CRITICALSTART vs Splunk SOAR comparison

Critical Start and Splunk are both solutions in the Security Orchestration Automation and Response (SOAR) category. Critical Start is ranked #31, while Splunk is ranked #3 with an average rating of 8.0. Critical Start holds a 0.2% mindshare in SOAR, compared to Splunk’s 7.2% mindshare. Additionally, 100% of Critical Start users are willing to recommend the solution, compared to 85% of Splunk users who would recommend it.

CRITICALSTART

Read 10 CRITICALSTART reviews

111 Views
59 Comparison Views

100% willing to recommend

Splunk SOAR

Read 44 Splunk SOAR reviews

4,577 Views
2,761 Comparison Views

85% willing to recommend

CRITICALSTART

Splunk SOAR

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Dec 5, 2024

Splunk SOAR and CRITICALSTART compete in the cybersecurity orchestration, automation, and response market. Splunk SOAR leads with extensive integrations and sophisticated feature sets, whereas CRITICALSTART is notable for its robust threat detection and response capabilities, making it highly valued for its perceived value and ease of use.

Features: Splunk SOAR offers automated workflows, customizable playbooks, and advanced integration capabilities, ideal for sophisticated threat management. CRITICALSTART excels with managed detection and response services, advanced threat analytics, and 24/7 security monitoring. While Splunk SOAR supports complex integration, CRITICALSTART focuses on effective real-time threat detection.

Room for Improvement: Splunk SOAR can improve in deployment complexity, user training, and simplifying integration processes. CRITICALSTART should focus on reducing upfront costs, enhancing mobile app features, and improving the intuitiveness of its user interface. Both solutions could enhance predictive analytics capabilities to match evolving cybersecurity threats.

Ease of Deployment and Customer Service: CRITICALSTART offers a streamlined deployment process with quick onboarding and continuous customer support. Splunk SOAR requires detailed configuration to optimize its powerful tools, demanding more deployment time compared to CRITICALSTART’s seamless setup and supportive customer service approach.

Pricing and ROI: Splunk SOAR requires substantial setup investment for customization and scaling, promising a strong long-term ROI for complex environments. CRITICALSTART has higher upfront costs but offers immediate value in threat mitigation and operational efficiency. Buyers often find CRITICALSTART’s cost appealing due to its tangible returns, while Splunk SOAR provides robust ROI potential over time for larger enterprises.

To learn more, read our detailed CRITICALSTART vs. Splunk SOAR Report (Updated: March 2025).

Buyer's Guide

CRITICALSTART vs. Splunk SOAR

March 2025

Download the complete report

Helped 846,617 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

CRITICALSTART

Ranking in Security Orchestration Automation and Response (SOAR)

31st

Average Rating

9.4

Reviews Sentiment

7.3

Number of Reviews

Ranking in other categories

Managed Detection and Response (MDR) (32nd)

Splunk SOAR

Ranking in Security Orchestration Automation and Response (SOAR)

3rd

Average Rating

8.0

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of April 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of CRITICALSTART is 0.2%, up from 0.1% compared to the previous year. The mindshare of Splunk SOAR is 7.2%, down from 8.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR)

Featured Reviews

Preston Broesche

Director of Information Technology at Kirby Corporation

Saves my team time and alert fatigue, allowing us to concentrate on more important things

The Trusted Behavior Registry helps resolve alerts in the sense that CRITICALSTART is doing a lot of that initial triage for me. Out of a given 500,000 events and alerts, for example, that come through, they're taking out 495,000 of them. That only leaves me with a subset of that to actually have to triage, and that's where it benefits us. They take care of Tier-1 and Tier-2 triage. And the new mobile app is awesome. It is one of the best I've ever seen. It's much better than its predecessor. It's more intuitive, a whole lot easier to navigate and get where you need to go. It's less repetitive and just generally easier to use. It allows me to not have to be sitting at my computer all the time. I can be on my phone or tablet or wherever I'm at. It makes it a lot easier to answer tickets and do that kind of thing. Also, the intuitiveness of the updated user interface for the service is spot-on. It is much easier to navigate, and know where to navigate, in the newer interface. I've never had an issue with responsiveness. It's very quick and doesn't sit there and chug on anything. It's fast, it's efficient. It has enabled our SecOps team to take action faster because if you have multiple ways of connecting to it and actually getting your alerts answered and taking care of things fast, it is extremely helpful. All the information that you need to make a determination is usually in the alert itself that comes through the Zero-Trust Analytics Platform (ZTAP). I don't find myself going back to the app itself very often. That still happens, but not as often. The ability to flow the information forward, from the alert standpoint, helps me because it saves me from running back to get the information. It's improved my efficiency. Finally, there haven't been any data sources that the service wasn't able to integrate with.

