- Security teams want to automate across APIs without waiting for vendor-built connectors: Tines supports direct HTTP and webhook integration, action templates, reusable Stories, credentials, and vendor-agnostic automation across tools with APIs.
- Mission-critical workflows need collaborative development and controlled promotion to production: Change Control provides drafts, testing, visual diffs, review, approval, push to live, versions, notifications, test credentials, and audit records.
Security & Privacy / Security Orchestration, Automation, and Response (SOAR) Software
Tines Review, Pricing, Pros & Cons
Tines is an intelligent workflow platform with security-focused automation, case management, API integration, governed credentials, and human-in-the-loop response workflows.
Research by Global Tool Radar Research SystemEvidence checked: Aug 10, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Buying snapshot
Quick buying snapshot
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
- The buyer needs a SIEM, EDR, or managed detection service rather than an orchestration layer: Tines connects and coordinates those systems but does not replace their telemetry, detection engine, endpoint sensor, or staffed monitoring service.
- The organization requires a fully itemized public enterprise price before contacting sales: The paid editions publish capabilities but no binding numeric amount, minimum, payment timing, or contract duration.
- Persistent free edition plus sales-assisted paid editions; Cases and some hosted AI usage are separate commercial components.
- Paid amounts unverified — check official pricing
- The Free edition is a continuing entry plan. Cases documentation separately lists a one-time 45-day trial for that add-on.
Product scope
Product functionality and purchase scope
This profile evaluates Tines as a security orchestration and automation platform, including Stories, integrations, governed credentials, security cases, response workflows, monitoring, and deployment choices.
Product checked: Aug 10, 2026
- Tines Storyboard and security automation Stories
- Direct API, webhook, action-template, resource, credential, and reusable-story integrations
- Teams, roles, permissions, credentials, audit logs, and change control
- Security Cases when purchased as an add-on
- Tines-hosted or customer-supplied AI inside governed workflows
- Cloud and self-hosted paid-edition deployment options
- Generic HR, finance, revenue, product, and other non-security workflow use cases when scoring SOAR capability
- Tines Professional Services
- Customer-operated MDR, incident-response retainers, and third-party managed services
- Third-party SIEM, EDR, identity, ticketing, threat-intelligence, and LLM products connected through Tines
- Workbench when separately purchased or not included in the selected agreement
Pricing plans
Tines pricing table
Pricing checked: Aug 10, 2026
Official factConfidence 96%2 linked sources
The current pricing page clearly supports a zero-price Free edition and quote-based paid editions. A USD 0 Offer is retained only for the Free edition; no paid amount or contract term is inferred.
Official pricing pagePricing cautions
- Paid editions are quote based: Confirm edition, workflow or action limits, cloud or self-hosted deployment, support, onboarding, Cases, Workbench, AI allocation, overages, payment timing, and contract duration in the order form.
- Free AI allowance is not consistently described: The pricing page and AI billing guide use different free-package names, quantities, and reset states; do not combine them without vendor confirmation.
PlanPriceKey differencesBest for
Free editionTines Free editionSupporting pricing evidence
- $0 USD · per tenant · Free edition · minimum 1 tenant · Current public Free edition
- Live workflows: 3 workflows; Current Free edition.
- Users, spaces, and connectors: Unlimited not_applicable; Current Free edition.
Paid editionsTines paid editionsSupporting pricing evidenceAmount unverified — check official pricing
- Live workflows: Unlimited workflows; Current paid editions.
- Deployment options: Flexible; Subject to negotiated edition and deployment.
CasesTines Cases add-onSupporting pricing evidenceAmount unverified — check official pricing
- One-time trial: 45 days; Paid-plan tenant and add-on eligibility.
Plan upgrade triggers
Verified plan boundaries that can change the required edition.
The organization requires more than three live workflows, enterprise deployment options, negotiated governance features, or production scale.
Supporting pricing evidenceAnalysts require shared incident workspaces, records, dashboards, case templates, comments, actions, and case reporting.
Supporting pricing evidenceVariable usage cost
Usage cost scenarios
Calculate additional usage only where the plan allowance, unit, and period are established. Published rates are shown separately when an estimate is not available.
Tines-hosted AI runtime credits
$0.01 USD / AI runtime credit
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
This calculation compares usage with the published allowance on the same unit and period basis. It excludes taxes, negotiated terms, and unverified packaging conditions.
