ServiceNow Security Operations vs Splunk SOAR comparison

ServiceNow and Splunk are both solutions in the Security Orchestration Automation and Response (SOAR) category. ServiceNow is ranked #6 with an average rating of 8.1, while Splunk is ranked #3 with an average rating of 8.3. ServiceNow holds a 3.6% mindshare in SOAR, compared to Splunk’s 7.6% mindshare. Additionally, 95% of ServiceNow users are willing to recommend the solution, compared to 86% of Splunk users who would recommend it.

ServiceNow Security Operations

Read 21 ServiceNow Security Operations reviews

1,943 Views
817 Comparison Views

95% willing to recommend

Splunk SOAR

Read 45 Splunk SOAR reviews

4,002 Views
1,528 Comparison Views

86% willing to recommend

ServiceNow Security Operations

Splunk SOAR

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jun 15, 2025

ServiceNow Security Operations and Splunk SOAR compete in the security operations space. Splunk SOAR has the upper hand due to its robust automation and scalability.

Features: ServiceNow Security Operations offers strong integration with IT service management, robust incident management, and comprehensive threat intelligence. It excels with customizable workflows and incident response playbooks. Splunk SOAR provides advanced automation capabilities, customizable workflows, and excellent efficiency in automating repetitive tasks, while allowing for advanced customization.

Room for Improvement: ServiceNow could improve in areas such as deployment complexity for non-ServiceNow users, enhancing flexibility in module configurations, and cost-effectiveness. Splunk SOAR may need to simplify its initial setup process, improve its technical documentation for users of varied expertise, and expand integration capabilities with non-supported tools.

Ease of Deployment and Customer Service: ServiceNow Security Operations integrates seamlessly for existing platform users, offering strong customer service. However, deployment might be challenging for new users. Splunk SOAR has a modular deployment model, providing flexibility but demanding more setup effort. Its customer service can be responsive but often requires a higher technical understanding.

Pricing and ROI: ServiceNow Security Operations tends to have higher setup costs, reflecting its extensive features and promising long-term ROI for full capability utilization. Splunk SOAR presents a more cost-effective initial setup and provides quicker ROI through its efficient automation, significantly reducing operational costs for organizations focused on automation efficiency.

To learn more, read our detailed ServiceNow Security Operations vs. Splunk SOAR Report (Updated: June 2025).

Buyer's Guide

ServiceNow Security Operations vs. Splunk SOAR

June 2025

Download the complete report

Helped 860,592 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

ServiceNow Security Operations

Ranking in Security Orchestration Automation and Response (SOAR)

6th

Average Rating

8.0

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Security Incident Response (1st), Risk-Based Vulnerability Management (10th)

Splunk SOAR

Ranking in Security Orchestration Automation and Response (SOAR)

3rd

Average Rating

8.0

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of July 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of ServiceNow Security Operations is 3.6%, down from 4.3% compared to the previous year. The mindshare of Splunk SOAR is 7.6%, down from 8.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR)

Featured Reviews

KishoreKumar4

Senior QE Lead at Cognizant

A low-cost and open-source tool for incident and change management

If we encounter challenges while deploying, we raise incidents. These incidents are categorized by priority: high, medium, and low. We assign an incident number and notify the relevant teams to address the issue. For instance, if we experience a problem with Cloud services or any other issue, we…

Read full review

SAURABHYADAV4

Consultant at HCL Technologies

Enables optimization by reducing manual intervention and increasing automation in the workflow

The product provides 100% automation for certain processes. It needs no manual intervention. We can integrate various tools like VirusTotal and ServiceNow. We can automate all the tasks. It is one of the best things about the tool. It also provides workforce protection. Whenever we get any alerts or make any configurations, we develop workflow automation using the playbooks. We can fully automate some of the security incident resolutions. We can also do identification and redirection using the product. I have integrated Splunk Phantom with Splunk Cloud. Previously, I used it with Splunk on-premise to get the logs into Splunk for tracking and audit purposes. Since Splunk is a SaaS-based product, it has certain maintenance windows. Over time, the vendor does some maintenance during off-production hours. Creating playbooks using the solution’s playbook editor is not tough. For someone who knows the solution, I rate the ease of creating playbooks as four out of five. The solution’s playbook viewer provides full visibility. The product provides different integrations. We can easily integrate the tool with VirusTotal, ServiceNow, and the asset and identity management system. The product is somewhat easier to use in an investigation. We have been able to identify the false positives using the product. The tool has helped reduce false positives by 30%. Splunk SOAR has helped reduce our mean time to detect by 10% to 15%. Splunk SOAR has a major impact on our meantime to resolve. Our mean time to resolve has been reduced by 35% to 40%. I have integrated VirusTotal with Splunk SOAR. Instead of doing manual checks, I can easily get the score by integrating the tool with Splunk SOAR. I have also synced Active Directory with the asset and identity management system. It's been a long time since we have implemented Splunk SOAR. It brings value to our organization. Before Splunk SOAR, everything was done using manual intervention. We had to educate the SOC team on how to do tasks. We also had to create playbooks for them. With Splunk SOAR, we only have to educate the team about how things are done so that they can perform a manual intervention when there is a failure, which is rare. After deploying the product, we had to provide some training to the SOC team. After getting trained, it was hands-on. Along with other Splunk solutions, Splunk SOAR provides the resilience to face any issues and hardships. We easily cope with downtimes. Splunk SOAR offers us end-to-end visibility across our environment. It depends on how much we utilize it. Visualizing and troubleshooting our cloud-native environment using Splunk SOAR is somewhat easy. I have to coordinate with the Phantom administrators if there is any issue. I work mostly on playbook development and integrating it with security instances.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The SOAR module of ServiceNow Security Operations is the most valuable feature"

