SOAR runs the playbooks your team writes for alerts you've seen before. A new attack has no playbook, so SOAR routes it to a person and waits. Simbian's AI SOC Agent investigates the alert itself and closes it, playbook or no playbook.
Security automation with SOAR means running a playbook when an alert matches a pattern your team already mapped. Toggle between an alert it has a playbook for and one it doesn't.
Playbook exists
User-reported phishing — credential harvesting
Source: Email security · Matches a phishing-triage playbook your team maintains
SimbianAutonomous
IngestAlert picked up from email security
·ReasonWorks the alert directly and forms a hypothesis, with no playbook to match
·EnrichDetonates the URL, checks sender history, pulls who else received it
·DecideVerdict: malicious — active credential theft, evidence attached
·ContainPurges org-wide, resets exposed identities, closes the case under the active mode
SOARPlaybook-bound
IngestAlert received
·Match playbook"Phishing-Triage" matches by type and source
·Run enrichmentScripted enrichment calls fire — URL reputation, sender, hash
·DecidePlaybook branch reaches a deterministic verdict
·Contain + approveExecutes containment, pauses for an analyst to approve the action
Give SOAR the alert it was built for and it delivers — fast and repeatable, with a clean audit trail. Someone still has to write and maintain that playbook, but it works. The gap opens on the alert no one wrote a playbook for.
No playbooks vs. hundreds to maintain
Grouped by coverage, reasoning, and what it costs to run.
R1
Coverage and speed
SOARSimbian
Resolves a known, matched alert on its own
Share of alert volume automated
Speed on a matched alert
R2
Novelty and reasoning
SOARSimbian
Resolves a novel alert with no playbook
Reasons about the alert vs. matches a rule
Learns across cases — every investigation improves the next
R3
Operating cost and control
SOARSimbian
Ongoing playbook maintenance burden
Time to meaningful ROI
Human keeps containment authority, with graduated autonomy
Full Limited None
Where SOAR still earns its place: deterministic containment on stable, high-frequency incident types, repeatable multi-tool enrichment, and clean, audit-ready case records. On the alerts it has a playbook for, a well-maintained SOAR is fast and reliable.
SOAR still earns its place for deterministic, high-frequency incident types with stable playbooks and audit-ready case records. Where it struggles is a novel alert with no matching playbook, which routes to a human by default. A reasoning-based AI SOC agent is the SOAR alternative buyers are moving toward: it investigates and decides without a pre-authored playbook, so it covers the cases SOAR escalates.
No. A playbook is a decision tree authored in advance, so an alert shape with no branch has no path to follow. SOAR vendors concede this directly: Torq's own documentation notes that when a threat is new, no playbook exists and SOAR drops the alert into the manual queue. Simbian reasons through the alert instead of matching it, so a novel signal still gets investigated and closed.
No. SOAR is being absorbed into SIEM, XDR, and AI SOC platforms, and vendor-stated figures put its automation coverage at roughly 30 to 40 percent of alert volume. The playbook engine is real and useful for the incident types it was built for. What is fading is the belief that a library of static playbooks can cover a threat landscape that keeps producing alerts nobody wrote a branch for.
SOAR executes playbooks your team authors and maintains against alerts that match a known shape. An AI SOC agent reasons about the alert itself and decides the next step, so there is no playbook to write and nothing to break when your environment changes. Simbian resolves 92% of alerts autonomously in production deployments; the reasoning stands in for the rules rather than running them faster.
No. Simbian's AI SOC Agent sits on top of your existing tools and orchestrates them — SIEM, EDR, identity, SaaS, and ticketing stay in place. Stable, high-frequency playbooks can keep running where they already work; Simbian takes the alerts that fall outside them, including the novel ones SOAR escalates.
Sign up for Simbian's Newsletter
By submitting this form, you agree to our Privacy Policy.
