Guide, facts read 3 to 5 November 2026
From SOAR to agentic defense: a migration checklist
The short answer
Moving from SOAR to agentic defense is an inventory and a parallel run, not a cutover. Start with the playbooks that fail most, keep deterministic workflows for notification and logging, and check every connector against a published list. Torq, CrowdStrike and SentinelOne keep a workflow engine under their agents; Mate replaces it with Gamebooks.
Inventory before you talk to vendors
List every playbook with three facts: how often it ran in the last 90 days, how often an analyst overrode it, and which tools it touches. Most estates find a long tail of playbooks that never run and a short head that runs thousands of times. Mate's quoted customer had 711; your number decides how much migration effort you need.
Group playbooks by intent: phishing, suspicious login, malware on endpoint, data exfiltration, cloud misconfiguration. The intent groups are what you migrate.
Check connectors against a published list
Your SOAR has connectors for every tool it touches. The new platform needs the same reach. Simbian publishes a count by category (25 SIEM and log, 15 threat intel, 9 identity, 9 cloud, among others). Prophet claims 200+ and names 75 in its grid. Dropzone names a catalog of 90+ or 100+ depending on the page. Mate published no integrations page as of 2026-11-03; Legion says it works through the browser 'with or without APIs'.
Where a vendor publishes no list, ask for your exact tools in writing, with the actions supported per tool. Mate's gaps include no list of supported containment actions per tool.
| Platform | Published count | Named catalog | Integration score |
|---|---|---|---|
| Simbian | 100+, by category | Yes | 8 |
| Dropzone AI | 90+ or 100+ | Yes | 8 |
| Torq | No count | Yes, large | 8 |
| Prophet Security | 200+ claimed, 75 shown | Yes | 7 |
| Mate Security | None | No (examples only) | 3 |
Decide what stays deterministic
Some steps should run the same way every time: creating a ticket, paging on-call, packaging evidence for legal, writing to a compliance log. Keep those as workflows. Torq is built on a hyperautomation engine and adds agents on top. CrowdStrike's Agentic SOAR combines agents with deterministic workflows. SentinelOne runs automated responses only within pre-approved policies.
Investigation, enrichment choices and verdicts are where agents earn their keep. Draw the line per intent group and write it down.
Run both systems side by side for one quarter
Put the agent in shadow mode on the same alerts the SOAR handles. Compare outcomes daily for the intent groups you plan to move first. Retire a playbook only when the agent has matched or beaten it for 30 days on that intent, with false negatives read one by one.
Keep the SOAR licence through the parallel run. The saving from retiring it is real, but it should follow the evidence, not lead it.
Set guardrails before autonomy
Before any action moves beyond recommend-only, define who approves, what can be reversed, and where the audit trail lives. Mate scores actions by CPR (Confidence, Precision, Reversibility) outside the agent's reasoning loop. Microsoft logs agent actions in the Purview Unified Audit Log. CrowdStrike lists RBAC, execution traces, version rollback and credit caps.
Map each SOAR action to an autonomy level on the new platform, and record the mapping as a change-board document.
Measure the result in the units you used before
Report mean time to investigate, mean time to contain and analyst hours in the same way you measured them under SOAR. Vendor case studies often report a different unit: Torq's FICO story says automations are built 99.4 percent faster, which measures engineering time, not response time.
Plan the people change as carefully as the tool change
SOAR estates have owners: automation engineers who built and maintain the playbooks. An agentic platform changes their job from drawing branches to writing guidance, reviewing agent reasoning and tuning autonomy levels. Tell them early, and put them in charge of the parallel run. They know which playbooks are fragile and why.
Analysts change role too. With agents investigating every alert, tier 1 work shrinks and review work grows. Legion claims 24,000+ investigations run autonomously in place of T1 analysts in the first 30 days at an unnamed Fortune 500 insurer. Whatever your own number turns out to be, decide in advance what the freed analysts will do: hunting, detection engineering, or reviewing agent decisions.
Check the commercial terms before the technical ones
SOAR licences are often multi-year. Line up the end date with the end of your parallel run, and price the overlap. On the new platform, get the unit in writing. Microsoft publishes 4 USD per security compute unit per hour, read 2026-11-03. CrowdStrike's Charlotte Agentic SOAR is credit-based and quote-only, with 50 AI credits a month at no cost for qualifying customers. Dropzone sizes enterprise deals on employees. Intezer prices per endpoint with no dollar amounts published.
If the unit is alerts, agents or compute, model next year's volume, not this year's. Alert volume grows with every new tool you connect.
Keep a rollback path for every retired playbook
Export each playbook before you switch it off, and keep the SOAR instance able to run it until the end of the contract. If the agent's handling of an intent degrades after a model update or a context change, you want to restore the old behaviour in hours, not weeks.
CrowdStrike lists version rollback among Charlotte's controls. Ask every vendor how you roll back a guidance change, a learned behaviour, and a model version, and how long each takes.
Document the end state
Close the migration with a short record: intents moved, playbooks retired, actions at each autonomy level, and the measured result per intent against the SOAR baseline.
Platforms discussed in this guide
- Torq, rank 2, 6.50
- Simbian, rank 9, 5.80
- SentinelOne Purple AI, rank 10, 5.70