Tracecat bets cheap open-source SOAR beats Splunk's $100k stack; 3.8k stars

Tracecat is an open-source security automation platform for teams and AI agents: analysts build alert-response automations (investigate, contact victims, escalate, log evidence) with low-code workflows, case management and 100+ connectors, deployable as managed cloud or self-hosted.

Teams are priced out of SOAR, so an open-source engine that runs on one VM — and later turns prompts into automations — can win where Splunk SOAR charges $100k/year.

The founders were data engineers who kept hearing security friends complain about being priced out of SOAR — Splunk SOAR runs to roughly $100,000/year — while analysts face about 100 alerts a day at roughly 30 minutes each, so alerts get dropped and breaches trace back to week-old tickets. Tracecat began as a bare-bones alpha: webhook-triggered event workflows, REST API integrations, JSONPath parsing, conditional blocks, Tantivy log storage and a Jira-like case table, showcased on 2024-03-25 as 'an open source automation platform for security alerts.'

The Show HN thread became a positioning debate: the founders defended an open-core business model, arguing they could out-iterate incumbents on UX, especially for AI features; commenters warned that free software is not a business model and Tracecat would need to paywall features. The product then moved up the stack: by the 2026-09-04 crawl the README describes 'the agentic security automation platform' with prompt-to-automations driven from Claude Code, Codex and OpenCode via MCP, code-native Python sync, sandboxed execution with nsjail, durable workflows on Temporal, and an Enterprise Edition under AGPL-3.0 with paid EE licensing and managed Cloud (US/EU) or self-hosting options.

Still running as an open-core company: the 2026-09-04 crawl shows 3.8k stars, 411 forks, 5,736 commits, a paid Tracecat Enterprise tier and managed Cloud plus self-hosted deployment options. The material carries no funding, revenue, shutdown or acquisition data.

Verifiable attention: the 2024-03-25 Show HN drew 264 points and 65 comments, and the repo reached 3.8k stars, 411 forks and 5,736 commits by the 2026-09-04 crawl.

The bet is sharp and testable: price and operating complexity keep SOAR out of reach for most teams, so a one-VM open-source engine attacks Splunk's $100k Kubernetes-grade stack where it is weakest.

The thread shows the business-model question argued in real time — open core versus free-forever — and the 2026 AGPL-plus-Enterprise licensing shows which answer the company chose.

The story has a verifiable arc from alpha launch to a rebranded agentic platform, all documented on the same repo and HN thread.

Attack the incumbent's price and operating complexity before its features: a SOAR that runs on one VM makes the Kubernetes-grade $100k stack look absurd, and open code does the selling.

As of 2026-09-05 Tracecat is running as an open-core company: the 2026-09-04 crawl of TracecatHQ/tracecat shows 3.8k stars, 411 forks and 5,736 commits, and the README presents the platform as 'agentic security automation' with prompt-to-automations via MCP, 100+ connectors, nsjail sandboxing, Temporal-based durable workflows, and a paid Enterprise Edition under AGPL-3.0, sold as managed Cloud (US/EU) or self-hosted with support. The material contains no funding, revenue, shutdown or acquisition disclosures, so the commercial half of the bet is not verifiable from these sources.