# Tracecat **Source:** https://geo.sig.ai/brands/tracecat **Vertical:** Security **Subcategory:** General **Tier:** Leader **Website:** tracecat.com **Last Updated:** 2026-04-14 ## Summary SF YC W24 open-source SOAR security automation deployed by 200+ orgs (Fortune 500 + federal); $500K-$2M seed on Temporal's durable execution with 100+ integrations competing with Splunk SOAR and Tines for security incident response. ## Company Overview Tracecat is a San Francisco-based open-source security automation platform — backed by Y Combinator (W24) with $500,000-$2 million in seed funding from Y Combinator, Pioneer.app, Pioneer Fund, and SurgePoint Capital — providing security operations, IT, and infrastructure teams with a modern, cost-effective alternative to commercial SOAR (Security Orchestration, Automation, and Response) tools for automating security alerts, incident response, and IT workflows. Deployed by 200+ organizations from Fortune 500 companies to federal agencies, Tracecat is built on Temporal's durable execution platform (used by Datadog, Netflix, and Stripe) and offers 100+ integrations, AI-assisted runbooks, case management, and lookup tables. Founded in 2024 by Chris Lo and Daryl Lim. Tracecat's open-source SOAR platform addresses the cost and flexibility limitations of commercial security automation tools: enterprise security teams using Splunk SOAR (formerly Phantom) or Palo Alto Cortex XSOAR pay $500,000-$2 million annually for licenses, face vendor lock-in to specific security tool ecosystems, and deal with complex playbook development requiring dedicated SOAR engineers. Smaller security teams (50-500 person companies with lean SOC staff) can't justify commercial SOAR costs but face the same alert volume and incident response workflow needs — spending analyst time on manual triage that automation could handle. Tracecat's open-source architecture (free to self-host, with transparent playbook code that security teams can audit and modify, and a commercial cloud option) provides the economic accessibility and customization flexibility that commercial tools sacrifice for enterprise margin. In 2025, Tracecat competes in the SOAR, security automation, and incident response market with Splunk SOAR (NASDAQ: MSFT after Cisco/Splunk acquisition), Palo Alto Cortex XSOAR (NASDAQ: PANW, acquired Demisto for $560M), and Tines (security automation, $55M raised) for enterprise and mid-market security operations team security workflow automation and incident response platform adoption. Y Combinator W24 backing connects Tracecat with the security technology investor community. The 200+ organization deployment (including federal agencies) demonstrates security team trust in the open-source platform for mission-critical workloads. The Temporal infrastructure foundation provides battle-tested workflow execution durability. The 2025 strategy focuses on growing the cloud-hosted managed Tracecat tier for teams that want open-source flexibility without self-hosting infrastructure management, building the AI-powered alert triage for automated severity classification, and expanding the federal government and defense contractor security operations market. ## Frequently Asked Questions ### What is Tracecat? Tracecat is an open-source AI automation platform built for security, IT, and infrastructure teams. It provides a modern, free alternative to commercial SOAR (Security Orchestration, Automation, and Response) tools like Tines and Splunk SOAR, with features including 100+ integrations, AI-assisted runbooks, case management, and unlimited workflows. ### Who founded Tracecat? Tracecat was founded in 2024 by Chris Lo (CEO) and Daryl Lim (CTO) in San Francisco. Chris previously worked as an ML engineer at PwC, while Daryl has extensive experience from observability and AI infrastructure teams at AMD, Meta, and quantitative trading firms. The company is part of Y Combinator's Winter 2024 batch. ### What makes Tracecat different from commercial SOAR tools? Tracecat is completely open-source and free, making enterprise-grade security automation accessible to organizations of all sizes. Unlike expensive commercial SOAR tools, Tracecat offers unlimited workflows without add-ons, community-driven integrations, and the flexibility to self-host or deploy in your own infrastructure without vendor lock-in. ### How many integrations does Tracecat support? Tracecat supports over 100+ integrations, including both Tracecat-managed connectors and community-driven integrations. Users can also add custom Python and YAML integrations via Git for specialized tools and workflows. ### Who uses Tracecat? Tracecat has been deployed by more than 200 organizations ranging from startups to Fortune 500 companies and federal agencies. It's used by security teams, IT departments, and infrastructure engineers for automating alert response, incident management, and operational workflows. ### How much does Tracecat cost? Tracecat is completely free and open-source. There are no licensing fees, and the platform offers unlimited workflows without requiring additional paid add-ons. The code is available on GitHub for self-hosting or customization. ### What technology is Tracecat built on? Tracecat is built on Temporal, the open-source durable execution platform used by companies like Datadog, Netflix, and Stripe. This provides enterprise-grade reliability, scalability, and fault tolerance for mission-critical security workflows. ### Can I build custom workflows in Tracecat? Yes, Tracecat offers both a no-code drag-and-drop workflow builder and configuration-as-code options using Python and YAML. This dual approach supports both quick automation setup and advanced custom integrations for complex security workflows. ### What are AI runbooks in Tracecat? AI runbooks are intelligent, automated playbooks that use AI to enhance security operations. They help teams automate decision-making, enrich alerts with context, and orchestrate complex response workflows with minimal manual intervention. ### How much funding has Tracecat raised? Tracecat raised $500K in seed funding in April 2024 from Y Combinator, Pioneer.app, Pioneer Fund, and SurgePoint Capital. Some sources report total funding of $2M. ### Is Tracecat suitable for enterprise security teams? Yes, Tracecat is deployed by Fortune 500 companies and federal agencies. Built on Temporal's enterprise-proven platform, it offers the reliability, scalability, and security features required for large-scale security operations while remaining free and open-source. ### How do I get started with Tracecat? Visit www.tracecat.com or the GitHub repository at github.com/TracecatHQ/tracecat to download and deploy the platform. The project includes comprehensive documentation for setup, integration configuration, and workflow automation. ## Tags b2b, cybersecurity, enterprise, fortune500, saas, security --- *Data from geo.sig.ai Brand Intelligence Database. Updated 2026-04-14.*