S. State Government, State of Alaska, State of Colorado, Cemex, Deutsche Edelstahlwerke

Recorded Future, Blackstone

Buyer's Guide

McAfee ePolicy Orchestrator vs. Splunk SOAR

December 2025

Free Report: McAfee ePolicy Orchestrator vs. Splunk SOAR

Find out what your peers are saying about McAfee ePolicy Orchestrator vs. Splunk SOAR and other solutions. Updated: December 2025.

DOWNLOAD NOW

879,259 professionals have used our research since 2012.

See our McAfee ePolicy Orchestrator vs. Splunk SOAR report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.