Try our new research platform with insights from 80,000+ expert users

McAfee ePolicy Orchestrator vs Splunk SOAR comparison

McAfee and Splunk are both solutions in the Security Orchestration Automation and Response (SOAR) category. McAfee is ranked #12 with an average rating of 8.7, while Splunk is ranked #3 with an average rating of 8.5. McAfee holds a 0.7% mindshare in SOAR, compared to Splunk’s 7.7% mindshare. Additionally, 81% of McAfee users are willing to recommend the solution, compared to 86% of Splunk users who would recommend it.
McAfee ePolicy Orchestrator
Read 42 McAfee ePolicy Orchestrator reviews
  • 1,038 Views
  • 602 Comparison Views
81% willing to recommend
Splunk SOAR
Read 47 Splunk SOAR reviews
  • 4,554 Views
  • 3,416 Comparison Views
86% willing to recommend
 

Comparison Buyer's Guide

Download the report
Executive SummaryUpdated on Sep 21, 2025

McAfee ePolicy Orchestrator and Splunk SOAR are competing in the security operations category. Splunk SOAR has the upper hand due to its advanced automation and integration capabilities.

Features: McAfee ePolicy Orchestrator offers centralized management, threat protection, and compliance capabilities. It provides automatic updates and reports for virus signatures and patch levels, saving administrative time. Splunk SOAR features extensive automation and integration with security tools, offering playbooks for incident management and reducing response times, enhancing operational efficiency.

Room for Improvement: McAfee ePolicy Orchestrator can enhance its AI tools for more advanced automation and provide more customizable reporting options. Additionally, better clarity in its management interface can streamline user experience. Splunk SOAR can improve the ease of use for less technical users and reduce the learning curve. Enhanced built-in documentation for new features can also help users maximize the product’s potential.

Ease of Deployment and Customer Service: McAfee ePolicy Orchestrator is straightforward to deploy with comprehensive support options, facilitating easy integration into existing setups. Splunk SOAR offers thorough documentation, though it presents a more complex deployment process. Its strong community support partly mitigates the steeper learning challenges.

Pricing and ROI: McAfee ePolicy Orchestrator is more budget-friendly initially, offering reasonable ROI for smaller enterprises. In contrast, Splunk SOAR has higher initial costs but offers greater ROI through its enhanced threat management and automation capabilities, particularly suiting larger organizations with complex security needs.

DOWNLOAD THE COMPLETE REPORT
To learn more, read our detailed McAfee ePolicy Orchestrator vs. Splunk SOAR Report (Updated: September 2025).
Buyer's Guide
McAfee ePolicy Orchestrator vs. Splunk SOAR
September 2025
Download the complete report
Helped 868,759 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

McAfee ePolicy Orchestrator
Ranking in Security Orchestration Automation and Response (SOAR)
12th
Average Rating
8.0
Reviews Sentiment
6.6
Number of Reviews
42
Ranking in other categories
No ranking in other categories
Splunk SOAR
Ranking in Security Orchestration Automation and Response (SOAR)
3rd
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
47
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of October 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of McAfee ePolicy Orchestrator is 0.7%, up from 0.7% compared to the previous year. The mindshare of Splunk SOAR is 7.7%, down from 8.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR) Market Share Distribution
ProductMarket Share (%)
Splunk SOAR7.7%
McAfee ePolicy Orchestrator0.7%
Other91.6%
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