Read full review

Shubham Sinha.

Senior Principal Information Security Analyst at Veritas Technologies LLC

Helped eliminate repetitive and redundant tasks, but custom functions and reporting need a lot of work

The visibility of the solution’s playbook viewer depends on the right you assign to the analyst. SOAR has the flexibility to distinguish between the roles of analyst and owner. If the analyst's role is to just work on a ticket, they cannot view the playbook design platform. That is limited to the owner. That can be both a good and bad thing. A major problem I have faced in SOAR's rights distribution is roles and responsibilities. Suppose I am initially granted user rights or analyst rights, but later on, I also get admin rights. SOAR is unable to amend the limitations of my role. I raised a support ticket with Splunk about this. They said it's a bug in their 5.3.5 version. To fix this, I had to reinstall the entire platform from scratch, just to amend the rights and responsibilities of one role. This bug was not fixed. Also, the latest GUI is terrible. The previous one was better. Another point is that while using Splunk SOAR in an investigation is not difficult, there are some complex parameters. We have SOAR case management, but the licensing is going to put a big hole in your pocket. Also, there is an issue with investigation node addition. When you are doing node additions you cannot grant the entire environment to have SOAR visibility into the incident. So when you integrate it with an ITSM tool, like ServiceNow or Jira for ticketing purposes, there is a challenge. When you do nodes for investigation on a regular basis, sometimes it does not update our ServiceNow platform, which is terrible. It is a redundant activity for an analyst to update that in the case management as well as in the ITSM tool. Although SOAR provides integration, the functionality of investigation and nodes is terrible when it comes to integration. An additional area for improvement is custom function creation. It's terrible. A newbie cannot create custom functions right away. They would require a solid understanding first. Also, the reporting is really awful. If I want to do a report for a customized time period, such as the last three days or the last four days, or from the 10th to the 12th of June, that is not available in SOAR at all. That kind of feature is available in Cortex XSOAR. Reporting is a real challenge.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"From where we were prior to going into them, the service has increased our analysts’ efficiency to the point that they can focus on other areas of the business. It gives me the ability to allow analysts to do Level 3 and 4 work and stay out of the weeds of the alerts, where you tend to get alert fatigue. The service takes care of much of the Tier 1 and Tier 2 triage. It is more effective than what we had been used to, because it allows the filtering of Level 1 and Level 2 type alerts to be taken care of. This leaves less for us to handle, which is a good thing."

"Outside of using the platform to manage alerts, the feature of the service that we get the most value from is being able to reach out to them and say, "Hey, we might go buy a SIEM," for example. They give us their overview of what's out there, what they've dealt with, what they integrate with, and what that looks like. That's been pretty powerful over the years for us."

"I also use their mobile app. It's very easy to use and very convenient to be able to respond to alerts wherever you are. I love the app. You can respond and communicate, per ticket, with their SOC in near real-time. The response is very quick."

"There are two parts of CRITICALSTART's services that are most valuable to us. The MDR solution where they monitor our computers, laptops, and users across the board; and their knowledge of Palo Alto firewalls."

"The main difference between the other options and this one is the quality of the personnel within the SOC. It's their knowledge and depth and the way they handle customers."

"The quick interaction between the agents is the most valuable feature. If we have questions, they're quick to answer. If we make a change to our system, they quickly make the changes that are necessary to filter the logs correctly."

