Overview

Tracecat brings security workflows, cases, integrations, and AI agents into one platform. Its workflow logic includes loops, conditions, parallel subflows, and Python, Bash, and Ansible scripts, offering room to tailor playbooks but requiring teams prepared to build and maintain their automation. Deployment is available as managed cloud or self-hosted; Open Source supports Docker and AWS Fargate, while Enterprise also offers a Kubernetes Helm chart.

The homepage states SOC 2 Type II and describes the product as air-gappable. Those claims may matter to security teams with deployment and compliance requirements, though teams should assess whether the plan-specific controls meet their own needs.

Key features

Workflow automation: Loops, branching, parallel subflows, and scripting support playbook automation and alert enrichment. This flexibility favors teams with engineering capacity over those seeking a ready-made response program.
Integrations and threat intelligence: Tracecat advertises more than 500 integrations across SIEM, EDR, MDM, identity providers, and other categories, with threat-intelligence actions. Its hosted MCP catalog lists 56 servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub, and AWS.
Cases and agents: Open Source includes case management, comments, attachments, and custom fields alongside agents, presets, and skills. Enterprise adds case tasks, metrics, triggers, correlation, and other advanced case features. Tool approvals with a unified inbox are also Enterprise-only, a significant gap for teams that need human review within agent workflows.

Pricing

Plan	Price	What it includes
Open Source	0.00 USD per free; free forever	Unlimited workflows, cases, and agents; self-hosted deployment; monthly executions self-managed; Discord community and GitHub issues
Enterprise	Custom pricing	Unlimited workflows, cases, and agents; cloud in the US or EU or self-hosted deployment; monthly executions custom pricing; 24/7 Slack and email support; custom SLAs

Open Source is an unusually broad starting point for teams willing to run the platform themselves, but its monthly execution volume is self-managed and it excludes tool approvals, the agent inbox, advanced cases, multi-tenant workspaces, Git sync, custom roles and SCIM, and enterprise support. Enterprise is the fit when those controls, cloud hosting, or round-the-clock support matter; its custom price and execution terms need to be evaluated against the team's expected usage.

Platforms

Tracecat supports API, self-hosted, and web access. Docker and AWS Fargate provide self-hosted routes for Open Source, while Enterprise also lists Kubernetes Helm deployment. Open Source includes SSO and organization audit logs; Enterprise adds platform audit logs, custom roles, service accounts, and SCIM.

Who it's for

Tracecat is aimed at AI-native security teams, particularly those handling focused Tier 1 and Tier 2 work such as phishing, suspicious OAuth grants, EDR malware alerts, and cloud findings. It makes sense for teams that can shape and operate their own workflows and want case management and automation in the same product. Teams that require built-in human approvals, advanced case operations, or enterprise support should weigh the Enterprise plan; teams unwilling to self-manage execution volume or workflow upkeep may prefer a different fit.

Pros and cons

Pro: Open Source includes unlimited workflows, cases, and agents at no charge, making it viable for substantial self-hosted use without per-action billing terms in the plan.
Pro: Workflow control spans conditional logic, parallel subflows, and common scripting languages, which suits teams adapting automation to their own response processes.
Pro: The mix of integrations, cases, and agent capabilities can consolidate several parts of a security workflow.
Con: Open Source excludes human-in-the-loop tool approvals and advanced case functions, limiting teams that need governed agent actions or richer case operations.
Con: Monthly executions are self-managed on Open Source, and the team must handle self-hosting and workflow operations.
Con: Enterprise pricing is custom, so teams needing its added controls and support must obtain terms before comparing total cost.

Alternatives

Teams comparing orchestration and runbook tools can also review SOAR Software and Runbook Automation Software.

OpenSOAR is worth considering for teams prioritizing Apache 2.0 licensing, self-hosting, and no feature gates or per-action billing.
Cyware Security Orchestration and Automation suits buyers evaluating a paid platform whose custom quote varies with deployment, analyst seats, intelligence feeds, automation volume, sandbox capacity, digital risk protection, and add-ons.
Palo Alto Networks Cortex Cloud API Security is another paid, API-capable option.
Shuffle offers a free starting point with 2k App-Runs; its Starter plan is 29.00 USD per month, billed $29/month for 10k App Runs, with limits including 10 workflows, 5 users, and 1 tenant.
Defensys SOAR Platform is a paid alternative for buyers prepared to request a demo.
Swimlane Turbine is a paid option for teams comparing action-volume and user-banded enterprise plans.
Torq Hyperautomation is a paid alternative whose usage terms are provided in an order form and may involve measures such as cases, queries, API calls, compute units, or AI credits.
Rapid7 InsightConnect is worth considering for teams wanting a 30-day free trial, though workflows in toolkits require an InsightConnect license.

Verdict

Choose Tracecat if an AI-native security team wants flexible security automation, case management, and agents in a free, self-hosted base, and has the capacity to operate it. Look elsewhere if human approvals, advanced case functions, or dedicated support are essential but Enterprise's custom pricing and execution terms do not fit.

	Rapid7 InsightConnect	Tracecat
Free plan	No	Yes
Free trial	Yes	No
Paid from	—	Free
Open source	No	No
Platforms	api, Linux, self-hosted, Web	api, self-hosted, Web
Free plan	—	Yes

Rapid7 InsightConnect vs Tracecat

Rapid7 InsightConnect

Tracecat