Workflow automation platform for security and IT teams
Tines is an intelligent workflow automation platform for security and IT teams.
AI Panel Score
6 AI reviews
Reviewed
AI Editor ApprovedApproved and published by our AI Editor-in-Chief after full panel analysis.Tines is an intelligent workflow automation platform built for security and IT teams. Teams assemble automated workflows — called Stories — by connecting actions such as webhooks, HTTP requests, email handling, event transforms, conditional logic, and AI agents into visual pipelines, orchestrating tools and human decision points without writing application code. Stories can call other Stories through the Send to Story action, and a Run Script action covers cases that need custom code. Built-in credentials management keeps secrets out of individual workflow steps, while story versioning and change control track how automations evolve — useful for teams treating security automation as production infrastructure. Public and private action templates speed up common patterns, and story runs with event retention provide an execution history for review. A free Community plan and a free trial are available, and paid pricing starts at $500 per month for the Starter tier, with Business and Enterprise plans quote-based.
In Tines, users build automation workflows on a visual storyboard canvas by chaining together discrete action blocks. Actions include webhooks, HTTP requests, send/receive email, conditional branching, event transformation, script execution, and AI Agent steps. Workflows can be triggered by incoming events, schedules, or exposed as APIs, and each run is logged with full event data for auditing and debugging. Workflows can also call other workflows via a Send to Story mechanism, enabling modular, reusable automation.
Tines provides a broad library of pre-built connection templates covering over 100 tools—including CrowdStrike, Microsoft Defender, Jira, Slack, Splunk, ServiceNow, and cloud providers such as AWS—alongside credential management that supports text, OAuth 2.0, JWT, AWS IAM, mutual TLS, and multi-request patterns. An AI Agent action type allows workflows to incorporate large language models inline. Features such as Change Control, story versioning, and event retention address governance and auditability requirements common in enterprise security and IT environments.
Tines is positioned for security operations, IT automation, and adjacent teams in mid-market and enterprise organizations. Named competitors in the security automation category include Palo Alto XSOAR, Splunk SOAR, and Microsoft Sentinel Automation. Tines has a public pricing page and offers a free community tier alongside paid plans; pricing for enterprise tiers is contact-based.
The platform is delivered as a SaaS web application. It exposes a public REST API and supports custom script execution through a Run Script action with configurable runtimes. Workflows can be imported and exported, and the platform supports MCP server integration for connecting AI agent tooling.
A dedicated AI Agent action type can be embedded within a Story to deploy intelligent agents that perform decision-making or processing steps as part of an automated workflow.
Tines logs Story runs and provides configurable event and log retention (Keep Events and Logs), giving teams visibility into workflow execution history and audit trails.
The Event Transform action manipulates data flowing through a Story using multiple modes including deduplicate, delay, explode, extract, implode, throttle, and automatic transformation.
The Send to Story action allows one Story to invoke another Story, enabling modular workflow composition and reuse across pipelines.
Dedicated Send Email and Receive Email actions (supporting both email and IMAP modes) allow workflows to send outbound emails and ingest inbound emails as workflow triggers or data sources.
Users build automated workflows called Stories by connecting actions such as webhooks, HTTP requests, email handling, and AI agents into visual pipelines on a storyboard canvas.
Teams can use and share pre-built public templates or create private templates for reusable action configurations, accelerating workflow construction.
Stories support version history and a Change Control feature, allowing teams to track, review, and manage modifications to workflows over time.
A Run Script action lets users execute custom code within a Story, with support for custom runtimes and execution over a tunnel for private network access.
An HTTP Request action enables Stories to call external APIs and services directly, passing data between Tines and third-party tools without custom code.
A Webhook action type allows Stories to receive incoming HTTP payloads from external systems, triggering workflow execution automatically.
A centralized credentials store supports multiple authentication types—including OAuth 2.0, JWT, Mutual TLS, AWS, and HTTP request credentials—with domain restriction, expiry controls, and per-action access scoping.
A forever-free tier for individuals, proof-of-concepts, and experimentation. Ideal for learning the platform and building an internal business case before committing to a paid plan.
A self-serve paid tier launched in early 2026 for smaller organizations and growing teams that have outgrown the Community Edition. Bridges the gap between Community and Business.
