80
%
of orgs agree SOAR is too complex, costly, and time consuming
90
%
of security pros claim SOAR required upfront investment to build automation workflows and response playbooks
92
%
agree that SOAR demands programming/scripting skills
"Scalability issues as data and alerts grow"
"High costs and hidden costs for professional
services, maintenance, consulting"
services, maintenance, consulting"
"Limited number of workflow automations/
playbooks deployed reduces ROI"
playbooks deployed reduces ROI"
"Complexity in setup and maintenance
requires extensive expertise"
requires extensive expertise"
SOAR's Fatal Flaws
"Coding expertise required to create
playbooks and integrations"
playbooks and integrations"
"Limited integrations and extensive knowledge
to write and maintain connectors"
to write and maintain connectors"
"Legacy pre-cloud architecture limits
scalability, efficiency, flexibility,
and development options"
scalability, efficiency, flexibility,
and development options"
"Limited number of useful out-of-the-box pre-built playbooks and automation templates"
Torq Hyperautomation Outperforms Legacy SOAR
GigaOm also recognizes that the hyperautomation revolution is NOW. GigaOm named Torq a leader and outperformer in its GigaOm Radar report.
The leading analyst firm lauds Torq for its “extensive feature set” and “impressive portfolio of customers.”
| SOAR | Hyperautomation | Advantages of Hyperautomation |
|---|---|---|
| Reactive | Proactive | SOAR platforms are designed to initiate actions based on alerts or loC. However, SOAR does not help preventative actions such as automated testing, cybersecurity posture assessment, and connection to identity and access management logs/behaviors (features offered by hyperautomation). |
| MTTD/MTTR | Mean-time-to-innocence | SOAR is designed to initiate playbooks at the time of alert and execute a workflow. Detection and response is good as far as it goes, but networks need to be returned “whole,” making certain the adversary has been defeated and the company’s cybersecurity posture has been returned to its golden state. Hyperautomation includes configurations, attack path analysis, and BAS. |
| Connects devices | Connects devices, clouds, containers, and processes | At its inception, SOAR platforms tend to be designed for on-premises use cases, but its connectivity options are only over APIs. Hyperautomation creates a connectivity mesh using API calls to connect hyperscalers, data lakes, Kubernetes, Saas applications, SSH, and even remote shell PowerShell. |
| Connectivity is as strong as the sum of its APIs | Enterprise-grade extensibility | SOAR is often prebuilt. The connections between devices are determined by code written in Python. Hyperautomation provides no-code and low-code connection offering drag-and-drop options. |
| Either overprovisioned or underprovisioned | Matches the resources needed for outcomes | A hidden cost in SOAR is the time and effort needed to “stand up” the platform. Hyperautomation is deployed as a SaaS-native requiring no professional services. |
Read the SOAR is Dead Manifesto
SOAR was built as a monolith with products relying on proprietary connectors to various IT and security products. The traditional SOAR operating model and architecture is obsolete.