What is included, connected, or sold separately
Product scope
What is included, connected, or sold separately
Material capabilities are separated by their verified relationship to the target product.
Collaborative Cases, records, and dashboardsRelationship not verified
Cases are not assumed to be included in the base paid edition.
Plan: Paid editions: Not verifiedTines Cases
Managed detection and responseRelationship not verified
Tines can power managed workflows but does not itself establish a staffed MDR entitlement.
Customer or partner MDR service
Non-security intelligent workflowsRelationship not verified
Tines now supports many departments, but this category profile scores only security orchestration and response.
Plan: Free edition: Not verified · Paid editions: Not verified
Workflow implementation servicesRelationship not verified
Service labor is not scored as product capability.
Tines Professional Services
How the score is calculated
Scoring method
How the score is calculated
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
- Evidence confidence
- 76%
- AI claim confidence
- 98%
- Required-field evidence status
- 100%
- Evidence freshness
- 54%
- Field traceability
- 100%
- Model agreement
- 93%
Why this confidence level
- Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
- Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
- 8 of 8 weighted claims have evidence links.
- 0 A1 documentary official sources and 6 A2 official product sources are linked.
- 2 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
- 4 weighted claims are past the review window.
- No blocking evidence conflict was identified.
Automation and response depth20%
85Provides comprehensive ticketing, routing, and human-in-the-loop approvals, though full scale requires transitioning past the Free tier's workflow limit.
Playbook building and maintenance17%
86Eases workflow maintenance using collaborative drafts, isolated testing environments, visual review gates, and version history.
Connectors and ecosystem16%
87Direct HTTP, webhook, API, template, resource, credential, and reusable-story integration provide broad connectivity for security workflows. The score is limited because the facts describe direct integration methods, but they do not establish a catalog size or continuous sync guarantees.
Case and incident operations14%
72Standard workflow tools must leverage external ticketing platforms unless the separate Cases add-on is licensed.
Governance and execution security13%
85Enforces operational safety with granular roles, team permissions, shared credential configurations, and resource allocations.
Deployment, support, and total cost10%
63The Free edition lowers entry cost, but paid editions are quote-based and the public facts do not list support, onboarding, payment timing, or contract duration. Buyers therefore need a commercial check before they can compare total cost or service coverage.
Scale and operational analytics10%
75Unlimited users, spaces, and connectors on the Free edition and unlimited live workflows on paid editions support organizational growth, while dashboards and metrics provide operational visibility. The score is moderate because the facts support scale and analytics primitives, but they do not establish detailed volume limits, throughput guarantees, or advanced capacity analytics.
Public review signals
Tines earns strong ratings across two exact-product profiles
G2 and Gartner Peer Insights both show high aggregate ratings for the current Tines platform. Review themes favor approachable visual automation, API flexibility, rapid security workflow delivery, and support, while recurring cautions include complexity in large Stories, debugging effort, performance with heavy data, advanced-logic learning, and paid-edition cost visibility.
Public review signals updated: Aug 10, 2026
Commonly reported strengths
- Approachable visual workflow authoring with limited coding
- Flexible API-based integration across security and IT tools
- Fast delivery of repeatable security operations workflows
- Responsive support and useful learning resources
Commonly reported concerns
- Large workflows can become difficult to navigate and debug
- Advanced formulas and complex logic require learning
- Performance and event tracing can be challenging at higher complexity
- Paid-edition pricing is not publicly itemized
G24.7/5
- Review count
- 397 reviews
- Source context
- Tines on G2Exact product
Gartner Peer Insights4.8/5
- Rating count
- 57 ratings
- Source context
- Tines Intelligent Workflow Platform on Gartner Peer InsightsExact product
Tines tag profile
Company size
- Mid-market
- Enterprise
- Small business
Tines core capabilities
- Visual Storyboard for deterministic, AI-assisted, and human-led workflows
- Direct HTTP, webhook, API, template, resource, credential, and reusable-story integration
- Security alert enrichment, triage, routing, containment, remediation, ticketing, and notification workflows
- Teams, roles, permissions, shared credentials, resources, and story allocations
- Collaborative drafts, isolated testing, visual review, approval, version history, and change control
- Audit logs, story-run routes, event histories, metrics, dashboards, and operational tracing
Detailed strengths and purchase cautions
Why it is worth considering
- The Free edition supports a continuing entry plan with 3 live workflows and unlimited users, spaces, and connectors, which can let a team validate workflow design before negotiating paid licensing.
