Tines
Also known as: Tines, tines.com, Tines Workbench, Tines Storyboard, Tines AI-driven SOC
Vendor-agnostic AI orchestration and workflow platform for security and IT teams, and a SOAR leader gone agentic: a no-code Storyboard, an AI Workbench that acts on proprietary data in natural language, and Cases management, with three levels of control (deterministic, human-led copilot, autonomous agents) keeping the analyst in charge. Free community edition; data kept within Tines infrastructure.
Tines is a secure, vendor-agnostic AI orchestration and intelligent workflow platform built for security and IT teams, and one of the anchors of the SOAR-to-agentic transition. Its fundamental innovation is combining deterministic workflow automation with non-deterministic agentic AI while keeping the human analyst in control, exposing three levels of LLM control over SecOps workflows: fully deterministic steps for compliance and auditability, human-led copilot steps where judgment matters, and autonomous agents for high-volume work like alert triage. Teams build with a no-code drag-and-drop Storyboard, connect any tool via universal API integration, and use Workbench, an AI chat interface that lets users instruct an LLM in real time to access proprietary data and take action privately and securely, building and optimizing workflows in natural language. Cases adds case management with SLA tracking and TTD/TTR metrics, and built-in controls, confirmation prompts, guardrails, audit logs, and RBAC, are integrated into the core. Tines keeps all automation and data within its own infrastructure, is vendor-agnostic across tools and LLMs, and offers a free community edition alongside commercial tiers. Positioned by IDC as applying the right type of AI to the right problem, autonomous agents for volume, copilots for approvals, deterministic flows for auditability, Tines sits at the platform and orchestration tier of the security lane, the control-plane counterpart to point-solution AI SOC analysts.
Vendor details
Canonical URL
https://www.tines.com
Category
Security / SOC agent
Funding status
Established SOAR and workflow-automation leader co-headquartered in Dublin and Boston; well-funded independent (a security-automation category leader named alongside Torq and Swimlane); launched its AI Workbench in 2024 and autonomous Agents in June 2025; broad enterprise and MSSP customer base with partnerships including Elastic and CrowdStrike integrations
Company status
independent
Use cases & customers
Primary use cases
Target customers
Deployment options
Integrations
Vendor-agnostic: connects any tool with an API, plus any LLM or proprietary app, through universal API integration; a drag-and-drop Storyboard builds automated workflows (stories), Cases provides case management with SLA, time-to-detect, and time-to-respond metrics, and Workbench lets users act on proprietary data through natural language; integrates with the existing security stack (CrowdStrike, Elastic, Slack, and hundreds more).
Sources & related URLs
Capability coverage
10.5 / 14 capabilities · 75%
| Integrations & Tool CallingVendor-agnostic universal API integration connects any tool with an API plus any LLM or proprietary app, with hundreds of stack integrations (CrowdStrike, Elastic, Slack), Tines site and toolify profile 2026-07-22 | Full |
|---|---|
| Workflow OrchestrationTines is a workflow orchestration platform combining deterministic multi-step workflows with autonomous agents that query multiple data sources and execute multi-step problems across systems and other agents, Tines platform and blog 2026-07-22 | Full |
| Knowledge Grounding & RAGWorkbench executes stories, compiles the results, and reintegrates them back into the AI as context to enhance responses, grounding answers in the customer's connected proprietary data short of a documented knowledge base or retrieval layer, Tines Workbench blog 2026-07-22 | Partial |
| Human Oversight & GuardrailsKeeping the human analyst in control is Tines's fundamental innovation, with three levels of control (deterministic, human-led copilot, agentic) plus built-in confirmation steps, so agents do not go off the rails, Tines agentic-automation blog 2026-07-22 | Full |
| Security, Identity & GovernanceBuilt by security professionals with all automation and data kept within Tines infrastructure, plus built-in RBAC, audit logs, controls, and real-time AI guardrails that prevent sensitive data exposure in AI tools and agents, Tines site and Workbench page 2026-07-22 | Full |
| Observability & AuditabilityTeams build, run, and monitor automated processes with Cases metrics (time to detect, time to respond, SLA tracking) and built-in audit logs, giving first-class observability and auditability, Tines site and cybersectools profile 2026-07-22 | Full |
| Memory & State PersistenceThe Cases case-management system tracks and persists incident state across the lifecycle with SLA and TTD/TTR metrics, a durable per-incident state short of a documented agent memory layer, Tines site and cybersectools profile 2026-07-22 | Partial |
| Deployment & Data ResidencyTines keeps all automation and data within its own infrastructure for controlled data handling, a posture short of a documented customer self-host option in retrieved materials, Tines PR and site 2026-07-22 | Partial |
| Prebuilt Agents, Templates & PacksTeams deploy pre-built apps, chatbots, and workflow integrations and Workbench draws on a library of workflows (skills) that power the AI, a reusable starting-point set short of a fully documented template gallery in retrieved materials, Tines PR and Workbench blog 2026-07-22 | Partial |
| Triggers & Channel CoverageWorkflows are triggered by alerts and incidents across the stack with Cases monitoring high-priority alerts, and Workbench is reachable via chat and Slack, spanning event, webhook, and chat entry points, Tines site and cybersectools profile 2026-07-22 | Full |
| Model Flexibility & RoutingVendor-agnostic across LLMs: connect any tool, LLM, or proprietary app, and apply the right type of AI (deterministic, copilot, or agent) to each problem, Tines PR and site 2026-07-22 | Full |
| APIs, SDKs & MCP ExtensibilityBuilt on universal API integration to connect any tool or proprietary app and orchestrate custom intelligent workflows, a core developer-extensibility surface, Tines PR and toolify profile 2026-07-22 | Full |
| Testing, Debugging & OptimizationThe Storyboard lets users build, understand, and optimize workflows directly, a build-and-optimize capability short of a documented agent testing or simulation suite in retrieved materials, Tines Workbench page 2026-07-22 | Partial |
| Browser & Computer UseNo browser or computer use capability documented; Tines acts through API integrations rather than driving a browser or GUI, Tines materials 2026-07-22 | Unable to verify |
Pricing
Free community edition; paid tiers quoted by sales
tiered subscription (free community + paid)
What is public
The free community edition and the tier structure (Community, Professional, Enterprise, the last with unlimited builders and dedicated resources) are public; exact paid rates are quoted by sales.
Variable cost rationale
Commercial pricing is quoted by sales; the billing basis above the free tier is not published, so variable exposure cannot be assessed.
Sales call required
Yes — required for paid access
Free / trial
Free community edition available to all users
Related vendors
- 7AI — Swarming agentic SOC from the Cybereason founders: sixty plus domain…
- AirMDR — AI-native MDR built around a Virtual Analyst that triages 95% of…
- Airrived — Agentic OS that unifies SOC, GRC, IAM, vulnerability management, IT,…
- Andesite — Bionic SOC: a human-AI collaboration platform that automates triage,…
- Assail — Autonomous red teaming platform (Ares) whose AI agents discover,…
- Astelia — AI native exposure management platform from Israeli National Red…