What is SOAR (security orchestration, automation, and response)?

• SOAR connects security tools and response actions. Predefined playbooks enrich alerts, create tickets, carry out approved containment actions, and escalate incidents for analyst review.
• Security automation reduces repetitive work. Analysts can automate established processes and stay involved when a decision requires further investigation or judgment.
• SOAR functionality is becoming standard across security platforms. SIEM platforms build it into their management plane, XDR (and some EDR) add native orchestration and containment, and agentic AI SOC platforms ship with built-in response workflows.
• AI enhances playbook-based automation. AI-driven playbooks extend what analysts can act on, while adaptive, agentic investigation can address alerts that fall outside predefined workflows.
• Exposure context can improve the information feeding SOAR. Tenable does not sell a SOAR product. Tenable One with Tenable Hexa AI provides validated, risk-prioritized exposure information along with deep asset context that can feed your existing SOAR and SIEM platforms.

SOAR (security orchestration, automation, and response) is a category of cybersecurity platform that brings alerts, threat intelligence, and response actions together. SOAR uses predefined playbooks to automate repeatable parts of incident response.

A SOAR platform can pull information from security information and event management (SIEM), endpoint detection and response (EDR), threat intelligence feeds, and other security tools. Its playbooks can enrich an alert with additional context, create a ticket, take an approved response action, or escalate the incident to an analyst.

SOAR addresses a longstanding problem for security operations centers (SOCs). Analysts have large volumes of alerts coming from different tools, but many investigations involve the same routine steps. SOAR automates those steps while keeping analysts involved where a response requires further investigation or judgment.

The term SOAR first appeared in 2015, although it originally stood for security operations, analytics, and reporting. By 2017, Gartner’s definition had changed to security orchestration, automation, and response, bringing security orchestration and automation, incident response, and threat intelligence capabilities into the same category. 

Security operations centers were dealing with growing numbers of tools, alerts, and data sources. Analysts often had to move between separate systems during an investigation and repeat many of the same response steps. SOAR brought those systems together and allowed teams to build the steps into reusable playbooks.

Tenable was working toward exposure management around the same time, but with a different focus: determining which exposures present the greatest risk. The company pioneered the exposure management category with its cyber exposure ecosystem in 2017 and introduced its first exposure management platform in 2018. 

Exposure data can now add information such as exploitability, asset criticality, and attack paths to the risk context available to a SOAR platform.

Security teams cannot investigate every alert or handle every response step manually. Vulnerability exploitation accounted for 31% of breaches in the 2026 Verizon DBIR, overtaking stolen credentials as the leading breach entry point for the first time. This context helps analysts work out which alerts need attention and what action to take.

SOAR takes repeatable work out of that process. A playbook can collect information from other tools, enrich an alert, open a ticket, take an approved containment action, or escalate the incident. Analysts remain involved when an investigation needs further analysis or a decision falls outside the playbook.

Automation still relies on knowing which risks must take priority. If a SOAR platform gets alerts without enough context, its playbooks can spend time on lower-risk issues while more important exposures go unaddressed.

Exposure data can help make that distinction by adding technical and business context to the findings that feed a SOAR platform.

A SOAR platform connects to SIEM, EDR, threat intelligence feeds, cloud security tools, and other sources. It unites alerts and information for investigations into one place.

SOAR playbooks set out the actions to take based on pre-defined conditions. Security engineers build and maintain these workflows, including where automation stops and an analyst steps in. A playbook might enrich an alert with threat intelligence, create a ticket, isolate a host, block an IP address, or resolve or escalate alerts through predefined playbooks.

SOAR platforms also support case management. Analysts can see what actions have already been taken, add findings, assign work, and keep an investigation record.

SOAR vs. SIEM vs. XDR

These categories are converging. SIEM and XDR increasingly build SOAR functionality directly into their platforms, so many organizations get orchestration as part of their existing stack rather than a separate purchase.

SOAR can cut down the repetitive work involved in investigating and responding to security alerts. What you automate will depend on your playbooks, integrations, and where you want analysts to remain involved.

1. Reduce manual triage: Gather alert data, enrich it with threat intelligence, and automatically create tickets.
2. Accelerate incident response: Trigger approved actions when an alert meets the conditions set in a playbook. 
3. Standardize response processes: Use agreed playbooks for incidents that recur so analysts follow the same response process.
4. Reduce context switching: Bring alerts, investigation data, and response actions together so analysts spend less time swapping between tools.
5. Free up analyst time: Automate routine investigation and response steps, and let analysts handle decisions that need human judgment.
6. Improve case management: Keep findings, actions, assignments, and investigation history together throughout the case.
7. Connect existing security tools: Link detection, threat intelligence, ticketing, and response systems to carry out actions across your security stack.

SOAR is evolving past playbooks built for known, repeatable tasks. AI is changing how security teams investigate alerts that do not fit those established workflows, although analysts still oversee higher-risk actions as part of a broader continuous threat exposure management (CTEM) program.

