Tracecat

Tracecat is a security automation platform for teams building AI-assisted cyber defense. It is best suited to AI-native security teams automating focused Tier 1 and Tier 2 work. Its free self-hosted edition is substantial, but approvals and advanced casework sit behind Enterprise.

Overview

Tracecat brings security workflows, case management, and agentic AI together with tables, agent presets, skills, integrations, and a hosted MCP server catalog. Workflow logic includes loops, conditional branches, parallel subflows, and Python, Bash, and Ansible scripts. That flexibility suits teams with the engineering capacity to build and maintain their own playbooks; it is less compelling for buyers seeking a turnkey tool.

Teams can use managed cloud or self-host Tracecat. Open Source supports Docker and AWS Fargate, while Enterprise also offers a Kubernetes Helm chart. The homepage states SOC 2 Type II and describes the product as air-gappable, relevant to organizations with stringent security and deployment requirements.

Key features

• Workflow automation: Loops, conditions, parallel subflows, and scripting support playbook automation and alert enrichment. These tools can accommodate varied response processes, but their value depends on a team's ability to design and operate workflows.
• Integrations and threat intelligence: Tracecat advertises 500+ integrations spanning SIEM, EDR, MDM, identity providers, and other categories, and supports threat-intelligence actions. Its hosted MCP catalog lists 56 servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub, and AWS. The broad advertised coverage is useful when connecting diverse security tools; the published integration count and catalog count describe different offerings.
• Agents and approvals: Agentic AI, presets, and skills support teams building agent-based security work. Human approval of agent tools is an Enterprise feature, with a unified inbox; Open Source excludes tool approvals and the agent inbox. That makes the free edition less suitable when teams need a formal human checkpoint before agent actions.
• Case management: Open Source includes cases, comments, attachments, and custom fields. Enterprise adds case tasks, metrics, triggers, correlation, and other advanced features, so teams with basic case needs can start free, while those needing richer investigation workflows must budget for a custom-priced plan.
• Security and support: Open Source includes SSO and organization audit logs. Enterprise adds platform audit logs, custom roles, service accounts, and SCIM, as well as 24/7 Slack and email support and custom SLAs. Community support through Discord and GitHub issues is the trade-off for free users.

Pricing

Open Source is a strong starting point for teams comfortable operating a self-hosted system and managing their own execution volume. It excludes tool approvals and the agent inbox, advanced case features, multi-tenant workspaces, Git sync, custom roles and SCIM, and enterprise support. Enterprise preserves unlimited workflows, cases, and agents but leaves price and execution allowance to a custom agreement, so buyers should weigh those terms against their support and governance needs.

Platforms

Tracecat supports web, API, and self-hosted use. Open Source deploys with Docker or AWS Fargate; Enterprise also lists a Kubernetes Helm chart, while managed cloud is available in the US or EU on Enterprise.

Who it's for

Tracecat targets AI-native security teams, especially those automating focused Tier 1 and Tier 2 workflows such as phishing, suspicious OAuth grants, EDR malware alerts, and cloud findings. It is a good fit when a team wants to combine automation, cases, and agent tools and can manage its own deployment. Teams that require tool approvals, advanced case capabilities, or enterprise support should look to Enterprise; organizations wanting a ready-made product rather than configurable workflows may prefer another approach.

Pros and cons

• Pro: The free plan has unlimited workflows, cases, and agents, making it possible to build substantial self-hosted automation without a per-workflow cap.
• Pro: Workflow branching, parallel subflows, and Python, Bash, and Ansible scripts support tailored security playbooks.
• Pro: Cases, agent features, and a broad advertised integration range sit in one platform, reducing the need to separate those functions across tools.
• Con: Open Source excludes human approvals for agent tools, limiting its fit for teams that require review before agent actions.
• Con: Advanced casework, multi-tenant workspaces, Git sync, custom roles, SCIM, and enterprise support require Enterprise, whose price is custom.
• Con: Open Source execution volume is self-managed, and community support is not a substitute for Enterprise's 24/7 support and custom SLAs.

Alternatives

For a free, self-hosted option with no feature gates or per-action billing, consider OpenSOAR. If you want a web-based security analytics service with a free tier capped at 20 daily credits, seven-day log retention, and up to three users, Sumo Logic is another option. Tines may suit teams looking for a web-based workflow service whose free edition allows three live workflows.

For a free product available across API, self-hosted, and web platforms, compare Wildbox. Buyers considering a paid API and web option can also review Palo Alto Networks Cortex Cloud API Security. Cyware Security Orchestration and Automation uses custom quotes based on deployment and selected capacity or add-ons; Defensys SOAR Platform is another paid option with pricing not stated. Shuffle offers a free starting point and a Starter plan at $29 a month.

Browse more options in SOAR Software and Runbook Automation Software.

Verdict

Tracecat is a strong choice for technically equipped, AI-native security teams that want broad workflow control, case management, and agent capabilities with a free self-hosted entry point. Its main reason to choose it is the breadth of the Open Source plan; its main reason to look elsewhere is the Enterprise boundary around approvals, advanced casework, governance, and support.