"We refer to the setup and installation guide provided by ServiceNow. They have good documentation, which makes it easier to handle the process."

"The product's most valuable features include the no-code capability for workflows and flow design, which makes it user-friendly, and the ability to perform advanced configurations."

"ServiceNow is a convenient platform to raise tickets, and the respective support team will contact us to resolve any issues."

"The most valuable aspect of working with ServiceNow is its meaningful and feature-rich product."

"It's stable."

"It gives you the ability to bring data into the system. The workflows are out of the box, and it gives you the ability to auto-assign the incidents based on criteria and vulnerabilities."

"The "follow" feature is really good. If the user is not responding, there's an option to "follow". Just click on the button, and it will automatically trigger an email to the end user."

More ServiceNow Security Operations pros

"The product’s integration with other Splunk products is valuable."

"The best feature is the integration and the custom Python code that we can write. Splunk SOAR provides us with both of these capabilities, allowing us to integrate different security solutions with Splunk SOAR and take remediation actions directly on those security tools."

"The most valuable features are the Splunk SOAR apps and playbooks."

"I like the way Splunk interacts with various systems via the API. The ability to integrate Splunk with our ticketing system has been an immense help because we can maintain our workflow while blending Splunk with our support desk and other ways that we track work."

"Before its use, analyzing each email would take at least 15 to 20 minutes, with some complex cases taking up to 30 minutes...With the automation provided by Splunk Phantom, we could significantly reduce the amount of time and human effort required to complete this task."

"The automation part of the product is great."

"The playbooks are valuable. They are the core component. Being able to implement and build a code process to work through and scale out what we want to do is valuable."

"So far, the interface is very easy to use."

More Splunk SOAR pros

Cons

"Process framework and best practices for ease of integration between IT and security teams via incident, problem, and change."

"One area for improvement for the product is the need to tailor and alter some codes for customization, which can cause issues during upgrades. It does not support customized operations."

"An area for improvement I observed in ServiceNow Security Operations is the need to maintain correct CMDB data because if you're unable to do this, you can't perfectly maintain the vulnerability data. CMDB data in ServiceNow Security Operations needs to be accurate. As I've been working on ServiceNow Security Operations for only seven months, I still need more time to try all its modules before I can give recommendations regarding additional features I'd like to see in the solution."

"The dashboard and playbook creation will need to improve"

"They should stick to the roadmap and continue to build plugins and integrations with other third parties, enhance the UI, and enhance the reporting. It's all good. They should just continue enhancing the releases."

"It's very slow. When you click a button or update a field, it takes forever to actually react."

"Report generation within ServiceNow can take some time."

"Report generation within ServiceNow can take some time. Additionally, there are occasional issues when raising a ticket, which can also consume time."

More ServiceNow Security Operations cons

"Creating playbooks using the solution’s playbook editor, for me, is very cumbersome. There have been instances where I have said to myself that I just don't want to use this editor. I might just use a code block and write my own code within it... The functionality in the playbook editor is 80 percent there, but that 20 percent is still lacking. They could make it more efficient."

"The number of playbooks on offer should be increased."

"Splunk's support for integration is subpar and has room for improvement."

"The UI can be more customizable for the clients."

"Splunk SOAR can improve IoT/OT security-related case studies or your use cases. Their integration with identity and access management (IAM) solutions is a bit shaky. They don't have good integration with a lot of IAM solutions. They do have good capability in terms of user access management internally, but even with privileged user access, they have a good module. However, if they have to integrate with solutions, such as CyberArk or IBM IAM solutions they are lacking, the visibility of user access is not that much."

"In my opinion, the focus should be on improving its simplicity, specifically the interface, and configuration."

"It would be ideal if we could automate processes even more."

"have put a number of ideas on the ideas.splunk.com site for feature requests for the Splunk SOAR product. I posted one of them about three years ago, which finally got implemented in the latest release that just got announced, so the time to implement new features and things like that is a little bit concerning."

More Splunk SOAR cons

Pricing and Cost Advice

"The solution is more expensive than BMC Remedy, the other ITSM tool available in the market."

"It is an expensive product."

"This product is a good value for the money."

"If you're going to implement it on your own, there would be internal costs. If you're going to implement it through a contractor or consultant, you have to pay for that."

"Compared to competitor tools, ServiceNow Security Operations is more affordable"

"The product is more expensive than other solutions."