For ambitious, scaling teams that need comprehensive workflow automation. Pricing is not publicly listed and requires contacting Tines sales. Vendr data reports a median contract value of ~$52,500/year across paid tiers (range: $26,667–$157,499).
For large organizations (100+ analysts) requiring multi-tenant governance, dedicated infrastructure, extended compliance capabilities, and strict data residency or air-gapped deployments. Pricing requires direct negotiation with Tines sales; G2 reviewers note enterprise pricing starting at $50,000+.
Real SOAR alternative with AI baked in, priced for the mid-market gap it just created.
“Tines added a $500/month Starter tier in early 2026 to catch teams too big for free and too small for enterprise contracts. The feature set is deep enough to matter, but pricing above Community still requires a sales call.”
Community tier gives you 1 builder, 3 flows, and MCP server support for zero dollars — that's a real product, not a lead-gen trick. Starter at $500/month bridges the gap for 2-5 builders. Business and Enterprise stay contact-based, with Vendr pegging median contracts near $52,500/year.
The Story canvas, Send to Story modularity, and 200+ integrations including CrowdStrike and ServiceNow cover the operational core. AI Agent actions and Workbench copilot push this past simple SOAR playbooks into orchestration territory, versus Splunk SOAR or Palo Alto XSOAR named in the category.
Credential management spanning OAuth, JWT, and mutual TLS with SOC 2 and ISO 42001 on Enterprise shows they built for security buyers, not generic IT. Tradeoff: past Starter, you're negotiating blind. Pilot on Community, prove the case, then push sales for the Business number before you sign anything annual.
Inline AI Agent steps and 200+ prebuilt templates differentiate versus traditional SOAR tools named in the category.
SSO on every tier and SOC 2/ISO 42001 on Enterprise are strong, but Business/Enterprise pricing opacity is a real negotiation risk.
Free tier with 3 flows and no credit card lets teams prove value before spending, though full builder scale requires a sales cycle.
AI Agent actions and MCP server support move teams toward agentic ops, not just cheaper scripting.
Public docs, changelog, API, and a new pricing tier launched in early 2026 show active shipping.
Security or IT teams outgrowing manual playbooks who want AI-assisted orchestration without custom code.
Skip it if you need transparent enterprise pricing without a negotiation cycle.
Solid operational bet for security and IT ops, but the cost curve from Starter to Business needs board-level scrutiny.
“Tines is built for the operators who own incident response and IT automation headcount math, not generic business process teams. The pricing architecture rewards early adoption and punishes scale-up timing.”
I look at this as a headcount-substitution decision, not a tooling decision. Tines automates the repetitive triage work security and IT teams staff up for — 200+ integrations including CrowdStrike, ServiceNow, and Okta, plus Change Control and story versioning for audit defensibility. That's the right shape for regulated ops teams who need to show their work to auditors, not just ship fast.
The pricing jump is the real operational risk. Community is free with 1 builder and 3 flows; Starter jumps to $500/month for 2-5 builders; Business is custom-quoted with a median contract near $52,500/year per Vendr data. That's a steep step-function for a mid-market team scaling past its proof-of-concept.
SSO on every tier, including free, is a governance win procurement will like. Self-hosting and air-gapped options on Enterprise matter for compliance-heavy shops. Three-year lock-in risk is moderate — workflows are portable via export, but institutional knowledge built into hundreds of Stories isn't.
Sits alongside named competitors Palo Alto XSOAR and Splunk SOAR but leans lighter-weight and more general-purpose IT/security automation.
Named integrations like CrowdStrike, Splunk, and ServiceNow match how SOC and IT ops teams actually operate day to day.
Public REST API, MCP server support, and 200+ tool connections give this real fit into an existing ops stack.
Pricing gap from $500/month Starter to custom-quoted Business (median ~$52,500/year) creates a hard renegotiation point at scale.
Change Control, versioning, and event retention address real audit and governance requirements, not just workflow speed.
Mid-market or enterprise security and IT teams that need auditable, governed automation across an established tool stack.
Avoid if your team is small, cost-sensitive, and likely to outgrow the free tier before budget approval for Business-tier contracts.
Free tier is real. Everything above $500/month is a phone call.
