ServiceNow Security Operations vs Splunk SOAR comparison

ServiceNow and Splunk are both solutions in the Security Orchestration Automation and Response (SOAR) category. ServiceNow is ranked #8 with an average rating of 8.1, while Splunk is ranked #3 with an average rating of 8.0. ServiceNow holds a 3.8% mindshare in SOAR, compared to Splunk’s 7.2% mindshare. Additionally, 94% of ServiceNow users are willing to recommend the solution, compared to 85% of Splunk users who would recommend it.

ServiceNow Security Operations

Read 20 ServiceNow Security Operations reviews

2,265 Views
1,363 Comparison Views

94% willing to recommend

Splunk SOAR

Read 44 Splunk SOAR reviews

4,577 Views
2,761 Comparison Views

85% willing to recommend

ServiceNow Security Operations

Splunk SOAR

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 9, 2025

ServiceNow Security Operations and Splunk SOAR are key players in the security operation automation market, with Splunk SOAR having an edge due to its strong automation capabilities and customizable playbooks.

Features: ServiceNow Security Operations offers seamless integration with its broader ecosystem, powerful incident management, and a rich set of IT service management features. Splunk SOAR excels in advanced automation, customizable playbooks, and robust threat intelligence management, appealing to those seeking deeper automation.

Room for Improvement: ServiceNow Security Operations could enhance its automation capabilities and offer more customizable playbooks. Another area for improvement is its threat intelligence management. Splunk SOAR could benefit from strengthening its integration with service management tools and simplifying its UI for beginners. Additionally, further enhancement of customer support could be valuable for users dealing with complex deployments.

Ease of Deployment and Customer Service: ServiceNow Security Operations is easy to deploy for those familiar with the ServiceNow platform and offers robust customer service. Splunk SOAR provides flexible deployment options and is backed by extensive documentation, supporting even complex scenarios.

Pricing and ROI: ServiceNow Security Operations requires significant upfront investment but offers substantial long-term ROI due to its comprehensive functionalities. Splunk SOAR offers competitive pricing, making it a cost-effective solution for those focusing on advanced automation and sophisticated threat management. While ServiceNow’s integration capabilities often justify the higher costs, Splunk SOAR delivers cost efficiency through its automation features.

To learn more, read our detailed ServiceNow Security Operations vs. Splunk SOAR Report (Updated: March 2025).

Buyer's Guide

ServiceNow Security Operations vs. Splunk SOAR

March 2025

Download the complete report

Helped 845,040 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

ServiceNow Security Operations

Ranking in Security Orchestration Automation and Response (SOAR)

8th

Average Rating

8.0

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Security Incident Response (2nd), Risk-Based Vulnerability Management (10th)

Splunk SOAR

Ranking in Security Orchestration Automation and Response (SOAR)

3rd

Average Rating

8.0

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of April 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of ServiceNow Security Operations is 3.8%, down from 4.2% compared to the previous year. The mindshare of Splunk SOAR is 7.2%, down from 8.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR)

Featured Reviews

KishoreKumar4

Senior QE Lead at Cognizant

A low-cost and open-source tool for incident and change management

If we encounter challenges while deploying, we raise incidents. These incidents are categorized by priority: high, medium, and low. We assign an incident number and notify the relevant teams to address the issue. For instance, if we experience a problem with Cloud services or any other issue, we…

Read full review

Shubham Sinha.

Senior Principal Information Security Analyst at Veritas Technologies LLC

Helped eliminate repetitive and redundant tasks, but custom functions and reporting need a lot of work