- The platform supports deterministic, AI-assisted, and human-led workflows with direct HTTP, webhook, API, template, resource, credential, and reusable-story integration, which gives security teams multiple automation patterns in one tool.
- Paid editions support unlimited live workflows and flexible deployment options, and the product also offers Docker-based self-hosted deployment for eligible paid customers.
- Cases add collaborative incident workspaces with records, templates, comments, actions, dashboards, and reporting for teams that want structured case handling alongside automation.
What to confirm before buying
- Paid-edition amounts, support, onboarding, payment timing, and contract duration are not publicly listed, so commercial comparison requires a quote.
- Cases are a separate paid add-on with a one-time 45-day trial, so buyers need to confirm whether incident management scope is included in the commercial package they want.
- Custom integrations and autonomous response depend on external APIs, permissions, credentials, rate limits, and safe workflow design, so outcomes depend on the buyer’s implementation discipline.
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
AI assessment updated: Sep 23, 2026
Score comparisonGeminiGPTxAIRange
Automation and response depth8586833
Playbook building and maintenance8883885
Connectors and ecosystem9284848
Case and incident operations7475678
Governance and execution security8682864
Scale and operational analytics8073728
Deployment, support, and total cost70615812
soar playbook automation depth8584823
soar alert triage enrichment9088864
soar case management coordination7572687
soar response action reliability8078746
soar metrics process improvement82707812
- Deployment, support, and total cost: 58–70 (12-point range)
- soar metrics process improvement: 70–82 (12-point range)
- Case and incident operations: 67–75 (8-point range)
GeminiAI-assisted buyer perspective82
Tines delivers a flexible, API-driven security orchestration and automation platform with visual workflows and human-in-the-loop approvals, though teams must navigate quote-based paid plans and separate commercial add-ons to achieve unlimited scale and incident case management.
- Review confidence
- 82/100
Model details
- Strengths
- Flexible visual workflow design utilizing direct HTTP, webhooks, API templates, and credentials rather than relying on restrictive pre-packaged connectors.
- Structured change control and governance features including collaborative drafts, isolated testing, visual review, and version history.
- A permanent Free edition that supports unlimited users, spaces, and connectors, allowing low-risk workflow experimentation.
- Cautions
- Incident case management and collaborative workspaces require purchasing the separate paid Cases add-on.
- Paid tier pricing, contract commitments, and support SLA terms are not publicly listed and require custom vendor negotiation.
- Free AI-use boundaries and credit allocations are inconsistently detailed across current documentation, making resource planning difficult.
GPTAI-assisted buyer perspective78
Tines fits security teams that want visual workflow automation for alert enrichment, triage, routing, approvals, containment, remediation, ticketing, and notifications, especially if they want to start on the Free edition and later negotiate paid editions or add Cases. Buyers should check production workflow needs, Cases scope, self-hosting requirements, and quote-based commercial terms before purchase.
- Review confidence
- 78/100
Model details
- Strengths
- The Free edition supports a continuing entry plan with 3 live workflows and unlimited users, spaces, and connectors, which can let a team validate workflow design before negotiating paid licensing.
- The platform supports deterministic, AI-assisted, and human-led workflows with direct HTTP, webhook, API, template, resource, credential, and reusable-story integration, which gives security teams multiple automation patterns in one tool.
- Paid editions support unlimited live workflows and flexible deployment options, and the product also offers Docker-based self-hosted deployment for eligible paid customers.
- Cases add collaborative incident workspaces with records, templates, comments, actions, dashboards, and reporting for teams that want structured case handling alongside automation.
- Cautions
- Paid-edition amounts, support, onboarding, payment timing, and contract duration are not publicly listed, so commercial comparison requires a quote.
- Cases are a separate paid add-on with a one-time 45-day trial, so buyers need to confirm whether incident management scope is included in the commercial package they want.
- Custom integrations and autonomous response depend on external APIs, permissions, credentials, rate limits, and safe workflow design, so outcomes depend on the buyer’s implementation discipline.
xAIAI-assisted buyer perspective77
Tines fits security teams that need visual low-code SOAR-style workflows for enrichment, triage, approvals, and response actions across APIs, with a permanent Free edition for limited live use and quote-based paid editions for broader production, provided the buyer owns workflow design and accepts separate Cases licensing plus non-public commercial terms.
