Tracecat review
A developer-focused SOAR combining AI agents, playbooks, cases, and open-source deployment.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Tracecat is an open-source security orchestration, automation, and response platform for security teams and developers. It combines AI agents with deterministic workflows, security case management, alert triage, enrichment, threat-intelligence actions, audit logs, and MCP-based access to security and IT tools. Teams can deploy it through the web, API, or self-hosted environments, using workflows for investigation, threat hunting, vulnerability response, and incident response. Its positioning suits organizations that want an AI-assisted SOAR foundation with control over deployment and automation logic.
The Open Source plan provides unlimited workflows, cases, and agents, along with agent presets and skills, a hosted MCP server catalog, prebuilt integrations, lookup tables, and deployment through Docker or AWS Fargate. The platform also includes human approval gates, run history, Git synchronization, prompt versioning, and custom Python actions in a sandbox. Enterprise adds cloud or self-hosted deployment, RBAC, service accounts, SCIM, advanced cases, a Kubernetes Helm chart, tool approvals with a unified inbox, and 24/7 Slack and email support. Enterprise pricing is custom, so organizations evaluating paid deployment will need a direct commercial discussion.
Tracecat’s ecosystem spans Elastic, Panther, Splunk, Microsoft Sentinel, Google Cloud SecOps, CrowdStrike Falcon, SentinelOne, Jamf, Microsoft Defender XDR, Wiz, AWS, Microsoft Entra ID, and Okta. Its hosted MCP catalog lists 56 integrations, while the documentation also includes additional native integrations. That breadth supports teams connecting detection, cloud, endpoint, identity, and case workflows in one automation layer. Choose Tracecat if open-source deployment, AI-assisted playbooks, and developer control are priorities. Teams seeking a longer-established product or fully specified Enterprise pricing may prefer an alternative.
Tracecat pros and cons
- Where it wins
- Unlimited workflows, cases, and agents in the Open Source plan
- AI agents, Python actions, approvals, and Git-based prompt versioning
- Integrates with major security, cloud, identity, and observability tools
- Where it doesn't
- Enterprise pricing is custom rather than listed
- Advanced RBAC, SCIM, and 24/7 support require Enterprise
- Founded in 2024, with less maturity evidence than established SOAR products
Tracecat fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update