The visibility of the solution’s playbook viewer depends on the right you assign to the analyst. SOAR has the flexibility to distinguish between the roles of analyst and owner. If the analyst's role is to just work on a ticket, they cannot view the playbook design platform. That is limited to the owner. That can be both a good and bad thing. A major problem I have faced in SOAR's rights distribution is roles and responsibilities. Suppose I am initially granted user rights or analyst rights, but later on, I also get admin rights. SOAR is unable to amend the limitations of my role. I raised a support ticket with Splunk about this. They said it's a bug in their 5.3.5 version. To fix this, I had to reinstall the entire platform from scratch, just to amend the rights and responsibilities of one role. This bug was not fixed. Also, the latest GUI is terrible. The previous one was better. Another point is that while using Splunk SOAR in an investigation is not difficult, there are some complex parameters. We have SOAR case management, but the licensing is going to put a big hole in your pocket. Also, there is an issue with investigation node addition. When you are doing node additions you cannot grant the entire environment to have SOAR visibility into the incident. So when you integrate it with an ITSM tool, like ServiceNow or Jira for ticketing purposes, there is a challenge. When you do nodes for investigation on a regular basis, sometimes it does not update our ServiceNow platform, which is terrible. It is a redundant activity for an analyst to update that in the case management as well as in the ITSM tool. Although SOAR provides integration, the functionality of investigation and nodes is terrible when it comes to integration. An additional area for improvement is custom function creation. It's terrible. A newbie cannot create custom functions right away. They would require a solid understanding first. Also, the reporting is really awful. If I want to do a report for a customized time period, such as the last three days or the last four days, or from the 10th to the 12th of June, that is not available in SOAR at all. That kind of feature is available in Cortex XSOAR. Reporting is a real challenge.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"ServiceNow is a convenient platform to raise tickets, and the respective support team will contact us to resolve any issues."

"It has helped optimize security costs by consolidating multiple tools into one platform."

"The solution is available over the cloud and is easy to manage."

"The most valuable aspect of working with ServiceNow is its meaningful and feature-rich product."

"It gives you the ability to bring data into the system. The workflows are out of the box, and it gives you the ability to auto-assign the incidents based on criteria and vulnerabilities."

"The SOAR module of ServiceNow Security Operations is the most valuable feature"

"The "follow" feature is really good. If the user is not responding, there's an option to "follow". Just click on the button, and it will automatically trigger an email to the end user."

"Reduces time to closure and closure metrics for vulnerabilities."

More ServiceNow Security Operations pros

"We are not a 24/7 SOC, so the most valuable feature of Splunk SOAR is the auto-response to threats when we are not in the office and the notifications that it sends to the on-call engineer."

"The product’s integration with other Splunk products is valuable."

"The customization of the playbook in Splunk SOAR is very beneficial."

"It helps increase efficiency and productivity."

"The most valuable features are the Splunk SOAR apps and playbooks."

"The best feature is the integration and the custom Python code that we can write. Splunk SOAR provides us with both of these capabilities, allowing us to integrate different security solutions with Splunk SOAR and take remediation actions directly on those security tools."

"So far, the interface is very easy to use."

"Splunk has many features that make work easier, and it's simple to implement in a large production environment. Splunk collects a massive amount of data from cloud servers and handles it perfectly."

More Splunk SOAR pros

Cons

"We'd like customization to be easier in terms of the UI and using the dashboards."

"The threat intelligence module needs a better dashboard."

"There is room for improvement in terms of developer support and documentation."

"It's very slow. When you click a button or update a field, it takes forever to actually react."

"The initial setup is difficult."

"They should stick to the roadmap and continue to build plugins and integrations with other third parties, enhance the UI, and enhance the reporting. It's all good. They should just continue enhancing the releases."

"It is challenging for the customers to understand the processes for SecOps. It needs to be simplified."

"The solution needs to make customization easier. You cannot do much customization immediately. It requires an extensive workload. If the customization process was user-friendly, it would be much better."

More ServiceNow Security Operations cons

"The tool's response is slower because it has to search through a huge dataset, which can be improved for latency."

"The creation of playbooks is complex in Splunk SOAR, and the number of integrations needs enhancement. Although it enhances alert handling, it still has a journey to compete with Palo Alto SOAR and FortiSOAR."

"Various aspects of the playbook development process itself can be optimized."

"The font used in the interface could be changed and made easier to read."

"The algorithm and machine learning have room for improvement and can be more user-friendly."

"The UI can be more customizable for the clients."

"What we have seen is if the workflow gets halted or if we want to halt a workflow, it cannot be resumed."

"SOAR is probably the most unreliable product Splunk has and that's because most of it is content driven from what you put into it. There are certain parts of it that have a little bit of difficulty at volume too. It's always changing. There is new stuff coming out for it that's going to make it a little bit better, but it does have some drawbacks."

More Splunk SOAR cons

Pricing and Cost Advice

"It is an expensive product."

