Tines Review

Community tier gives you 1 builder, 3 flows, and MCP server support for zero dollars — that's a real product, not a lead-gen trick. Starter at $500/month bridges the gap for 2-5 builders. Business and Enterprise stay contact-based, with Vendr pegging median contracts near $52,500/year.

The Story canvas, Send to Story modularity, and 200+ integrations including CrowdStrike and ServiceNow cover the operational core. AI Agent actions and Workbench copilot push this past simple SOAR playbooks into orchestration territory, versus Splunk SOAR or Palo Alto XSOAR named in the category.

Credential management spanning OAuth, JWT, and mutual TLS with SOC 2 and ISO 42001 on Enterprise shows they built for security buyers, not generic IT. Tradeoff: past Starter, you're negotiating blind. Pilot on Community, prove the case, then push sales for the Business number before you sign anything annual.

I look at this as a headcount-substitution decision, not a tooling decision. Tines automates the repetitive triage work security and IT teams staff up for — 200+ integrations including CrowdStrike, ServiceNow, and Okta, plus Change Control and story versioning for audit defensibility. That's the right shape for regulated ops teams who need to show their work to auditors, not just ship fast.

The pricing jump is the real operational risk. Community is free with 1 builder and 3 flows; Starter jumps to $500/month for 2-5 builders; Business is custom-quoted with a median contract near $52,500/year per Vendr data. That's a steep step-function for a mid-market team scaling past its proof-of-concept.

SSO on every tier, including free, is a governance win procurement will like. Self-hosting and air-gapped options on Enterprise matter for compliance-heavy shops. Three-year lock-in risk is moderate — workflows are portable via export, but institutional knowledge built into hundreds of Stories isn't.

Community Edition is genuinely free. 1 builder, 3 flows, SSO included even here — rare. Starter launches early 2026 at $500/month, 2-5 builders, 5-20 flows, 2,500-10,000 AI run-time credits. Math: 5 builders × $500 × 12 = $6K/year, before Business-tier features like SCIM or multi-team support.

Business and Enterprise are the real spend. Vendr reports median contract $52,500/year, range $26,667-$157,499. G2 reviewers cite Enterprise starting at $50K+. That's a 100x jump from Starter with zero public pricing logic connecting them.

Year 3, mid-market team of 50 analysts: you're in Business tier minimum, likely $150K+ over three years once AI credit overages and multi-team scaling hit. Named competitors include Palo Alto XSOAR and Splunk SOAR — both similarly opaque past entry tier. No published overage rate on AI run-time credits. That's the invoice risk, not the sticker.

Building a Story feels natural if you've ever chained together a SOAR playbook: webhook in, HTTP request out, conditional branch, Send to Story for reuse. Event Transform's dedupe/throttle/explode modes solve the annoying data-shaping work that usually needs a script step elsewhere. Credentials management with OAuth2, JWT, mutual TLS, and per-action scoping is the kind of thing an ops team actually audits, not just a marketing bullet.

Where it gets real: Community tier caps you at 1 builder and 3 flows — fine for a POC, useless for a live on-call rotation. Starter jumps to $500/month for 2-5 builders. Business pricing isn't public; Vendr pegs median contracts around $52,500/year. That's a lot of unknowns before you can budget a rollout.

Run Script with tunnel support for private network access is a nice touch for on-prem integrations. AI Agent actions and MCP server support are there, but how they behave under real incident load versus a demo isn't something the evidence settles.

Tines is built by people who've clearly sat through a 3am pager alert. The Story canvas, Send to Story for modular workflows, Event Transform with modes like throttle and dedupe — this is automation built by folks who know what a messy incident actually looks like. Credentials management supporting OAuth, JWT, mutual TLS, AWS IAM tells you this wasn't designed for hobbyists.

The Community tier is 1 builder and 3 flows. That's not a trial, that's a taste. Real usage starts at $500/month for the Starter tier (launched early 2026, per their pricing page), and jumps to contact-sales territory after that — Vendr data pegs median contracts around $52,500/year. Compare that to Palo Alto XSOAR or Splunk SOAR, and Tines reads as the lighter, more approachable option, but the pricing cliff between free and useful is steep.

Change Control and story versioning suggest someone thought about month-three reality, not just the demo. No mobile mentioned anywhere — this lives on a desktop, which is fine for its audience but worth knowing going in.

Palo Alto XSOAR, Splunk SOAR, Microsoft Sentinel Automation — all named as competitors in this evidence, all bigger, all entrenched in the SOC. Tines' pitch is the no-code storyboard plus AI Agent steps instead of hand-rolled playbooks. That's a real gap, not a copycat move, if the AI Agent action holds up under actual incident load.

What's grounded: Send to Story for modular workflows, Run Script for custom code, credentials management across OAuth2/JWT/mTLS/AWS IAM. That's specific, not vaporware language. Community tier is genuinely free — 1 builder, 3 flows, no card required. But Starter at $500/month "launched in early 2026" is brand new; no track record on it yet. Business tier jumps to a median $52,500/year per Vendr. That's a steep cliff.

Exit story: workflows import/export, public REST API, so migration isn't a black box. Still, 100+ prebuilt integrations mean re-wiring on the way out. Docs, changelog, and SOC 2/ISO 42001 mentions suggest a maintained platform, not an abandoned side project.