IBM Resilient vs Splunk SOAR comparison

IBM Resilient and Splunk SOAR both compete in the cybersecurity incident response and automation space. Splunk SOAR seems to have the upper hand due to its strong integration flexibility with third-party tools and automation capabilities.

Features: IBM Resilient is known for strong incident response capabilities, flexibility, and integration with other IBM products, offering a comprehensive stack of tools. It allows extensive customization and suits diverse environments, fostering action-oriented responses. Splunk SOAR excels in integration flexibility, especially with third-party tools, through powerful automation and machine learning-based analytics. It supports efficient playbook development, reducing response times, and provides strong orchestration capabilities.

Room for Improvement: IBM Resilient could improve third-party integration, pricing structures, and setup complexity. Support responsiveness and expanding automation features are also crucial areas. Splunk SOAR may benefit from enhanced integration capabilities, better documentation, and refined pricing models. Users also desire advanced automation options and simplified playbook development processes.

Ease of Deployment and Customer Service: IBM Resilient primarily offers on-premises deployment with responsive technical support, although resolution times have room for improvement. Splunk SOAR offers cloud and hybrid deployment models and provides adequate technical support, though users wish for swifter support and better data source integration.

Pricing and ROI: IBM Resilient’s high pricing, based on user licenses, is considered a barrier for large implementations. Some users report significant ROI via time savings. Splunk SOAR faces criticism for high pricing but is seen as valuable for its performance benefits. Subscription-based pricing is costly, but automation and cost savings offer potential ROI.