Shuffle

Shuffle is an open-source automation platform built for security workflows. It is best suited to security operations teams that want to build integrations as well as workflows and choose where they run. Its breadth and deployment flexibility are compelling, but the free plan’s hard run cap and the cloud limitation on custom Python apps may matter.

Overview

Shuffle was created to address automation problems in the CERT/SIRT community, with the aim of helping security operations centers share processes, automations, and detections. Its visual workflow designer is paired with a no-code app creator that can generate integrations from Swagger/OpenAPI specifications or API documentation URLs. That gives teams a way to connect APIs beyond the public catalog; teams needing custom Python apps should favor on-prem deployment, where local app hotloading is supported.

Key features

The public app catalog lists more than 2,500 integrations, including Slack, Gmail, MISP, Wazuh, Splunk, and Jira. Workflows can start from webhooks, schedules, subflows, or user input, with extension triggers for AWS Lambda, AWS S3, Kafka, and Pub/Sub. This range suits response workflows that need to connect security tools, event sources, and team communications. Approval steps, scheduled runs, event triggers, incident integrations, and audit logs support operational coordination and traceability.

Shuffle describes itself as API-first and documents Bearer-token authentication for its API on cloud and on-prem installations. Its architecture documentation says passwords are bcrypt-hashed and app authentication, protected datastore keys, and files are AES-256 encrypted. Tenant-controlled SAML/SSO and MFA are documented, with Okta, Auth0, PingID, and AzureAD named as supported platforms. Shuffle says cloud AI requests use regional model endpoints with isolated tenant contexts; on-prem installations can use local models without external requests. These controls make deployment choice relevant to teams with specific authentication or data-handling needs.

Pricing

Shuffle uses a freemium model. Scale costs nothing and includes 2k App Runs, with a hard App Runs limit, 3 tenants, 1 location, and 98.2% feature coverage. It has no listed support or onboarding. That is a defined entry point for smaller deployments, but the run ceiling and tenant and location caps make it a poor fit for growing or distributed operations.

Business and Enterprise both start at 300k App Runs and use a soft limit; each includes unlimited tenants, locations, and branding, 100% feature coverage, and onboarding and setup. Business includes SLA and email support and covers 3 use cases. Enterprise adds on-call support, an alert mechanism, professional services, and unlimited use cases. Both have custom pricing. Business suits organizations with a bounded set of use cases; Enterprise is the stronger fit when broader coverage and escalation support are required.

Platforms

Shuffle supports API, Linux, self-hosted, and web environments. Deployment choices include self-hosted open source, self-hosted licensed, Shuffle Cloud SaaS, and documented hybrid deployment. Runtime architectures include Docker Compose, distributed Docker Swarm, a cloud hybrid setup with a local Orborus runner, and Kubernetes using Helm charts. The range favors teams that want to place execution within their own infrastructure or mix local and cloud deployment; teams seeking only a hosted service may not need that breadth.

Who it's for

Shuffle is a strong candidate for security operations centers and CERT/SIRT teams that need to connect incident tools, share automation, and choose between cloud and self-managed execution. It is less suitable for cloud users who depend on easily creating custom Python apps, or for teams whose run demand exceeds Scale’s hard cap but cannot justify a custom-priced plan.

Pros and cons

Pros: A catalog of more than 2,500 apps and a no-code app creator give teams more ways to connect tools than a fixed set of integrations alone.

Pros: Self-hosted, cloud, and hybrid deployment options, plus several documented runtime architectures, accommodate different operating preferences.

Pros: The free Scale plan has explicit run, tenant, and location limits, making its capacity easier to judge before adoption.

Cons: Scale’s 2k App Runs hard limit and caps of 3 tenants and 1 location constrain its use as operations expand.

Cons: Custom Python apps cannot yet be created easily for Shuffle Cloud, so teams needing that flexibility must consider on-prem deployment.

Cons: Business and Enterprise require custom pricing, which makes budgeting less straightforward than the free entry plan.

Alternatives

For other options, see Runbook Automation Software. Choose Rundeck if its freemium model, free trial, and small-team Community plan suit your needs. Tanium Deploy is a paid option that requires a Tanium license including Deploy and Tanium Core Platform servers. Parachute is another freemium choice, with a Starter plan at $49 a month billed Monthly. StackStorm is free and open source, with no paid products offered by the project. HCL BigFix is a paid subscription whose term and quote depend on managed devices, offer or modules, deployment, and onboarding. Palo Alto Networks Cortex Cloud API Security is a paid API- and web-platform option. Tracecat offers a free-forever, self-hosted Open Source plan with unlimited workflows, cases, and agents. Azure Automation is a freemium option for Windows and Linux, with 500 minutes per month included for process automation job run time.

Verdict

Choose Shuffle if your security team wants broad integrations, a visual workflow builder, and control over cloud, self-hosted, or hybrid deployment. The catalog and app creator are its strongest reasons to choose it; look elsewhere if cloud-based custom Python app creation is central to your workflows, or if Scale’s hard run cap is too restrictive and custom pricing is not a fit.