Try our new research platform with insights from 80,000+ expert users

ServiceNow Security Operations vs Splunk SOAR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 9, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

ServiceNow Security Operations
Ranking in Security Orchestration Automation and Response (SOAR)
8th
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
20
Ranking in other categories
Security Incident Response (2nd), Risk-Based Vulnerability Management (10th)
Splunk SOAR
Ranking in Security Orchestration Automation and Response (SOAR)
3rd
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
45
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of ServiceNow Security Operations is 3.9%, down from 4.3% compared to the previous year. The mindshare of Splunk SOAR is 7.3%, down from 8.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

KishoreKumar4 - PeerSpot reviewer
A low-cost and open-source tool for incident and change management
If we encounter challenges while deploying, we raise incidents. These incidents are categorized by priority: high, medium, and low. We assign an incident number and notify the relevant teams to address the issue. For instance, if we experience a problem with Cloud services or any other issue, we…
Shubham Sinha. - PeerSpot reviewer
Helped eliminate repetitive and redundant tasks, but custom functions and reporting need a lot of work
The visibility of the solution’s playbook viewer depends on the right you assign to the analyst. SOAR has the flexibility to distinguish between the roles of analyst and owner. If the analyst's role is to just work on a ticket, they cannot view the playbook design platform. That is limited to the owner. That can be both a good and bad thing. A major problem I have faced in SOAR's rights distribution is roles and responsibilities. Suppose I am initially granted user rights or analyst rights, but later on, I also get admin rights. SOAR is unable to amend the limitations of my role. I raised a support ticket with Splunk about this. They said it's a bug in their 5.3.5 version. To fix this, I had to reinstall the entire platform from scratch, just to amend the rights and responsibilities of one role. This bug was not fixed. Also, the latest GUI is terrible. The previous one was better. Another point is that while using Splunk SOAR in an investigation is not difficult, there are some complex parameters. We have SOAR case management, but the licensing is going to put a big hole in your pocket. Also, there is an issue with investigation node addition. When you are doing node additions you cannot grant the entire environment to have SOAR visibility into the incident. So when you integrate it with an ITSM tool, like ServiceNow or Jira for ticketing purposes, there is a challenge. When you do nodes for investigation on a regular basis, sometimes it does not update our ServiceNow platform, which is terrible. It is a redundant activity for an analyst to update that in the case management as well as in the ITSM tool. Although SOAR provides integration, the functionality of investigation and nodes is terrible when it comes to integration. An additional area for improvement is custom function creation. It's terrible. A newbie cannot create custom functions right away. They would require a solid understanding first. Also, the reporting is really awful. If I want to do a report for a customized time period, such as the last three days or the last four days, or from the 10th to the 12th of June, that is not available in SOAR at all. That kind of feature is available in Cortex XSOAR. Reporting is a real challenge.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The SOAR module of ServiceNow Security Operations is the most valuable feature"
"ServiceNow Security Operations also takes care of GRC, governance, risk and compliance, enabling it to provide risk assessment."
"What I found most valuable in ServiceNow Security Operations is that it's very useful for any incoming vulnerability. For example, if my team finds any vulnerability on servers such as the CA and CMDB integrated with ServiceNow Security Operations, my team can make some changes. My team can map the vulnerabilities found on the CA server, make the changes required, and resolve the vulnerabilities before the system is attacked. You can avoid vulnerability attacks through ServiceNow Security Operations, so this is the best feature of the solution. ServiceNow Security Operations is beneficial mainly for vulnerability response and engagement purposes."
"Multiple projects use the ServiceNow tool because it is a low-cost and open-source tool."
"My favorite feature is the application vulnerability scanner."
"The most valuable aspect of working with ServiceNow is its meaningful and feature-rich product."
"The solution is stable."
"ServiceNow is a convenient platform to raise tickets, and the respective support team will contact us to resolve any issues."
"Splunk SOAR's quick response to incidents is the most valuable part."
"SOAR allows custom code to be written and integrates with various technologies through pre-built apps like Windows Remote Management or custom apps we can build ourselves like a secret retrieval app from our vault."
"Scalability is the best feature of the solution."
"Our customers find it easy to conduct searches and consider it an excellent content management system."
"The solution’s dashboard is really good and customizable. It also has a good UI."
"The most valuable features are the Splunk SOAR apps and playbooks."
"My understanding is the initial setup isn't too hard."
"The solution allows us to customize playbooks and incorporate custom code, allowing us to drag and drop elements while still writing code to build the integrations we need."
 