"The most valuable feature of their service is their tuning... If we were getting 1,000 alerts a day without them, they tune it until they know what to do for 999 of them, and one will make it through to us per day. That tuning is the most valuable part of their solution."

"My impression of the transparency of the data is that it has good detail. It allows you to see how many events have come in, how many of those events have made it down to their analysts to review, and then however many from their analysts to be able to close out, have been able to been escalated to us. It's a good metric that we can share with my management. They see the value of what the SOC is bringing on top of what my team is already doing."

More CRITICALSTART pros

"Splunk SOAR's extensive library of pre-built integrations allows it to connect with a vast array of popular security and IT applications, streamlining workflows across our existing security stack."

"Technical support is helpful."

"When you design a playbook, you can integrate multiple log sources and define rules... After that, the platform automatically compiles all these activities and, based on the results, the analyst only has to indicate whether the result is a true or false positive. That reduces the time and effort involved."

"The ability to automate Splunk SOAR and customize the playbook use cases is the most valuable feature and is very exciting for me."

"I like the integration capabilities of Phantom. It has a lot of integrations with other products. Its searching methodologies are also good. It is also easy to understand and easy to create playbooks."

"The most valuable feature is the API connector, depending on how it's formatted and who made the actual app offering for it. The REST API is my favorite component. It's very easy to use. The filters are also really valuable. Those are the two primary features but I enjoy using the rest of it."

"It helps increase efficiency and productivity."

"In Splunk SOAR, I find the playbooks valuable. We get to create multiple playbooks, and within each playbook, there is a different type of investigation attached to it, which helps out an analyst or new analysts coming on board."

More Splunk SOAR pros

Cons

"They just did a user interface overhaul to the website portal that you use for troubleshooting tickets. The old one was fine. The new one is not intuitive..."

"The biggest room for improvement is not necessarily in their service or offering, but in the products that they support. I would like them to further their knowledge and ability to integrate with those tools. They have base integrations with everything, and we haven't come across anything. They should just continue to build on that API interface between their applications and other third-party consoles."

"In terms of responsiveness, when I open up an alert, sometimes it takes a bit of time to load. However, it only happened once or twice."

"It has frustrated us that they don't have a native Slack integration, because most things do now. That's something we've asked for, for years, and it just doesn't really seem like it's a priority."

"The UI has become slower but it's not something I would call them out on."

"They could dig a little bit deeper into the Splunk alerts when they feel like they need to be escalated to us. For example, if a locked account shows up, they could do a little extra digging to verify that the locked account was due to a bad password on the local system. They could just do a little extra digging within the Splunk environment instead of pushing it onto us to go do that extra little digging."

"The only thing I can think of that I would like to see, and I'm sure they could work this into a service pretty easily, is not only alerts on issues that are affecting my company, but some threat intelligence of a general nature on what's out there in the environment. That might be a nice add-in."

"The updated UI is actually pretty bad. Regarding the intuitiveness, it is fairly easy to use, but the responsiveness, on a scale of one to 10, is a one. It's really poor performance."

More CRITICALSTART cons

"The cost of Splunk SOAR has room for improvement."

"We want to see improvements made to the APIs such that we can connect to many different systems and data sources."

"The algorithm and machine learning have room for improvement and can be more user-friendly."

"SOAR is probably the most unreliable product Splunk has and that's because most of it is content driven from what you put into it. There are certain parts of it that have a little bit of difficulty at volume too. It's always changing. There is new stuff coming out for it that's going to make it a little bit better, but it does have some drawbacks."

"The solution must provide more AIOps to improve predictability."

"The font used in the interface could be changed and made easier to read."

"The UI can be more customizable for the clients."

"It would be ideal if we could automate processes even more."

More Splunk SOAR cons

Pricing and Cost Advice

"The pricing of other services was so insane that they weren't even an option."

"The pricing has always been competitive. They have always been good to us. They will make it a fight. They don't try to hide anything; it's always been fully transparent and well-worth what we pay for it."

"I've told CRITICALSTART that I think the managed service they provide is cheaper than it should be. It's a really good deal."

