Forty-five new customers should have been good news. For Victrix, a Canadian managed security provider, they also raised an awkward question: who would handle all the extra work? The team bought security orchestration, automation, and response software, or SOAR. A year later, its target of automating 20% of incoming tickets remained out of reach. Bugs persisted. Analysts worked around the system. “It was a fail,” cybersecurity manager Patrick Côté recalled in Swimlane’s customer account.
- The job: connect security tools and automate the work between alerts and responses.
- The buyer: enterprise security teams and providers protecting many customers.
- The useful distinction: repeatable playbooks for familiar work, AI reasoning for cases that need it.
Victrix had considered Swimlane first. The obstacle was wonderfully unglamorous: Canadian data residency. When Swimlane could offer a Canadian tenant, the conversation reopened. Victrix says it reproduced a year’s automation work in three weeks, while training analysts in parallel. A hosting constraint had mattered more than a feature list. Then implementation mattered more than the promise.
The expensive space between tools
Swimlane grew out of work its founders understood firsthand. Cody Cornell and Brian Kafenbaum came from security consulting. Development began in 2014; the company publicly launched in January 2015 as a spinout from Phoenix Data Security. Its original announcement described centralizing alerts, gathering threat intelligence, and automating responses. The vocabulary has changed. That basic assignment remains recognizable.
A security operations center, or SOC, can own excellent detection tools and still waste time. An alert arrives from one system; context lives in another; the person authorized to act uses a third. Someone must join the dots, create the case, request approval, and record the result. Swimlane sells software for that connective work. Its expertise sits in translating operational procedures into integrations, workflows, and usable case records.
Turbine, introduced in 2022, supplies the foundation: a visual playbook builder, integrations, case management, dashboards, and reporting. Hero AI adds assistance and agents for investigation and workflow creation. An analyst can describe a desired playbook in natural language, then inspect and adapt the result. The appeal is straightforward: more people on the security team can help build the machinery they use.
Give the routine work a route
The interesting development arrived in August 2026. Swimlane introduced intelligent routing across three paths: deterministic automation, AI-assisted investigation, and fully agentic investigation. Familiar tasks can follow established instructions. Ambiguous cases can receive model reasoning. Analysts can remain involved where the organization wants oversight. This makes the product’s allocation of work as interesting as its ability to perform work.
Swimlane says an unnamed healthcare customer investigating about 180 threats daily cut investigation processing costs by 90%, reserving agentic AI for the most complex 10%. That is a vendor-reported comparison with routing every alert through AI. It is not a promise about an organization’s total security budget. Still, it identifies a sensible design question: why pay for reasoning when the procedure is already known?
The usefulness extends beyond the alert queue. Northland Power, with a seven-person security team supporting more than 45 locations, used Swimlane to connect existing tools and automate vulnerability workflows. Its security leader reported a 30% reduction in time to patch critical vulnerabilities. The company’s ambition to automate remediation of roughly 92% of critical vulnerabilities was a future goal, rather than a completed result.
Less time to patch critical vulnerabilities.Reported by Northland Power in Swimlane’s customer account.
“When you’re processing hundreds of thousands of investigations, spending five or ten dollars in tokens for each investigation doesn’t scale.”
Cody Cornell · Co-founder & CEO
The bill has two meters
There is a software bill and an operating bill. Swimlane’s September 2025 enterprise datasheet describes subscription tiers based on average daily automated actions, with user-based options also available. Current Hero AI documentation describes credits calculated from weighted token usage for Swimlane-managed inference. A buyer therefore needs to understand both the licensed automation workload and the chosen AI arrangement.
The comparison should also include migration, integration upkeep, analyst training, and approval design. These are practical evaluation costs, not a published Swimlane price list. A low-code interface still needs someone who understands what the process should do. Automating an unclear procedure can make its confusion travel faster. The useful purchasing unit is a completed, trustworthy workflow, measured against the time and effort it previously required.
Swimlane raised $45 million in June 2025 from Energy Impact Partners, Activate Capital, and Trinity Capital. It reported customers spanning more than 50 Global 1,000 companies and 26 U.S. federal agencies. Those figures describe its enterprise footing. They do not establish what an individual deployment will save.
Sell the machinery. Leave the service.
For managed security service providers, the economics have an extra wrinkle. Each new customer brings another tool stack, permission structure, and reporting obligation. Swimlane’s July 2026 AI SOC for MSSPs adds central command, portfolio analytics, and tenant controls. Its stated position is to support providers while leaving them ownership of their customer relationships and services. NTT DATA is both a partner and a user.
The competitive neighborhood includes Palo Alto Networks Cortex XSOAR, Splunk SOAR, and Google’s security orchestration offering. Swimlane’s case rests on independence across tool vendors and on combining customizable automation with AI investigation. Its wider product range includes vulnerability response, compliance audit readiness, and business continuity. The compliance product, for example, maps controls and gathers audit evidence: another recurring coordination problem.
Start with one stubborn queue
The lesson to copy is small enough to test. Choose a recurring case, record its handling time, connect the required tools, and compare outcomes with human review. Check data residency before migration. Keep approval for consequential actions until the workflow has earned trust. Victrix’s account describes analysts confirming AI conclusions before expanding autonomy. Poor integrations, unclear permissions, or unreliable inputs weaken the whole arrangement. Start where the work is understood. Make that queue better. Then decide what deserves automation next.