"We renewed it this year. This year was the first time there was a dramatic increase in the price. It was kind of non-negotiable. It was just a high increase. We had internal communications, and it was definitely a surprise to us. In a short time frame, we renewed it this year. Prices are going up everywhere, but they are not always justifiable, at least not to our eyes. The pricing this year was definitely a big shock."

"The tool is not cheap."

"The cost is high and the licensing is on an annual basis."

"When we first purchased our Splunk SOAR license, it was based on an event-count model. It was based on the number of events. I had strong opinions at the time that automation should not be stifled by the amount of automation you can accomplish, so the previous structure was not as beneficial for us. Later that year, we got told or saw at a conference that they announced user-based pricing. We are now in a renewal period, so we migrated to a user-based license model, which is more appropriate for us so that we no longer have to worry about stifling our automation based on the quantity."

"The licensing cost is reasonable."

"In my opinion, the price is high, but if you want good products, you have to be willing to pay for them."

"While I can't confirm the exact pricing, some colleagues have mentioned that Splunk SOAR may be on the costlier side."

"Splunk is a fast enterprise tool, but it costs too much. At the same time, it's worth what we pay, in my opinion. We can efficiently perform all the functions and tie together the data. It's the perfect tool for our needs."

More Splunk SOAR pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

860,592 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

19%

Manufacturing Company

12%

Computer Software Company

10%

Government

Computer Software Company

14%

Financial Services Firm

12%

Manufacturing Company

11%

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about ServiceNow Security Operations?

The most valuable aspect of working with ServiceNow is its meaningful and feature-rich product.

See all answers

What is your experience regarding pricing and costs for ServiceNow Security Operations?

The product is more expensive than other solutions like Archer but offers more features, making the pricing justifiable.

See all answers

What needs improvement with ServiceNow Security Operations?

In terms of improvements, there are several things that could enhance ServiceNow Security Operations in the future, especially regarding false positives or exceptions, which usually require filling...

See all answers

What do you like most about Splunk Phantom?

Splunk SOAR's quick response to incidents is the most valuable part.

See all answers

What is your experience regarding pricing and costs for Splunk Phantom?

Splunk SOAR is moderately priced, neither cheap nor overly expensive.

See all answers

What needs improvement with Splunk Phantom?

There are areas in Splunk SOAR that have room for improvement. To make Splunk SOAR a better solution, there could be better built-in debugging tools, smarter playbook suggestions, and enhanced life...

See all answers

Comparisons

Palo Alto Networks Cortex XSOAR vs ServiceNow Security Operations

Compared 22% of the time

Microsoft Sentinel vs ServiceNow Security Operations

Compared 13% of the time

Tines vs ServiceNow Security Operations

Compared 8% of the time

Unified Vulnerability Management vs ServiceNow Security Operations

Compared 6% of the time

Zafran Security vs ServiceNow Security Operations

Compared 5% of the time

More ServiceNow Security Operations Competitors

Palo Alto Networks Cortex XSOAR vs Splunk SOAR

Compared 18% of the time

Cortex XSIAM vs Splunk SOAR

Compared 16% of the time

Fortinet FortiSOAR vs Splunk SOAR

Compared 11% of the time

Tines vs Splunk SOAR

Compared 9% of the time

Torq vs Splunk SOAR

Compared 7% of the time

More Splunk SOAR Competitors

Product Reports

Buyer's Guide

ServiceNow Security Operations

June 2025

Download ServiceNow Security Operations product report

Buyer's Guide

Splunk SOAR

June 2025

Download Splunk SOAR product report

Also Known As

No data available

Phantom

Overview

ServiceNow Security Operations is a cutting-edge security solution designed to elevate organizations' security incident response (SIR) processes through automation and orchestration. Going beyond traditional SOAR, this comprehensive Security Operations Suite integrates seamlessly with other ServiceNow products and offers a wide array of features. Its components include Security Incident Response (SIR), which automates incident workflows and offers pre-built playbooks; Security Configuration Compliance (SCC), continuously scanning and automating compliance tasks; Vulnerability Response (VR), prioritizing and remediating vulnerabilities; Threat Intelligence (TI), aggregating threat data for proactive threat hunting; and additional features like IT Service Management integration, Machine Learning and AI, reporting, and a mobile app. The benefits span improved incident response speed, reduced mean time to resolution, increased security posture, enhanced compliance, collaborative synergy between security and IT teams, and operational cost reductions.

ServiceNow

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats.

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk

Sample Customers

DXC Technology, Freedom Security Alliance, Prime Therapeutics, Seton Hall University, York Risk Services

Recorded Future, Blackstone

Buyer's Guide

ServiceNow Security Operations vs. Splunk SOAR

June 2025

Free Report: ServiceNow Security Operations vs. Splunk SOAR

Find out what your peers are saying about ServiceNow Security Operations vs. Splunk SOAR and other solutions. Updated: June 2025.

DOWNLOAD NOW

860,592 professionals have used our research since 2012.

See our ServiceNow Security Operations vs. Splunk SOAR report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.