Where Splunk SOAR stands in 2026
Splunk SOAR is a supported, mature automation product. Start there, because the rest of this guide depends on it being true. Nothing here claims an end of life, because no formal end-of-life has been announced.
What has changed is the product’s position inside the Splunk portfolio. Splunk’s own product page now states, “Splunk SOAR is now a native capability within Splunk Enterprise Security” (vendor product page banner, fetched June 2026). That is the vendor’s language, quoted exactly. The AI investment tells the same story. Splunk’s AI SOC features are delivered through Enterprise Security Premier, a separately priced, workload-based edition (vendor press release, September 2025).
The ownership history matters too, because roadmaps follow owners. Splunk acquired Phantom Cyber for roughly $350 million in February 2018, then rebranded it Splunk SOAR. Cisco completed its acquisition of Splunk for $28 billion, the largest deal in Cisco’s history, on March 18, 2024 (Cisco/Splunk PR, verified June 12, 2026). So the standalone product a team selected has changed owners twice and changed shape once. Nobody at the customer chose any of those moves. They are sourced corporate facts, not predictions about what comes next.
The honest takeaway: standalone-SOAR customers should ask for the standalone roadmap in writing, then read it against where the AI investment actually flows.
Table of Contents
The Three Paths in Front of You
A renewal is a decision point, and there are three real options. Each deserves fair treatment.
Stay on standalone SOAR
The product works and remains supported. The open question is the roadmap. Ask the account team to put the standalone SOAR roadmap in writing, separate from Enterprise Security, and read it carefully.
Follow the suite up to ES Premier
This is the vendor’s signposted route to the agentic SOC. Cisco announced six AI agents for Enterprise Security in September 2025: Detection Builder, Triage, Guided Response, SOP, Malware Threat Reversing, and Automation Builder (vendor PR, September 2025). The agents live in ES Premier, a separately priced, workload-based edition. As of June 2026, five of the six are in alpha or prerelease, and the Triage Agent targets alpha in the first half of 2026 (vendor blog, 2025-26). The route therefore stacks three pricing mechanisms: SOAR seats for execution, ES workload pricing for the host, and the Premier edition gate where the AI lives. The thing your SOC actually manages is alert outcomes, and none of those three meters tracks it.
Move the automation layer to an open platform while keeping Splunk as your SIEM
This is the choice you control. You keep the Splunk you like as your data platform, and you change only the automation and intelligence layer that sits on top. The rest of this guide explains what that move involves and what to demand from any destination.
What a SOAR Migration Really Involves
A SOAR migration is not a single switch. It touches three things: playbooks, connectors, and case data. Understanding each is what makes the project predictable.
Playbooks carry your team’s operating knowledge. A migration sorts them into keep, translate, and retire, then rebuilds the survivors on the new platform. This is where the destination’s design matters most. A platform built on a deterministic-playbook model is the operating model Phantom-era teams already think in, so the work translates what your engineers already know rather than re-educating them.
Connectors are the quiet tax. The industry norm for repairing a broken connector runs 4 to 6 weeks, and every API change starts that clock again. A destination with self-healing integrations removes that recurring maintenance cost. Morpheus carries 800+ self-healing integrations with an 18-minute mean repair time against that 4-6-week norm.
Case data and SLAs need mapping so history and reporting survive the move. Industry migration projects often run 6 to 12 months. Migrations between platforms that share a deterministic-playbook model run substantially faster, because the operating model carries over.
For Phantom-era teams running a multi-vendor stack, this is the practical point: a deterministic-substrate destination is what makes the landing soft. The closer the new platform’s model is to the one your engineers already use, the less the migration costs in time and retraining.
What “Governed” Has to Mean in 2026
Agentic AI without governance is risk at machine speed, and agents still in alpha are exactly the ones that need governance answered first. Any platform that touches your incidents should produce an artifact an auditor can read. Ask for it before any AI closes a case.
Morpheus runs autonomous investigation and deterministic SOAR on a single engine, and that single engine is what makes the governance legible. Every LLM step is boxed inside deterministic playbooks, with validation gates before and after. Every action is auto-tiered by command risk, which automatically drives the right approval gate. One audit trail reads identically to a regulator across all four autonomy modes: Deterministic, AI-Assisted, AI-Led, and Autonomous.
That governance maps to seven frameworks: SEC 1.05, NYDFS 500, HIPAA, NERC CIP, NIS2, DORA, and the EU AI Act Article 14. The Cybersecurity Triage Reasoning Graph learns from your analysts’ decisions and from your threat-intel and vulnerability feeds. It learns, and it acts only inside its gates. That distinction is the whole point: the system improves without ever stepping outside the boundaries you set.
Morpheus: The Open, Governed Implementation, Beside the Splunk You Keep
The agentic SOC is the right destination. Cisco, CrowdStrike, and Palo Alto spent RSAC 2026 proving the category is real (VentureBeat, 2026). For Splunk SOAR customers, the question is the route: up the editions and onto the meters, waiting for alpha to reach GA, or sideways to one engine that is already shipping.
Morpheus is the open, governed implementation of that destination. It runs autonomous investigation and deterministic SOAR on one engine, in production today, beside the Splunk you keep. Splunk Enterprise and Splunk Cloud are first-class citizens among 800+ self-healing integrations, alongside your EDR, identity, email, cloud, and DLP tools. There is no edition upgrade and no re-platforming. The openness claim is economic and temporal: their agents arrive through Splunk’s editions and meters on Splunk’s schedule, while Morpheus works where your tools already are, today.
The pricing posture matches the openness posture. Two platforms, an autonomous SOC and a modern SOAR, run on one engine for one price, at or under what you pay today. No seat math, no ingest toll on intelligence, no edition gate.
If you also run a heterogeneous, multi-vendor stack, see the companion Open Agentic SOC: Multi-Vendor Guide for the cross-platform view. This guide stays focused on the Splunk SOAR path.
Frequently Asked Questions
Is Splunk SOAR end of life?
No. No formal end-of-life has been announced. Splunk’s product page states “Splunk SOAR is now a native capability within Splunk Enterprise Security” (fetched June 2026), and Splunk’s AI SOC features are delivered through Enterprise Security Premier, a separately priced workload-based edition (vendor press release, Sep 2025). Standalone-SOAR customers should ask for the standalone roadmap in writing.
Do I need ES Premier to get Splunk’s AI agents?
Per Splunk’s September 2025 announcement, the AI Assistant and announced agent roadmap are part of Enterprise Security Premier. Five of the six announced agents were in alpha or prerelease as of June 2026 (vendor blog).
Can I get an agentic SOC and keep Splunk as my SIEM?
Yes. Platform-neutral agentic SOC engines run on top of an existing Splunk deployment. D3 Security’s Morpheus integrates Splunk Enterprise and Splunk Cloud among 800+ tools and runs autonomous investigation and deterministic SOAR on one engine beside the SIEM, with no edition upgrade or re-platforming.
How long does it take to migrate off a SOAR platform?
Industry projects often run 6-12 months. Migrations between platforms sharing a deterministic-playbook model are substantially faster. D3 Security scopes playbook inventories and provides a calendar-based migration plan for typical SOAR deployments.
Bring Us Your SOAR Renewal
Bring us your SOAR renewal: seats, ES tier, ingest. We will show you the open, governed agentic SOC on your real numbers, beside the Splunk you keep.
