Shuffle is an open-source automation platform for security teams to build and run workflows. Its visual designer works with a no-code app creator that can generate integrations from Swagger or OpenAPI specifications, or API documentation URLs. The public catalog lists more than 2,500 apps, including Slack, Gmail, MISP, Wazuh, Splunk, and Jira. Workflows can start from webhooks, schedules, subflows, or user input; documented extensions include AWS Lambda, AWS S3, Kafka, and Pub/Sub. Teams can choose self-hosted open source, self-hosted licensed software, Shuffle Cloud SaaS, or a hybrid deployment. Documented runtime setups include Docker Compose, Docker Swarm, a cloud-hybrid local Orborus runner, and Kubernetes with Helm charts. Shuffle documents bcrypt password hashing and AES-256 encryption for app authentication, protected datastore keys, and files. Its Scale free plan includes 2,000 app runs per month, with a hard limit, three tenants, and one location. Custom Python apps cannot yet be created easily for Shuffle Cloud, though on-premises instances support local app hotloading.
Who it is for
Shuffle is aimed at security operations and CERT/SIRT teams that want to share and automate workflows, processes, or detections. It can suit teams choosing between cloud, self-hosted, and hybrid deployments.
What is good
- Public catalog lists more than 2,500 apps
- Offers self-hosted, cloud, and hybrid deployment
- Supports webhook, schedule, subflow, and user-input triggers
- Scale includes 2,000 app runs per month
What to know first
- Scale has a hard app-run limit
- Scale lists no support or onboarding
- Custom Python apps are difficult to create for Shuffle Cloud
Verdict
Shuffle offers security-focused workflow automation with a large app catalog and several deployment choices. Check the Scale limits and the cloud-specific constraint on custom Python apps before choosing a setup.
Shuffle plans and pricing
All plansCompared on runbook automation software
- Free plan
- Yes
- Approval steps
- Yes
- Scheduled runs
- Yes
- Event triggers
- Yes
- Incident integrations
- Yes
- Audit logs
- Yes
- Self-hosted option
- Yes
- Runs included
- $2,000/mo
