About the Security Orchestration, Automation and Response (SOAR) category
What belongs in this category
The Security Orchestration, Automation and Response (SOAR) category covers platforms that connect to the tools a security team uses and run playbooks: defined sequences of steps that enrich alerts, ask for approvals, open tickets and take response actions such as isolating a device or blocking an IP address. Typical entries offer a library of integrations, a visual playbook builder and case management.
SOAR is defined by orchestration through playbooks. Products that automate one particular SOC task fit SOC Automation, products that close routine alerts on their own fit Automated Investigation and Response, and AI that investigates alerts as an analyst would fits AI SOC Platform. A SOAR platform can also enter Security Automation or Security Operations.
Related categories to enter
Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the automation the platform runs: integrations available, playbooks in production, actions executed, and customers that run their response on it.
- Innovation — an orchestration problem solved in a new way, such as playbooks a team can build without code, integrations that keep working as tools change, or safe automated actions with clear approval steps.
- Impact — results for customers: response time cut, manual steps removed, analyst hours returned, incidents handled per analyst. Give figures from customers.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.
