Shuffle

Shuffle is an open-source automation platform built for security teams that need to turn operational procedures into repeatable workflows. It is particularly well suited to CERT/SIRT groups and security operations centers combining many existing tools, while deployment choices make it viable for organizations that cannot put every workload in a SaaS environment. Its strongest proposition is the combination of a large app catalog, API-driven extensibility, and self-hosting; the free cloud tier is useful for evaluation but its run ceiling and cloud app-development limitation matter quickly.

Overview

Shuffle was created for the CERT/SIRT community, with an emphasis on sharing processes, automations, and detections across a security operation. The visual workflow designer is paired with a no-code app builder that can create integrations from Swagger or OpenAPI specifications and from API documentation URLs. That gives teams a practical way to connect services that are not already represented as ready-made actions.

The product is API-first, with Bearer-token authentication documented for both cloud and on-premises installations. Security documentation describes bcrypt password hashing, AES-256 encryption for app authentication, protected datastore keys, and encrypted files. Tenant-controlled SAML/SSO and MFA are supported through providers including Okta, Auth0, PingID, and AzureAD. Cloud AI requests are routed to regional model endpoints with tenant isolation, while on-premises deployments can use local models without sending requests externally.

Key features

Shuffle's public catalog contains more than 2,500 apps, including Slack, Gmail, MISP, Wazuh, Splunk, and Jira. For a security operation, that breadth reduces the need to build every connector internally and makes it easier to carry an alert from a detection system into collaboration, ticketing, and threat-intelligence tools.

Workflows can begin with webhooks, schedules, subflows, or user input. Extension triggers add AWS Lambda, AWS S3, Kafka, and Pub/Sub, covering both cloud events and message-driven architectures. Approval steps, scheduled runs, event triggers, incident integrations, and audit logs are supported, so Shuffle can represent controlled response procedures rather than only unattended jobs.

Deployment is unusually flexible: options include self-hosted open source, self-hosted licensed installations, Shuffle Cloud SaaS, and documented hybrid arrangements. Runtime architectures cover Docker Compose, distributed Docker Swarm, a cloud-hybrid model with a local Orborus runner, and Kubernetes through Helm charts. This suits teams that need local execution while retaining cloud management, but the range of architectures also puts more responsibility for design and operations on the customer.

Custom Python app creation is not yet easy in Shuffle Cloud, whereas on-premises instances support local app hotloading. Cloud buyers should therefore confirm that the catalog and generated integrations cover their use cases; organizations expecting to maintain a substantial library of bespoke Python apps have a stronger reason to self-host.

Pricing

Shuffle uses a freemium model. The Scale plan costs free and includes 2,000 App Runs per month. It has a hard App Runs limit, allows three tenants and one location, and provides 98.2% feature coverage. No support or onboarding is listed for this tier. It is a sensible starting point for a small team, a proof of concept, or low-volume automation, but the hard quota can interrupt a growing operation rather than merely increase its bill.

Business uses custom pricing and starts at 300,000 App Runs with a soft limit. It includes unlimited tenants, locations, and branding, 100% feature coverage, SLA and email support, onboarding and setup, and coverage for three use cases. This is the more appropriate commercial tier for a production team that needs room to scale and formal assistance but does not require the highest support commitment.

Enterprise also uses custom pricing and starts at 300,000 App Runs with a soft limit. It adds unlimited tenants, locations, and branding, full feature coverage, SLA, email, on-call and alert-mechanism support, professional services, onboarding and setup, and unlimited use cases. It is aimed at larger or more distributed security organizations where escalation coverage and implementation help justify a bespoke contract.

Platforms

Shuffle supports web access and API use, with Linux and self-hosted deployment options. The self-hosted and hybrid models are important for teams with data-residency or local-execution requirements; the cloud option favors organizations that want less infrastructure management.

Who it's for

Choose Shuffle for a security operations center, CERT, or SIRT that needs to orchestrate many security and business tools, formalize approvals and incident handling, and retain control over where workflows run. It is also a strong fit when OpenAPI-based integration generation can cover gaps in the catalog.

Look elsewhere if a 2,000-run hard cap is too restrictive, if you need effortless custom Python development in the cloud, or if your automation is not security-oriented enough to benefit from Shuffle's ecosystem and deployment model.

Pros and cons

• Pros: More than 2,500 catalog apps reduce connector work; OpenAPI and documentation-based app generation extends coverage; self-hosted, cloud, and hybrid architectures support different governance needs; SAML/SSO, MFA, encryption, and audit logs address operational controls.
• Cons: The free Scale tier stops at 2,000 monthly runs and is limited to three tenants and one location; custom Python apps are difficult to create in Shuffle Cloud; Business and Enterprise require custom pricing; the deployment choices can demand substantial infrastructure expertise.

Alternatives

Runbook Automation Software is the broader category guide for comparing workflow and response tools. Rundeck is a better fit when cross-platform runbook execution, including macOS and Windows, is central and its free Community plan for small teams is sufficient.

Tines suits teams that prefer a hosted, security-focused workflow product with a Free edition limited to three live workflows. StackStorm is the straightforward choice for a fully free, open-source, self-hosted automation project with no paid products.

Tanium Deploy is relevant when endpoint deployment is already anchored in a Tanium license. Tracecat is worth considering for self-hosted users wanting unlimited workflows, cases, and agents on its free Open Source plan. Azure Automation fits Azure-centered process automation, with 500 job-run minutes per month included. Palo Alto Networks Cortex Cloud API Security and Torq Case Management are paid alternatives for organizations seeking those specialized platforms.

Verdict

Shuffle is a strong recommendation for security teams that need broad integrations, approval-aware workflows, and the freedom to choose cloud, self-hosted, or hybrid execution. The main reason to choose it is the unusual combination of a 2,500-plus app catalog and extensible API workflow design. Look elsewhere when the free tier's hard 2,000-run ceiling, cloud custom-app limitation, or the operational burden of self-hosting conflicts with your scale or resources.