Binu Haneef - PeerSpot reviewer
Comprehensive security management enabled through efficient integration and automation
McAfee ePolicy Orchestrator helps automate routine security tasks. We created customized automation. For example, when we did not have an EDR or XDR solution, we created tasks exclusively for detection and response automation and automatic segregation of infected PCs. The ability to customize the dashboard in McAfee ePolicy Orchestrator helps us significantly. The main feature is automation for auto-segmentation and segregation. As we are in an AI era, McAfee can focus on AI tools. Instead of putting manual effort into each security-related task, it can implement more advanced automation using AI. This enhancement could improve cybersecurity significantly. Regarding the reporting area in McAfee ePolicy Orchestrator, we are satisfied with what we currently have. Our cybersecurity team needs customized reports beyond the default ones. We have more than 20 separate reports for identifying threats, managing, and understanding the security posture of our company and assets.
Read full review
Mack Scott - PeerSpot reviewer
Improves response time by consolidating tools and automating threat detection
I haven't gone too far into it to see anything that needs improvement yet. We can likely include some features related to the integration with on-premises resources, rather than focusing solely on the existing automation. These are the additional features that could be included in the future. Splunk's Unified Platform does help consolidate networking security and IT observability tools. They should integrate Splunk Enterprise Security better into Splunk Cloud.
Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Their support is really good. I would rate it a nine out of ten. I have never any issues with their support. They always reply and follow our queries on time."
"The central manager policy means we have almost all client modules in one solution."
"I really like the auditing component because it really looks at exactly what has happened on the network."
"McAfee ePolicy Orchestrator has a built-in advanced pattern, which is very useful because it can detect any pattern."
"The DLP feature in McAfee ePolicy Orchestrator is good."
"The most valuable features of McAfee ePolicy Orchestrator are the easy-to-use console, and lots of reports, such as customized reports and inventory reports. Additionally, overall the centralized management is very good where you can see the compliance levels and inventory."
"We get fewer false positives than with other solutions."
"Application control and traffic encryption are the most valuable features."
More McAfee ePolicy Orchestrator pros
"The features of Splunk SOAR that I appreciate most are the integrations with all the other applications and tools."
"I'm just a beginner on the solution and it's pretty easy for me to use."
"The customizable playbook is the most valuable aspect of the solution."
"It has definitely saved a decent amount of time for our analysts so they can focus on other tasks."
"I like the way Splunk interacts with various systems via the API. The ability to integrate Splunk with our ticketing system has been an immense help because we can maintain our workflow while blending Splunk with our support desk and other ways that we track work."
"In Splunk SOAR, I find the playbooks valuable. We get to create multiple playbooks, and within each playbook, there is a different type of investigation attached to it, which helps out an analyst or new analysts coming on board."
"Splunk SOAR has made a huge impact across security operations and the business overall."
"Before its use, analyzing each email would take at least 15 to 20 minutes, with some complex cases taking up to 30 minutes...With the automation provided by Splunk Phantom, we could significantly reduce the amount of time and human effort required to complete this task."
More Splunk SOAR pros
 

Cons

"We need to consolidate multiple features into one console. It would be beneficial to have all the important features on a single platform."
"The rollout to cover the online resources, such as SharePoint, One Drive, and Office 365 doesn't seem to have a very clear path."
"The Virtual Patching feature needs to be improved."
"I would like to see McAfee reduce the amount of manual work required."
"Some drawbacks include difficulty in supporting improvements because we don't get proper response from Trellix support, so there is a need to improve the support."
"As for improvements, I think that putting everything on a cloud and one console would be a great idea and would be useful for customers."
"McAfee ePolicy Orchestrator needs to upgrade its technology since the solution's EDR function is not good compared to other vendors in the market."
"There are some issues we are having with updating our Windows server. So we need to contact support or access our support portal."
More McAfee ePolicy Orchestrator cons
"Various aspects of the playbook development process itself can be optimized."
"While support is available, the resources around Splunk SOAR are more homegrown by other users, and discovering different troubleshooting methods is harder to do with Splunk SOAR than with Enterprise Security or other Splunk services."
"There is a lot of room for improvement with the UI."
"Splunk SOAR should improve its ease of upgrade, which is a pain point for us right now."
"Unfortunately, not all of our analysts are iPhone users or iOS users. The mobile app is only supported on iOS. Our analysts who have Android do not have that benefit. That would be a nice thing to have so that we can have it across the board and not just for iOS."
"We've run into a few minor issues. Some of the playbook writing is a bit complicated. We've had a few hiccups with the source control. We'd really like to use GitHub deployment keys for a dedicated account. We haven't been able to do that. I think those are some of the major ones."
"While there have been improvements to the investigation process, particularly with the playbook data, the current log review method is cumbersome."
"SOAR is probably the most unreliable product Splunk has and that's because most of it is content driven from what you put into it. There are certain parts of it that have a little bit of difficulty at volume too. It's always changing. There is new stuff coming out for it that's going to make it a little bit better, but it does have some drawbacks."
More Splunk SOAR cons
 

Pricing and Cost Advice

"$The price of McAfee ePolicy Orchestrator is expensive, it is approximately $6,000 to $9,000 per license annually."
"For large enterprise companies, the price should be alright, but for small businesses, the uptake might be slow because, for these clients, the price doesn't look very attractive."
"Compared to other Antivirus products, the cost of this solution is a bit high."
"McAfee ePolicy Orchestrator is a cheaply priced product, meaning it is not expensive since McAfee provides a free version of ePO, which includes phone support as well."
"There is a license required to use this solution. If we use the additional components, such as DLP encryption, there is an additional cost. However, it is similar to a separate product altogether. If you want to use that or not, it is optional, but when you use it, it will cost you additional pricing."
"McAfee ePolicy Orchestrator is not an expensive solution."
"McAfee tries to package different things into different products, then sell them as different products with different licenses. They just split everything up into multiple things. That's just their sales pitch and how they do it."
"It's an expensive solution"
More McAfee ePolicy Orchestrator pricing and cost advice
"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."
"I found the price of Splunk SOAR to be good."
"The cost is high and the licensing is on an annual basis."
"I don't know the exact price, but for my region, it is very expensive."
"It's very overpriced because it is based on the number of users. There is no bulk licensing."
"Splunk SOAR is an expensive solution for an organization of our size."
"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."
"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."
More Splunk SOAR pricing and cost advice
report
See which vendors are best for you
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
See recommendations
868,759 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
9%
Computer Software Company
8%
Financial Services Firm
8%
University
7%
Financial Services Firm
13%
Computer Software Company
11%
Manufacturing Company
10%
University
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business13
Midsize Enterprise11
Large Enterprise19
By reviewers
Company SizeCount
Small Business11
Midsize Enterprise7
Large Enterprise28
 