- Review confidence
- 77/100
Model details
- Strengths
- Visual Storyboard supports deterministic, AI-assisted, and human-led security workflows with collaborative drafts, isolated testing, visual review, approval, version history, and change control.
- Verified workflows cover security alert enrichment, triage, routing, containment, remediation, ticketing, and notifications using direct HTTP, webhook, API, credential, and reusable-story integration patterns.
- Governance controls include teams, roles, permissions, shared credentials, resources, story allocations, audit logs, story-run routes, and event histories.
- The Free edition provides a USD 0 entry point with three live workflows plus unlimited users, spaces, and connectors before negotiating paid production licensing.
- Cautions
- Paid-edition amounts, workflow or action limits, support, onboarding, payment timing, and contract duration are quote-based and not publicly listed, so commercial fit must be confirmed in an order form.
- Cases, records, templates, comments, actions, dashboards, and case reporting are a paid-plan add-on with a one-time 45-day trial rather than core Free-edition functionality.
- The Free edition caps live workflows at three, so production scale requires moving to paid editions that state unlimited live workflows under negotiated terms.
- Custom integrations and autonomous response depend on external APIs, permissions, credentials, rate limits, and buyer-owned safe workflow design and ongoing maintenance.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
- Official sources
- 6
- Broad product review sources
- 2
- Marketplace and app-store sources
- 0
- Editorial sources
- 0
- Latest evidence check
- Aug 10, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handlingNo unresolved evidence conflict is currently recorded.
View research methodologyVerified findingsThe Free edition is a continuing entry plan. Cases documentation separately lists a one-time 45-day trial for that add-on.
- Persistent free edition plus sales-assisted paid editions; Cases and some hosted AI usage are separate commercial components.
- Visual Storyboard for deterministic, AI-assisted, and human-led workflows Direct HTTP, webhook, API, template, resource, credential, and reusable-story integration Security alert enrichment, triage, routing, containment, remediation, ticketing, and notification workflows Teams, roles, permissions, shared credentials, resources, and story allocations Collaborative drafts, isolated testing, visual review, approval, version history, and change control Audit logs, story-run routes, event histories, metrics, dashboards, and operational tracing Optional Cases with records, templates, comments, actions, dashboards, and reporting Cloud and Docker-based self-hosted deployment with paid-edition commercial agreement
- USD 0 for the Free edition; paid-edition amounts are not publicly listed.
- The current pricing page clearly supports a zero-price Free edition and quote-based paid editions. A USD 0 Offer is retained only for the Free edition; no paid amount or contract term is inferred.
Verification notes and unresolved itemsCurrent official pricing, platform, security, Cases, team, change-control, audit, and self-hosting sources support the exact security automation scope and all eight SOAR attributes.
- Generic business workflows, professional services, MDR, and third-party security products remain separate.
- Only the clearly free entry offer is numeric
- paid pricing and contract terms are not inferred.
Sources checked
Sources checked
Tines source links
Tines self-hosted deploymentTinesLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Tines TeamsTinesLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Tines Change ControlTinesLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Tines CasesTinesLevel A2Linked to 4 scored claimsChecked Aug 10, 2026
Tines pricingTinesLevel A2Linked to 4 scored claimsChecked Aug 10, 2026
Tines intelligent workflow platformTinesLevel A2Linked to 1 scored claimChecked Aug 10, 2026
FAQ
Tines FAQ
Can Tines be used for SOAR workflows?
Yes. Security automation is a primary Tines use case, including alert enrichment, triage, cases, human approvals, and actions across SIEM, EDR, identity, ticketing, and messaging tools.
Does Tines have a free plan?
Yes. The current pricing page lists a Free edition with unlimited users, spaces, and connectors and three live workflows.
Are Cases included in every plan?
No. Current documentation describes Cases, records, and dashboards as a paid-plan add-on with a one-time 45-day trial.
Can Tines be self-hosted?
Yes for eligible paid customers. Official documentation describes Docker-based self-hosting across common container environments, with infrastructure operation remaining the customer's responsibility.
Popular comparisons
Common Tines comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.