"This product is a good value for the money."

"The product is more expensive than other solutions."

"If you're going to implement it on your own, there would be internal costs. If you're going to implement it through a contractor or consultant, you have to pay for that."

"Compared to competitor tools, ServiceNow Security Operations is more affordable"

"The solution is more expensive than BMC Remedy, the other ITSM tool available in the market."

"The tool is not cheap."

"I found the price of Splunk SOAR to be good."

"The licensing cost is reasonable."

"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."

"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."

"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."

"The cost is high and the licensing is on an annual basis."

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."

More Splunk SOAR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

845,040 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

21%

Manufacturing Company

10%

Government

10%

Computer Software Company

14%

Financial Services Firm

13%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about ServiceNow Security Operations?

The most valuable aspect of working with ServiceNow is its meaningful and feature-rich product.

See all answers

What is your experience regarding pricing and costs for ServiceNow Security Operations?

The product is more expensive than other solutions like Archer but offers more features, making the pricing justifiable.

See all answers

What needs improvement with ServiceNow Security Operations?

Report generation within ServiceNow can take some time. Additionally, there are occasional issues when raising a ticket, which can also consume time.

See all answers

What do you like most about Splunk Phantom?

Splunk SOAR's quick response to incidents is the most valuable part.

See all answers

What is your experience regarding pricing and costs for Splunk Phantom?

Splunk SOAR is affordable cost-wise only, but not competitive from a technical perspective compared to Palo Alto SOAR and FortiSOAR.

See all answers

What needs improvement with Splunk Phantom?

The creation of playbooks is complex in Splunk SOAR ( /categories/security-orchestration-automation-and-response-soar ), and the number of integrations needs enhancement. Although it enhances alert...

See all answers

Comparisons

Palo Alto Networks Cortex XSOAR vs ServiceNow Security Operations

Compared 26% of the time

Microsoft Sentinel vs ServiceNow Security Operations

Compared 14% of the time

Unified Vulnerability Management vs ServiceNow Security Operations

Compared 8% of the time

Tines vs ServiceNow Security Operations

Compared 7% of the time

Swimlane vs ServiceNow Security Operations

Compared 6% of the time

More ServiceNow Security Operations Competitors

Cortex XSIAM vs Splunk SOAR

Compared 24% of the time

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Compared 19% of the time

Tines vs Splunk SOAR

Compared 10% of the time

Fortinet FortiSOAR vs Splunk SOAR

Compared 9% of the time

Swimlane vs Splunk SOAR

Compared 5% of the time

More Splunk SOAR Competitors

Product Reports

Buyer's Guide

ServiceNow Security Operations

March 2025

Download ServiceNow Security Operations product report

Buyer's Guide

Splunk SOAR

March 2025

Download Splunk SOAR product report

Also Known As

No data available

Phantom

Overview

ServiceNow Security Operations is a cutting-edge security solution designed to elevate organizations' security incident response (SIR) processes through automation and orchestration. Going beyond traditional SOAR, this comprehensive Security Operations Suite integrates seamlessly with other ServiceNow products and offers a wide array of features. Its components include Security Incident Response (SIR), which automates incident workflows and offers pre-built playbooks; Security Configuration Compliance (SCC), continuously scanning and automating compliance tasks; Vulnerability Response (VR), prioritizing and remediating vulnerabilities; Threat Intelligence (TI), aggregating threat data for proactive threat hunting; and additional features like IT Service Management integration, Machine Learning and AI, reporting, and a mobile app. The benefits span improved incident response speed, reduced mean time to resolution, increased security posture, enhanced compliance, collaborative synergy between security and IT teams, and operational cost reductions.

ServiceNow

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk

Sample Customers

DXC Technology, Freedom Security Alliance, Prime Therapeutics, Seton Hall University, York Risk Services

Recorded Future, Blackstone

Buyer's Guide

ServiceNow Security Operations vs. Splunk SOAR

March 2025

Free Report: ServiceNow Security Operations vs. Splunk SOAR

Find out what your peers are saying about ServiceNow Security Operations vs. Splunk SOAR and other solutions. Updated: March 2025.

DOWNLOAD NOW

845,040 professionals have used our research since 2012.

See our ServiceNow Security Operations vs. Splunk SOAR report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.