Back to vendors
T

Tines

Also known as: Tines, tines.com, Tines Workbench, Tines Storyboard, Tines AI-driven SOC

Visit site
Security / SOC agentindependentVerified 2026-07-22

Vendor-agnostic AI orchestration and workflow platform for security and IT teams, and a SOAR leader gone agentic: a no-code Storyboard, an AI Workbench that acts on proprietary data in natural language, and Cases management, with three levels of control (deterministic, human-led copilot, autonomous agents) keeping the analyst in charge. Free community edition; data kept within Tines infrastructure.

Tines is a secure, vendor-agnostic AI orchestration and intelligent workflow platform built for security and IT teams, and one of the anchors of the SOAR-to-agentic transition. Its fundamental innovation is combining deterministic workflow automation with non-deterministic agentic AI while keeping the human analyst in control, exposing three levels of LLM control over SecOps workflows: fully deterministic steps for compliance and auditability, human-led copilot steps where judgment matters, and autonomous agents for high-volume work like alert triage. Teams build with a no-code drag-and-drop Storyboard, connect any tool via universal API integration, and use Workbench, an AI chat interface that lets users instruct an LLM in real time to access proprietary data and take action privately and securely, building and optimizing workflows in natural language. Cases adds case management with SLA tracking and TTD/TTR metrics, and built-in controls, confirmation prompts, guardrails, audit logs, and RBAC, are integrated into the core. Tines keeps all automation and data within its own infrastructure, is vendor-agnostic across tools and LLMs, and offers a free community edition alongside commercial tiers. Positioned by IDC as applying the right type of AI to the right problem, autonomous agents for volume, copilots for approvals, deterministic flows for auditability, Tines sits at the platform and orchestration tier of the security lane, the control-plane counterpart to point-solution AI SOC analysts.

Vendor details

Canonical URL

https://www.tines.com

Category

Security / SOC agent

Funding status

Established SOAR and workflow-automation leader co-headquartered in Dublin and Boston; well-funded independent (a security-automation category leader named alongside Torq and Swimlane); launched its AI Workbench in 2024 and autonomous Agents in June 2025; broad enterprise and MSSP customer base with partnerships including Elastic and CrowdStrike integrations

Company status

independent

Use cases & customers

Primary use cases

security workflow orchestration and automation (SOAR)autonomous alert triage and investigation via AI agentsnatural-language SecOps action through Workbenchincident case management with SLA metricsIT and cross-team workflow automation

Target customers

enterprise security operations centersIT and infrastructure teamsMSSPs and security consultanciesdetection engineering and incident response teams

Deployment options

cloud SaaS keeping all automation and data within Tines infrastructurefree community editionenterprise tenant with controls

Integrations

Vendor-agnostic: connects any tool with an API, plus any LLM or proprietary app, through universal API integration; a drag-and-drop Storyboard builds automated workflows (stories), Cases provides case management with SLA, time-to-detect, and time-to-respond metrics, and Workbench lets users act on proprietary data through natural language; integrates with the existing security stack (CrowdStrike, Elastic, Slack, and hundreds more).

Capability coverage

10.5 / 14 capabilities · 75%

Integrations & Tool CallingVendor-agnostic universal API integration connects any tool with an API plus any LLM or proprietary app, with hundreds of stack integrations (CrowdStrike, Elastic, Slack), Tines site and toolify profile 2026-07-22 Full
Workflow OrchestrationTines is a workflow orchestration platform combining deterministic multi-step workflows with autonomous agents that query multiple data sources and execute multi-step problems across systems and other agents, Tines platform and blog 2026-07-22 Full
Knowledge Grounding & RAGWorkbench executes stories, compiles the results, and reintegrates them back into the AI as context to enhance responses, grounding answers in the customer's connected proprietary data short of a documented knowledge base or retrieval layer, Tines Workbench blog 2026-07-22 Partial
Human Oversight & GuardrailsKeeping the human analyst in control is Tines's fundamental innovation, with three levels of control (deterministic, human-led copilot, agentic) plus built-in confirmation steps, so agents do not go off the rails, Tines agentic-automation blog 2026-07-22 Full
Security, Identity & GovernanceBuilt by security professionals with all automation and data kept within Tines infrastructure, plus built-in RBAC, audit logs, controls, and real-time AI guardrails that prevent sensitive data exposure in AI tools and agents, Tines site and Workbench page 2026-07-22 Full
Observability & AuditabilityTeams build, run, and monitor automated processes with Cases metrics (time to detect, time to respond, SLA tracking) and built-in audit logs, giving first-class observability and auditability, Tines site and cybersectools profile 2026-07-22 Full
Memory & State PersistenceThe Cases case-management system tracks and persists incident state across the lifecycle with SLA and TTD/TTR metrics, a durable per-incident state short of a documented agent memory layer, Tines site and cybersectools profile 2026-07-22 Partial
Deployment & Data ResidencyTines keeps all automation and data within its own infrastructure for controlled data handling, a posture short of a documented customer self-host option in retrieved materials, Tines PR and site 2026-07-22 Partial
Prebuilt Agents, Templates & PacksTeams deploy pre-built apps, chatbots, and workflow integrations and Workbench draws on a library of workflows (skills) that power the AI, a reusable starting-point set short of a fully documented template gallery in retrieved materials, Tines PR and Workbench blog 2026-07-22 Partial
Triggers & Channel CoverageWorkflows are triggered by alerts and incidents across the stack with Cases monitoring high-priority alerts, and Workbench is reachable via chat and Slack, spanning event, webhook, and chat entry points, Tines site and cybersectools profile 2026-07-22 Full
Model Flexibility & RoutingVendor-agnostic across LLMs: connect any tool, LLM, or proprietary app, and apply the right type of AI (deterministic, copilot, or agent) to each problem, Tines PR and site 2026-07-22 Full
APIs, SDKs & MCP ExtensibilityBuilt on universal API integration to connect any tool or proprietary app and orchestrate custom intelligent workflows, a core developer-extensibility surface, Tines PR and toolify profile 2026-07-22 Full
Testing, Debugging & OptimizationThe Storyboard lets users build, understand, and optimize workflows directly, a build-and-optimize capability short of a documented agent testing or simulation suite in retrieved materials, Tines Workbench page 2026-07-22 Partial
Browser & Computer UseNo browser or computer use capability documented; Tines acts through API integrations rather than driving a browser or GUI, Tines materials 2026-07-22 Unable to verify

Pricing

Free community edition; paid tiers quoted by sales

tiered subscription (free community + paid)

Public — partialMedium variable costFree tierTrial available

What is public

The free community edition and the tier structure (Community, Professional, Enterprise, the last with unlimited builders and dedicated resources) are public; exact paid rates are quoted by sales.

Variable cost rationale

Commercial pricing is quoted by sales; the billing basis above the free tier is not published, so variable exposure cannot be assessed.

Sales call required

Yes — required for paid access

Free / trial

Free community edition available to all users

Verified 2026-07-22

Contact us

Found a vendor we missed? Have feedback on the index? We'd love to hear from you.