First Impressions: An Open-Source SOAR with AI at Its Core
Upon visiting tracecat.com, I was immediately struck by the emphasis on being both open-source and AI-native. The landing page promises an “open source security automation platform for teams and AI agents.” After signing up for the free tier, I entered a clean workspace dashboard. The left sidebar houses sections for Inbox, Workspace, Workflows, Cases, Agents, Tools, Tables, Members, Variables, and Connections. The default view shows a task pane with workflows like “Isolate Gmail account from Slack request” alongside status indicators (Review required, Awaiting approval, In progress, Completed). I tested the workflow builder by initiating a Slack trigger. The AI copilot sprang into action, asking which Slack signal should trigger the action and which Gmail fields are needed. It then built a two-step workflow (Lookup Gmail account → Isolate Gmail account) and requested my approval before adding it. This live interaction confirmed that Tracecat truly integrates natural language commands into security automation.
What Tracecat Does and How It Works
Tracecat is a Security Orchestration, Automation, and Response (SOAR) platform reimagined for the modern AI era. It replaces legacy SOAR tools that rely on rigid playbooks and manual scripting. Instead, Tracecat lets teams build secure, agentic workflows through chat. The copilot can generate entire workflows from a simple description, as I witnessed with the Gmail isolation task. The platform includes over 200 pre-built enterprise connectors for security, IT, and platform apps. It supports limitless control flow (loops, if-conditions, parallel subflows, and scripts in Python, Bash, or JavaScript). A standout feature is human-in-the-loop agents: agents can run autonomously but require explicit tool approvals for sensitive actions. The Cases module provides a collaborative incident management interface with status, priority, severity, and a copilot that can draft summaries, timelines, and containment steps. Agents can be built with skills (e.g., SIEM log search, asset inventory) and attached to workflows or cases. Tracecat also offers a Tables feature for securely storing data like incidents, alerts, and access reviews.
Pricing, Models, and Technical Details
Pricing is not publicly listed on the website. The platform offers a free tier for building and self-hosting. An Enterprise Edition provides fine-grained access controls, open source audit logs, self-hosting anywhere, sandboxed execution, SOC2 Type II compliance, SLAs, reserved compute with autoscaling, version control for workflows, and bring-your-own-LLM capability. The underlying AI model appears to be a variant of Opus (version 4.5 is mentioned in the agent config) alongside support for any external LLM via API. The tool connects to MCP servers for agentic integrations. No REST API documentation is visible on the main site, but given the open source nature, an API likely exists in the repository. Tracecat is designed for deployment at enterprise scale and is trusted by security teams from companies like Depop.
Strengths, Limitations, and Verdict
Strengths: The AI copilot dramatically reduces the time to build and modify workflows. Human-in-the-loop approvals add a critical safety layer. Over 200 integrations cover most enterprise security tools. The platform is open source, allowing full customization and self-hosting. Sandboxed agent execution mitigates risk when running scripts or connecting to external LLMs. Limitations: As a relatively new entrant, the community and library of pre-built workflows are smaller than established SOAR platforms like Splunk Phantom or Siemplify. Pricing for the Enterprise Edition is opaque, which may deter budget-conscious teams. Documentation depth was not fully assessed but appears adequate from the screenshots. Verdict: Tracecat is best suited for security teams ready to move beyond legacy SOAR and embrace AI-native automation. It excels for organizations that need a flexible, open foundation with strong human oversight. If you require a mature ecosystem of out-of-the-box playbooks or have strict compliance needs that exceed SOC2 Type II, consider alternatives. But for innovative teams willing to experiment, the free tier is a risk-free way to transform incident response. Visit Tracecat at https://tracecat.com/ to explore it yourself.
Comments