"There are contractual penalties if their SLAs are not met. This commitment was very important in our decision to go with this service, because not having downtime is extremely important to us. The providers has not missed an SLA in the 18 months that I have worked with them."

"It costs a lot for what we felt comfortable to spend."

"Overall, for what I'm paying for it, and the benefit I'm getting out of it, it is right where it needs to be, if not a little bit in my favor. For what it costs me to actually have this service, I could afford one internal person to do that job, but now I have a team of 10 or more who are doing that job, and they don't sleep because they work shifts."

"As far as the expense goes, it's very competitive pricing and the services you get are almost like you have a person on your team."

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."

"I don't know the exact price, but for my region, it is very expensive."

"The cost is high and the licensing is on an annual basis."

"I found the price of Splunk SOAR to be good."

"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."

"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."

"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."

"The licensing cost is reasonable."

More Splunk SOAR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

846,617 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

12%

Healthcare Company

11%

Real Estate/Law Firm

10%

Financial Services Firm

10%

Computer Software Company

14%

Financial Services Firm

13%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

Ask a question

Earn 20 points

What do you like most about Splunk Phantom?

Splunk SOAR's quick response to incidents is the most valuable part.

See all answers

What is your experience regarding pricing and costs for Splunk Phantom?

Splunk SOAR is affordable cost-wise only, but not competitive from a technical perspective compared to Palo Alto SOAR and FortiSOAR.

See all answers

What needs improvement with Splunk Phantom?

The creation of playbooks is complex in Splunk SOAR ( /categories/security-orchestration-automation-and-response-soar ), and the number of integrations needs enhancement. Although it enhances alert...

See all answers

Comparisons

ReliaQuest GreyMatter vs CRITICALSTART

Compared 22% of the time

BlueVoyant CORE vs CRITICALSTART

Compared 18% of the time

Red Canary vs CRITICALSTART

Compared 18% of the time

CrowdStrike Falcon Complete MDR vs CRITICALSTART

Compared 16% of the time

Arctic Wolf Managed Detection and Response vs CRITICALSTART

Compared 14% of the time

More CRITICALSTART Competitors

Cortex XSIAM vs Splunk SOAR

Compared 24% of the time

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Compared 19% of the time

Tines vs Splunk SOAR

Compared 10% of the time

Fortinet FortiSOAR vs Splunk SOAR

Compared 9% of the time

Torq vs Splunk SOAR

Compared 8% of the time

More Splunk SOAR Competitors

Product Reports

Buyer's Guide

CRITICALSTART

April 2025

Download CRITICALSTART product report

Buyer's Guide

Splunk SOAR

March 2025

Download Splunk SOAR product report

Also Known As

Critical Start, CriticalStart

Phantom

Overview

The cybersecurity landscape is growing more complex by the day with the arrival of new threats and new tools supposedly designed for combating them. The problem is it’s all creating more noise and confusion for security professionals to sort through.

CRITICALSTART is the only MDR provider committed to eliminating acceptable risk and leaving nothing to chance. They believe that companies should never have to settle for “good enough.” Their award-winning portfolio includes end-to-end Professional Services and Managed Detection and Response (MDR). CRITICALSTART MDR puts a stop to alert fatigue by leveraging the Zero Trust Analytics Platform (ZTAP) plus the industry-leading Trusted Behavior Registry, which eliminates false positives at scale by resolving known-good behaviors. Driven by 24x7x365 human-led, end-to-end monitoring, investigation and remediation of alerts, their on-the-go threat detection and response capabilities are enabled via a fully interactive MOBILESOC app.

Critical Start

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk

Sample Customers

Information Not Available

Recorded Future, Blackstone

Buyer's Guide

CRITICALSTART vs. Splunk SOAR

March 2025

Free Report: CRITICALSTART vs. Splunk SOAR

Find out what your peers are saying about CRITICALSTART vs. Splunk SOAR and other solutions. Updated: March 2025.

DOWNLOAD NOW

846,617 professionals have used our research since 2012.

See our CRITICALSTART vs. Splunk SOAR report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.