“Community tier: $0, 1 builder, 3 flows. Above that, Starter at $500/month, then two sales-gated tiers with no sticker price.”
Community Edition is genuinely free. 1 builder, 3 flows, SSO included even here — rare. Starter launches early 2026 at $500/month, 2-5 builders, 5-20 flows, 2,500-10,000 AI run-time credits. Math: 5 builders × $500 × 12 = $6K/year, before Business-tier features like SCIM or multi-team support.
Business and Enterprise are the real spend. Vendr reports median contract $52,500/year, range $26,667-$157,499. G2 reviewers cite Enterprise starting at $50K+. That's a 100x jump from Starter with zero public pricing logic connecting them.
Year 3, mid-market team of 50 analysts: you're in Business tier minimum, likely $150K+ over three years once AI credit overages and multi-team scaling hit. Named competitors include Palo Alto XSOAR and Splunk SOAR — both similarly opaque past entry tier. No published overage rate on AI run-time credits. That's the invoice risk, not the sticker.
Self-serve signup for Starter with no credit card on Community; Business/Enterprise require sales-led procurement cycle.
Monthly or annual billing offered on Starter; multi-year billing mentioned for Business but no renewal terms disclosed.
Community and Starter tiers publicly priced at $0 and $500/month; Business and Enterprise are contact-sales only.
Story run logs and event retention give measurable execution history, but no published benchmark ties automation to dollar savings.
Vendr median $52,500/year plus AI credit scaling means 3-year cost is hard to model before a quote.
Security teams that can self-serve on Starter or have budget authority to negotiate Business-tier contracts directly.
Avoid if your procurement process requires full pricing transparency before any sales conversation.
Solid Story-based automation for security ops, but the jump from Community to Business is steep
“Tines gives you a real visual builder with versioning, Change Control, and 100+ prebuilt connectors that actually matter for SOC/IT queues. The pricing cliff between the free tier and the $500/mo Starter plan is the first friction point you'll hit running real tickets.”
Building a Story feels natural if you've ever chained together a SOAR playbook: webhook in, HTTP request out, conditional branch, Send to Story for reuse. Event Transform's dedupe/throttle/explode modes solve the annoying data-shaping work that usually needs a script step elsewhere. Credentials management with OAuth2, JWT, mutual TLS, and per-action scoping is the kind of thing an ops team actually audits, not just a marketing bullet.
Where it gets real: Community tier caps you at 1 builder and 3 flows — fine for a POC, useless for a live on-call rotation. Starter jumps to $500/month for 2-5 builders. Business pricing isn't public; Vendr pegs median contracts around $52,500/year. That's a lot of unknowns before you can budget a rollout.
Run Script with tunnel support for private network access is a nice touch for on-prem integrations. AI Agent actions and MCP server support are there, but how they behave under real incident load versus a demo isn't something the evidence settles.
Visual Story canvas plus Event Transform and Send to Story cover real daily SOC/IT tasks, not just demo flows.
Docs, changelog, and Tines University suggest practitioner-oriented content, though public evidence doesn't confirm depth on advanced Run Script use.
Community tier's 1-builder/3-flow cap forces an early upgrade decision, and Business/Enterprise pricing requires a sales call.
Change Control, story versioning, and Run Script with custom runtimes give real headroom past basic webhook chaining.
200+ named integrations including CrowdStrike, ServiceNow, Slack, and Okta fit existing security stacks without custom glue code.
Security and IT teams who need auditable, no-code automation across an existing tool stack like CrowdStrike, ServiceNow, or Splunk.
Skip it if you need transparent enterprise pricing upfront instead of a custom sales negotiation.
A serious security automation tool, but the free tier is basically a demo.
“Tines gives you a real visual builder with 100+ integration templates and genuine governance features. Whether it feels good day-to-day depends entirely on which tier you're paying for.”
Tines is built by people who've clearly sat through a 3am pager alert. The Story canvas, Send to Story for modular workflows, Event Transform with modes like throttle and dedupe — this is automation built by folks who know what a messy incident actually looks like. Credentials management supporting OAuth, JWT, mutual TLS, AWS IAM tells you this wasn't designed for hobbyists.
