Shuffle

Shuffle is an open-source workflow automation platform built for security operations. It is a strong fit for teams that need to connect security tools and choose their own deployment model. Its broad catalog and flexible hosting are balanced by a strict free-tier run cap and a cloud limitation on custom Python apps.

Overview

Shuffle was created to address automation needs in the CERT/SIRT community, with the aim of helping security operations centers share processes, automations, and detections. Its visual workflow designer is paired with a no-code app creator that can generate integrations from Swagger/OpenAPI specifications or API documentation URLs. That gives teams a way to adapt workflows to APIs beyond the built-in catalog; teams that need locally developed Python apps should favor an on-premises setup, where app hotloading is supported.

Key features

The public catalog has more than 2,500 apps, including Slack, Gmail, MISP, Wazuh, Splunk, and Jira. Workflows can start from webhooks, schedules, subflows, or user input, while extension triggers include AWS Lambda, AWS S3, Kafka, and Pub/Sub. For security teams, that mix can link detection and incident tools with communications and event sources. Shuffle also supports approval steps, incident integrations, scheduled runs, event triggers, and audit logs, which suit workflows that need human review and an audit trail as well as automation.

Shuffle describes itself as API-first and documents Bearer-token authentication for cloud and on-premises APIs. Its architecture documentation says passwords are bcrypt-hashed and app authentication, protected datastore keys, and files are AES-256 encrypted. Tenant-controlled SAML/SSO and MFA are supported, with Okta, Auth0, PingID, and AzureAD named as platforms. For AI requests, Shuffle says cloud traffic goes to regional model endpoints with tenant contexts isolated; on-premises installations can use local models without external requests. These controls make deployment choice relevant not only to operations but also to authentication and AI data handling.

Pricing

Shuffle uses a freemium model. Scale is free and includes 2,000 App Runs per month, with a hard run limit. It allows three tenants and one location, covers 98.2% of features, and has no listed support or onboarding. This is a useful entry point for small evaluations or modest workloads, but the hard cap and reduced feature coverage make it a poor fit for teams whose security automations must continue beyond the monthly allowance.

Business and Enterprise both have custom pricing, with App Runs starting at 300,000 and a soft limit. Each includes unlimited tenants, locations, and branding, 100% feature coverage, onboarding and setup, and unlimited use cases on Enterprise. Business covers three use cases and includes SLA and email support. Enterprise adds on-call support and an alert mechanism, professional services, and unlimited use cases. Business is the more focused paid fit for organizations with a defined set of workflows; Enterprise is aimed at broader deployments that need additional support and services. The published plan information does not give a paid price or billing term, so buyers should confirm those before comparing costs.

Platforms

Shuffle is available through web and API access, on Linux, and as self-hosted software. Deployment choices include self-hosted open source, self-hosted licensed, Shuffle Cloud SaaS, and documented hybrid deployment. Runtime architectures include Docker Compose, distributed Docker Swarm, a cloud-hybrid setup with a local Orborus runner, and Kubernetes through Helm charts. This range suits teams that need control over where automation runs, though the cloud-specific custom Python limitation may steer integration-heavy teams toward on-premises deployment.

Who it's for

Shuffle is best suited to security operations teams that want to automate incident workflows across a large set of tools, especially those that value approvals, audit logs, and deployment control. The free Scale plan can suit teams with low run volumes and limited feature needs. Organizations with heavier workloads, multiple tenants, or requirements for full feature coverage should consider a paid plan; teams that rely on custom Python apps should weigh on-premises deployment over Shuffle Cloud.

Pros and cons

• Pro: More than 2,500 catalog apps and a no-code integration builder give teams several ways to connect security and business APIs.
• Pro: Cloud, self-hosted, and hybrid deployment options accommodate different infrastructure choices, including local AI models on-premises.
• Pro: Approval steps, incident integrations, and audit logs support workflows that need human oversight and traceability.
• Con: Scale stops at 2,000 monthly App Runs, and its hard cap can interrupt growth unless the team moves to a paid plan.
• Con: Scale covers only 98.2% of features and has no listed support or onboarding, so it is not equivalent to the paid tiers.
• Con: Custom Python apps are not yet easy to create on Shuffle Cloud, limiting flexibility for teams that need bespoke code in a SaaS deployment.

Alternatives

For a broader comparison, see Runbook Automation Software. Rundeck is worth considering for teams that want a freemium option with a free trial and a free Community plan intended for small teams. StackStorm is a better fit for teams seeking a free, open-source project with no paid product offering. Tines may suit web-only teams that can start with its Free edition, which allows three live workflows. Tracecat is an alternative for teams seeking a free-forever, self-hosted open-source option with unlimited workflows, cases, and agents, and self-managed monthly executions. Tanium Deploy is an option for organizations that already require a Tanium license including Deploy and Tanium Core Platform servers. Palo Alto Networks Cortex Cloud API Security is another paid, API-oriented alternative. BlinkOps may fit buyers looking for a paid platform with usage-based pricing and the full platform included. D3 SOAR is an alternative for teams considering SaaS or on-premises software-only deployment.

Verdict

Choose Shuffle if your security operations team needs a broad integration catalog, workflow controls, and the freedom to run automation in cloud, hybrid, or self-hosted environments. Its clearest advantage is that deployment flexibility paired with a security-oriented feature set. Look elsewhere if the hard free-tier run cap is too restrictive, or if custom Python apps are essential in a cloud-only setup.