Questions from the Community

Which is better - Mcafee's MVision ePO or ePolicy Orchestrator?
Our organization ran comparison tests to determine whether Mcafee's MVision ePO or ePolicy Orchestrator network security software was the better fit for us. We decided to go with Mcafee's ePolicy O...
See all answers
What do you like most about McAfee MVISION ePO?
McAfee ePolicy Orchestrator's performance is good.
See all answers
What is your experience regarding pricing and costs for McAfee MVISION ePO?
It's an expensive solution.
See all answers
What do you like most about Splunk Phantom?
Splunk SOAR's quick response to incidents is the most valuable part.
See all answers
What is your experience regarding pricing and costs for Splunk Phantom?
I don't have experience with costs; management handles that aspect.
See all answers
What needs improvement with Splunk Phantom?
I haven't gone too far into it to see anything that needs improvement yet. We can likely include some features related to the integration with on-premises resources, rather than focusing solely on ...
See all answers
 

Comparisons

Forcepoint Data Loss Prevention vs McAfee ePolicy Orchestrator Logo
Forcepoint Data Loss Prevention vs McAfee ePolicy Orchestrator
Compared 27% of the time
GTB Technologies Inspector vs McAfee ePolicy Orchestrator Logo
GTB Technologies Inspector vs McAfee ePolicy Orchestrator
Compared 25% of the time
Symantec Data Loss Prevention vs McAfee ePolicy Orchestrator Logo
Symantec Data Loss Prevention vs McAfee ePolicy Orchestrator
Compared 23% of the time
More McAfee ePolicy Orchestrator Competitors
Palo Alto Networks Cortex XSOAR vs Splunk SOAR Logo
Palo Alto Networks Cortex XSOAR vs Splunk SOAR
Compared 18% of the time
Fortinet FortiSOAR vs Splunk SOAR Logo
Fortinet FortiSOAR vs Splunk SOAR
Compared 11% of the time
Cortex XSIAM vs Splunk SOAR Logo
Cortex XSIAM vs Splunk SOAR
Compared 11% of the time
ServiceNow Security Operations vs Splunk SOAR Logo
ServiceNow Security Operations vs Splunk SOAR
Compared 9% of the time
VMware Carbon Black Endpoint vs Splunk SOAR Logo
VMware Carbon Black Endpoint vs Splunk SOAR
Compared 1% of the time
More Splunk SOAR Competitors
 

Product Reports

Buyer's Guide
McAfee ePolicy Orchestrator
September 2025
McAfee ePolicy Orchestrator reportDownload McAfee ePolicy Orchestrator product report
Buyer's Guide
Splunk SOAR
September 2025
Splunk SOAR reportDownload Splunk SOAR product report
 

Also Known As

McAfee ePO, ePolicy Orchestrator, Intel Security ePolicy Orchestrator, McAfee MVISION ePO
Phantom
 

Overview

McAfee ePolicy Orchestrator (McAfee ePO) is the most advanced, extensible, and scalable centralized security management software in the industry. Unifying security management through an open platform, McAfee ePO makes risk and compliance management simpler and more successful for organizations of all sizes.
McAfee

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats. 

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk
 

Sample Customers

Brelje & Race, Cognizant, Sutherland Global Services, Eagle Rock Energy, Arab National Bank, Bank Central Asia, Kleberg Bank, Leading Mexican Bank, SF Police Credit Union, Macquarie Telecom, Seagate Technology, Blackburn & Darwen Council, California Department of Corrections & Rehabilitation, IRCEP, Major U.S. State Government, State of Alaska, State of Colorado, Cemex, Deutsche Edelstahlwerke
Recorded Future, Blackstone
Buyer's Guide
McAfee ePolicy Orchestrator vs. Splunk SOAR
September 2025
Free Report: McAfee ePolicy Orchestrator vs. Splunk SOAR
Find out what your peers are saying about McAfee ePolicy Orchestrator vs. Splunk SOAR and other solutions. Updated: September 2025.
DOWNLOAD NOW
868,759 professionals have used our research since 2012.
See our McAfee ePolicy Orchestrator vs. Splunk SOAR report.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.