Cons

"The threat intelligence module needs a better dashboard."
"There is room for improvement in terms of developer support and documentation."
"Report generation within ServiceNow can take some time. Additionally, there are occasional issues when raising a ticket, which can also consume time."
"It is challenging for the customers to understand the processes for SecOps. It needs to be simplified."
"The initial setup is difficult."
"​Process framework and best practices for ease of integration between IT and security teams via incident, problem, and change.​"
"The product is called SecOps, but it is not security operations in terms of SIEM solutions."
"Customer awareness and understanding of ServiceNow's SecOps capabilities could be improved."
"It would be ideal if we could automate processes even more."
"Splunk SOAR should improve its ease of upgrade, which is a pain point for us right now."
"There are areas in Splunk SOAR that have room for improvement. To make Splunk SOAR a better solution, there could be better built-in debugging tools, smarter playbook suggestions, and enhanced lifecycle management."
"Some of the training materials are on a basic level."
"We've had trouble implementing the solution with Microsoft products. There seems to be an integration gap."
"The number of playbooks on offer should be increased."
"It would be ideal for us if Splunk SOAR could integrate with Teams."
"The scalability could be better."
 

Pricing and Cost Advice

"It is an expensive product."
"This product is a good value for the money."
"The solution is more expensive than BMC Remedy, the other ITSM tool available in the market."
"If you're going to implement it on your own, there would be internal costs. If you're going to implement it through a contractor or consultant, you have to pay for that."
"Compared to competitor tools, ServiceNow Security Operations is more affordable"
"The product is more expensive than other solutions."
"I don't know the exact price, but for my region, it is very expensive."
"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
"Splunk SOAR is moderately priced, neither cheap nor overly expensive."
"The tool is not cheap."
"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."
"I found the price of Splunk SOAR to be good."
"It's very overpriced because it is based on the number of users. There is no bulk licensing."
"Splunk SOAR is an expensive solution for an organization of our size."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
849,686 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Manufacturing Company
11%
Computer Software Company
9%
Government
8%
Computer Software Company
14%
Financial Services Firm
13%
Manufacturing Company
11%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about ServiceNow Security Operations?
The most valuable aspect of working with ServiceNow is its meaningful and feature-rich product.
What is your experience regarding pricing and costs for ServiceNow Security Operations?
The product is more expensive than other solutions like Archer but offers more features, making the pricing justifiable.
What needs improvement with ServiceNow Security Operations?
Report generation within ServiceNow can take some time. Additionally, there are occasional issues when raising a ticket, which can also consume time.
What do you like most about Splunk Phantom?
Splunk SOAR's quick response to incidents is the most valuable part.
What is your experience regarding pricing and costs for Splunk Phantom?
Splunk SOAR is affordable cost-wise only, but not competitive from a technical perspective compared to Palo Alto SOAR and FortiSOAR.
What needs improvement with Splunk Phantom?
The creation of playbooks is complex in Splunk SOAR ( /categories/security-orchestration-automation-and-response-soar ), and the number of integrations needs enhancement. Although it enhances alert...
 

Also Known As

No data available
Phantom
 

Overview

 

Sample Customers

DXC Technology, Freedom Security Alliance, Prime Therapeutics, Seton Hall University, York Risk Services
Recorded Future, Blackstone
Find out what your peers are saying about ServiceNow Security Operations vs. Splunk SOAR and other solutions. Updated: April 2025.
849,686 professionals have used our research since 2012.