Tracecat GTM brain

Tracecat sells open-source security automation, agents and case management to security operations teams.

category

Security orchestration and AI agents

market profile

  • text: Security teams must triage alerts and coordinate response across identity, endpoint and cloud tools.
  • text: Tracecat positions its open-source platform against legacy SOAR and agentic automation vendors.

personas

  • title: SOC manager
    pains:
    • Alert triage consumes analyst capacity
    • Containment needs review and coordination across tools
  • title: Security automation engineer
    pains:
    • Maintaining brittle runbooks and integrations
    • Balancing agent autonomy with approvals and deployment control
  • title: CISO
    pains:
    • Scaling security coverage without proportional headcount
    • Avoiding vendor lock-in for sensitive operations

icp

  • text: Organizations with a dedicated security operations function and multiple detection or response tools.
  • text: Security teams seeking self-hosted automation, including regulated and security-sensitive enterprises.

message pillars

  • text: Own the agents that extend security capacity.
  • text: Unify security teams and AI agents on an open-source automation platform.
  • text: Start self-hosted and scale execution capacity as usage grows.

objections

  • objection: Can we control agent-initiated containment?
    response: Demonstrate approval gates on a representative isolation workflow and agree on human review boundaries.
  • objection: Will we have to abandon existing security tools?
    response: Map existing detection and response tools to integrations and pilot a single runbook before migration.
  • objection: Will costs rise with every analyst?
    response: Pricing describes unlimited users and execution-based scaling; confirm forecasted volumes with sales.

competitors

  • name: Tines
    why: Security automation and workflow orchestration alternative.
  • name: Torq
    why: Security automation and agentic operations competitor.
  • name: Cortex XSOAR
    why: Enterprise SOAR competitor for incident response workflows.
  • name: Splunk SOAR
    why: Established security orchestration platform.

influencers

  • name: Chris L.
    url: https://www.linkedin.com/posts/chris-tracecat_opensource-nocode-security-activity-7324112561497415681-iVVp
    why: Tracecat founder discusses product and building in public.

keywords

  • open source SOAR
  • security automation platform
  • AI SOC agents
  • phishing triage automation
  • incident response playbooks
  • Tines alternatives

voice

  • technical and direct
  • builder-oriented
  • ambitious about analyst capacity

signals

  • text: Hiring security automation engineers or SOC analysts while alert volumes rise.
  • text: Evaluating replacement of legacy SOAR or requiring self-hosted incident response.

stack

  • Docker Compose
  • Wiz
  • CrowdStrike Falcon

pricing

model: freemium
starting price: Free self-hosted; Team $50,000 per year

motion

hybrid

channels

  • GitHub
  • Discord
  • SEO
  • LinkedIn
  • sales demos

confidence

high

Founders

  • name: Chris Lo
    title: Founder/CEO
    role: CEO
    bio: CEO and cofounder @ Tracecat
  • name: Daryl Lim
    title: Founder/CTO
    role: CTO
    bio: Daryl Lim is the Co-Founder and Chief Technology Officer of Tracecat. Previously, he worked on various observability, data and AI infrastructure teams at AMD, Meta, and a London-based quant trading firm. He earned a Bachelors and Masters degree in Computer Engineering from Imperial College London.

Back to YC companies