Shuffle

An open-source SOAR platform — visual workflows that fire actions across security tools without a human in the loop. 2.4k stars, 423 forks, 481 open issues. Backend AGPLv3; workflows, apps, docs and the SDK MIT. Maintained by the Shuffle team (lead handle Frikky), with a hosted tier at shuffler.io and listings on the Google Cloud and AWS marketplaces.

Tier note

T3, and the line is worth stating because this spoke grades visa-vulnerability-agentic-harness and exploitgym-repo as T1. Those are a defender and an academic group publishing tooling they are not selling. Shuffle’s open-source repo is the free tier of a commercial hosted product, which is the “usable for what’s offered, flag promotional” case in the ladder. Nothing about the code is suspect; the grade is about who is making the claims and what they are for.

Architecture

Four parts, and the split is the interesting bit:

Backend — Golang webserver, the core logic.
Frontend — ReactJS with Material UI, workflow graphs drawn in Cytoscape.
Execution layer — Orborus decides where a workflow runs and hands off to Worker, which runs it. Separating scheduling from execution is what lets one control plane drive runners inside several customer environments.
App SDK — third-party integrations, authored from an OpenAPI definition or in Python.

That execution split is aimed squarely at MSSPs and service providers: organization and sub-organization controls, plus hybrid resource sharing with the hosted service, so one provider operates workflows across many tenants. This is a multi-tenant product before it is a single-team tool.

What it connects to

Premade apps ship for the incident-response staples — VirusTotal, TheHive, Cortex, MISP — and anything with an OpenAPI spec can be added without writing an integration by hand. Deployment is Docker Compose self-hosted, or the hosted service.

Where it sits in this spoke’s argument

SOC triage is the spoke’s volume problem: ~98% of alerts resolvable without a human, per soc-fast-slow-thinking. Shuffle answers that problem a different way from every other source here. soc-fast-slow-thinking proposes an autonomous System-1 “fast brain” reaching a verdict in under two minutes; visa-vulnerability-agentic-harness runs multi-agent deterministic voting. Shuffle proposes neither. It offers a deterministic workflow an operator draws by hand — a graph of explicit steps whose behaviour is inspectable before it runs and identical every time it does.

That is the pre-LLM answer to the automation question, still actively maintained, and it is the control case the spoke did not have. The interesting question it raises is not whether a drawn workflow beats a model at triage, but which decisions in the pipeline anyone should want to be non-deterministic — a question this corpus keeps circling from the other direction.

The pattern holds here too

The spoke has recorded, repeatedly, that security automation ships its architecture and withholds its results: visa-vulnerability-agentic-harness states in its own README that it has no published precision or recall; visa-mythos-glasswing gives no counts and no false-positive rate; google-beyond-zero offers prototype anecdotes and zero metrics; soc-fast-slow-thinking omits its false-negative rate.

Shuffle is the most inspectable artifact of the group — the whole platform is source-available, not just described — and it still publishes no efficacy data at all: no mean time to respond, no analyst-hours displaced, no error rate on automated actions. Being open source turns out to be orthogonal to being measured. That is a sharper version of the spoke’s standing complaint, because here the code cannot be the excuse.

security-orchestration-automation-response · security-operations-center · soc-fast-slow-thinking · visa-vulnerability-agentic-harness · defensive-security · mean-time-to-adapt