The Community tier is 1 builder and 3 flows. That's not a trial, that's a taste. Real usage starts at $500/month for the Starter tier (launched early 2026, per their pricing page), and jumps to contact-sales territory after that — Vendr data pegs median contracts around $52,500/year. Compare that to Palo Alto XSOAR or Splunk SOAR, and Tines reads as the lighter, more approachable option, but the pricing cliff between free and useful is steep.
Change Control and story versioning suggest someone thought about month-three reality, not just the demo. No mobile mentioned anywhere — this lives on a desktop, which is fine for its audience but worth knowing going in.
Event retention, versioning, and Change Control point to a team thinking past first impressions.
Visual no-code builder plus 100+ templates helps early on, but Run Script and MCP integration add real depth to grow into.
No mobile experience mentioned in evidence; category norm for this segment is desktop-only anyway.
Free Community tier plus Tines University lowers the barrier, but 3 flows caps real exploration fast.
Full event logging and audit trails per run signal a platform built for accountability, not guesswork.
Security and IT teams who need auditable, governed automation and can budget past the free tier quickly.
Avoid if you need mobile access or expect to stay useful on the free Community plan long-term.
Solid SOAR alternative, but the $500/mo Starter tier is new — as in early-2026 new.
“Tines has the feature depth and the customer logos to back the SOC automation pitch. The pricing structure and the freshly-launched mid-tier are the parts I'd poke at before signing.”
Palo Alto XSOAR, Splunk SOAR, Microsoft Sentinel Automation — all named as competitors in this evidence, all bigger, all entrenched in the SOC. Tines' pitch is the no-code storyboard plus AI Agent steps instead of hand-rolled playbooks. That's a real gap, not a copycat move, if the AI Agent action holds up under actual incident load.
What's grounded: Send to Story for modular workflows, Run Script for custom code, credentials management across OAuth2/JWT/mTLS/AWS IAM. That's specific, not vaporware language. Community tier is genuinely free — 1 builder, 3 flows, no card required. But Starter at $500/month "launched in early 2026" is brand new; no track record on it yet. Business tier jumps to a median $52,500/year per Vendr. That's a steep cliff.
Exit story: workflows import/export, public REST API, so migration isn't a black box. Still, 100+ prebuilt integrations mean re-wiring on the way out. Docs, changelog, and SOC 2/ISO 42001 mentions suggest a maintained platform, not an abandoned side project.
No-code storyboard vs. XSOAR/Splunk SOAR/Sentinel Automation is a real positioning gap, not a me-too.
Public REST API and story import/export help, but 100+ integration templates and credential setups create real re-wiring cost.
Docs, changelog, SOC 2 Type II and ISO 42001 mentions signal active maintenance; enterprise pricing opacity is the flip side.
"AI orchestration platform" is aspirational but backed by a specific AI Agent action and Workbench copilot, not just a buzzword.
Named features like Event Transform and Change Control are concrete; the Starter tier is too new (early 2026) to have a track record yet.
Mid-market security or IT teams that have outgrown ad hoc scripts and want auditable, no-code workflows.
You need predictable enterprise pricing upfront rather than a sales negotiation.
Common questions answered by our AI research team
Tines offers a free Community Edition with 1 builder, 3 flows, unlimited viewers, and no credit card required. Business and Enterprise plans with 100+ builders and multiple teams are custom-priced, available upon request.
Yes. Tines includes Workbench, an AI copilot for executing tasks via natural language, plus agent building for autonomous task execution. It also offers Cases for case management with SLA monitoring and a visual Storyboard workflow builder.
Yes. Slack is a named integration, alongside Microsoft Teams, CrowdStrike, ServiceNow, Okta, AWS, and VirusTotal. Tines connects with 200+ tools and can integrate with any API-enabled solution.
Yes. Business and Enterprise plans offer flexible hosting options, either cloud or self-hosted. These tiers also include dedicated support and training, and professional services are available to accelerate time to value.
Yes. SSO (Single Sign-On) authentication is included in every tier, even the free Community Edition. Tines positions itself as a secure, reliable integration layer connecting teams, tools, and data.
Company
TinesFounded
2018Pricing
From $500/moFree Trial
AvailableFree Plan
Available




Tines is a Dublin-based workflow automation platform used by security and IT teams to orchestrate tasks and build automated workflows without requiring extensive coding.