1. More adaptive investigation: Traditional SOAR relies on security engineers to build and maintain each playbook. Changes to tools, environments, and alert types can mean updating those workflows. Agentic security operations can investigate alerts that fall outside existing playbooks and gather context for analysts to assess them.
2. AI-driven playbooks: AI-driven playbooks take what analysts can act on further, including gathering information and supporting investigation. Human review remains important for actions that could affect systems or business operations.
3. Continued market growth: The SOAR market was valued at $1.87 billion in 2025 and is forecast to reach $4.42 billion by 2030, according to Mordor Intelligence.
4. Exposure data feeding TDIR workflows: Combining exposure data, such as asset criticality and exploitability, with TDIR data gives SOAR playbooks a fuller risk context.
5. Human oversight: Predefined playbooks can take approved actions without waiting for an analyst to complete each step. Decisions that require further investigation, judgment, or approval stay with the security team.

Security teams typically use SOAR where the same investigation or response steps come up repeatedly.

Decide what you want to automate, where analysts need to intervene, and who is responsible for keeping each playbook current.

• Start with repeatable, low-risk processes. Begin with tasks that analysts perform often, and that follow predictable steps, such as alert enrichment and ticket creation. Test these workflows before moving on to actions with greater operational impact.
• Define where analysts should step in. Set approval points for containment and other actions that could disrupt users, systems, or business operations. Include those points when you build the playbook.
• Prioritize the input to your playbooks. Alert severity doesn’t always reflect the risk an exposure poses. Consider exploitability, asset criticality, toxic combinations, and exploitable attack paths when deciding what needs action.
• Keep each playbook focused. Build workflows around a specific incident type or response process, with clear conditions for when they run and when they escalate to an analyst.
• Review playbooks as your environment changes. New tools, integrations, applications, and alert types can affect existing workflows. Check that playbooks still use the correct data, systems, and escalation paths.
• Keep a record of automated actions. Record what the playbook did, where an analyst intervened, and what decisions were made during the investigation. Use those records when reviewing the workflow.
• Add exposure context before remediation. Tenable One can prioritize exposures across IT, cloud, operational technology (OT), identity, and AI environments. You can use that context to determine which findings feed response and mobilization workflows.

Tenable One provides exposure context that can feed your existing SOAR and SIEM platforms, giving your team more information about which findings need attention. Tenable provides a number of integrations into SOAR products, such as Cortex XSOAR, FortiSOAR, Google SecOps, Swimlane, and Torq. 

Tenable One brings exposure data from IT, cloud, OT, identity, and AI environments into a prioritized view. Tenable Vulnerability Priority Rating (VPR) adds threat and vulnerability context to help prioritize remediation. 

While the Common Vulnerability Scoring System (CVSS) classifies approximately 60% of vulnerabilities as critical or high severity, research shows that about 1.6% represent meaningful business risk.

Exposure management also supplies asset context that SOAR playbooks do not generate on their own, including asset criticality, ownership, internet-facing status, and unmanaged assets (shadow IT). This context helps playbooks act on the exposures most likely to affect the business.

Attack path analysis adds another layer of context by showing how exposures can combine to create toxic combinations and exploitable attack paths. This gives teams information about exploitability and potential business impact before findings feed into response workflows.

Tenable Hexa AI adds agentic capabilities to exposure management. Available in Tenable One, Tenable Hexa AI can investigate exposures, prioritize findings, and mobilize remediation workflows through integrations with ticketing, IT service management (ITSM), and DevOps tools. These workflows can run alongside your existing SOAR deployment.

SOAR runs predefined response workflows against the information it receives. An exposure assessment platform (EAP) and exposure management help you decide which exposures warrant action before they reach those workflows.

Technical severity alone does not always show which exposure poses the greatest risk. Asset criticality, exploitability, toxic combinations, and exploitable attack paths add context about how an exposure could affect the business. 

Prioritizing exposures before they reach a SOAR playbook can reduce the number of lower-risk findings entering automated response processes. Analysts can then use the additional exposure context to decide what needs action and where it needs human judgment.

• Playbook maintenance: Tools, alert types, and response processes change. Review playbooks regularly and update triggers, integrations, actions, and approval points to reflect the current environment.
• Alert volume: High alert volumes can persist after you introduce automation. Use risk and exposure context to decide which findings need automated action, analyst review, or a lower priority.
• Integration gaps: New cloud, identity, AI, and other security tools may sit outside existing workflows. Review integrations as your security stack changes and check that playbooks have access to the data they need.
• Automation risk: Containment and remediation actions can affect users, systems, and business operations. Set approval points for higher-risk actions and define where an analyst should intervene.
• Inconsistent data: Security tools may assign different severity ratings and risk signals to related findings. Add technical and business context before findings trigger response actions.

SOAR is important enough to security operations that its capabilities are being built into existing product segments, including SIEM, XDR, and emerging agentic AI SOC tools.

AI is extending security automation beyond predefined SOAR playbooks, particularly for investigations that security teams cannot map out step by step in advance.

• Adaptive investigation: Agentic systems can gather information, follow findings across different data sources, and work through multi-step investigations. This extends automation to alerts without a playbook.
• Exposure context for AI agents: AI agents need information about assets, identities, vulnerabilities, exploitability, and business risk when assessing what to do next. Exposure management can supply that context.
• Connections through MCP: Model Context Protocol (MCP) gives large language models (LLMs) and agents a standard way to interact with external tools and data. Tenable Hexa AI uses MCP to connect AI clients to tools backed by the Tenable Exposure Data Fabric, including capabilities for investigating vulnerabilities, launching scans, creating tickets, and building custom workflows. 
• More choice over human involvement: Security teams can set different levels of oversight for different workflows. Tenable Hexa AI, for example, supports both automated execution and human approval, with actions logged for auditability.