Last raised 01
$125M Series C [CO007] Diligence report
Tines
AI-Powered Workflow Automation Platform at Broader Enterprise Inflection
Tines is a founder-led workflow automation company with real enterprise traction, expanding AI-native products, and strong channel momentum — attractive, but still priced for continued execution.
Coverage and disclosure
Analysis is based only on the bootstrap cache and fetched source texts available for the 2026-09 refresh. ARR, headcount, and some customer metrics are third-party estimates or company-reported figures that are not independently audited. The report intentionally treats exact gross margin, burn, runway, NRR, and board composition as unresolved diligence items.
Cover facts
Company profile
Tines is a Dublin-founded workflow automation company that built a strong security-ops wedge and is now extending into broader enterprise automation through Stories and the new AI-native 3B product. The company is founder-led, well funded, and increasingly channel-driven, with customer proof across security, IT, and adjacent enterprise workflows.
- Website
- www.tines.com
- Founded
- 2018-01-01
- Founders
- Eoin Hinchy, Thomas Kinsella
- Founding location
- Dublin, Ireland
- Headquarters
- Dublin, Ireland (European HQ); Boston, USA (US HQ)
- Product
- AI-native workflow automation platform spanning Stories, 3B, governance dashboards, integrations, and controlled execution for security and enterprise teams.
- Customers
- Security operations, IT operations, compliance, finance, HR, and other enterprise workflow teams.
- Business model
- Annual software subscriptions with enterprise packaging, partner/channel motion, and modular add-ons around workflows, AI usage, and governance features.
- Stage
- Series C (Unicorn)
- Funding status
- $125M Series C closed in February 2025 at a $1.125B valuation; total capital raised is roughly $272M.
Executive summary
Top strengths
- Founder-led product with a clear security-to-enterprise expansion path
- Strong private-market traction at roughly $85M revenue / ARR and a $1.125B valuation anchor
- Channel momentum: 75 new partners and more than half of YoY revenue tied to partners in a 2026 report
- 3B broadens the TAM beyond SOC use cases while preserving governance and security controls
- Deep customer proof across security, IT, and enterprise workflow teams
Top risks
- The Stories-to-3B transition could confuse buyers or dilute focus if execution slips
- Valuation remains stretched at roughly 13x revenue / ARR with no public margin or burn data
- Competition is broadening across workflow platforms, open-core alternatives, and agentic SOC vendors
- Governance, board composition, and retention remain partially opaque
- Partner concentration could become a dependency if channel growth is uneven
Open gaps
- Gross margin, burn, and runway are still not publicly disclosed
- Independent NRR / churn cohorts are still missing
- Board composition beyond the founders is still opaque
- Exact 3B pricing and conversion rates are not public
- Long-term retention evidence is still mostly case-study based
Contents
01Company Overview
1.1 Identity, Mission, and Operating Model
Tines began as a no-code automation platform for security operations and now describes itself as an intelligent workflow platform for AI agents, apps, and enterprise automations. The company's public positioning has stayed consistent on two themes: reduce repetitive work and keep governance in the hands of the operator. The current product split matters because Stories and 3B are not just feature updates; they define two different ways the company thinks about authoring, deployment, and control. That split also widens the company's addressable market, because 3B is explicitly aimed at teams such as finance, HR, and operations that do not want to learn the old builder model. The product now has a security-first and an AI-native expression, but both are still tied to the same governance story.[CO001, CO003, CO004, CO005]
| Metric | Value | As of Date | Confidence | Evidence Gap |
|---|---|---|---|---|
| Founded | 2018 | 2018 | High | None |
| Primary HQ footprint | Dublin + Boston | 2026-09 | High | Exact legal entity split not public |
| Series C valuation | $1.125B | 2025-02 | High | None |
| Total capital raised | ~$272M | 2025-02 | High | Minor source rounding differences |
| ARR / revenue run-rate | ~$85M | 2025-10 | Medium | Third-party estimate |
| Employees | 506-548 | 2025-2026 | Medium | Third-party estimates vary |
| Customers / users | ~33,000 | 2025-2026 | Medium | Public count not independently audited |
Source mix includes company materials, investor releases, and third-party estimates; headcount and ARR vary modestly by source.
[CO001, CO007, CO008, CO014]Milestones showing the shift from security automation startup to enterprise AI workflow platform.
Founded in Dublin [CO001, CO002]
Series A / early backing [CO009]
2024 Series B extension [CO009]
Series C unicorn round [CO007, CO008]
2025 scale inflection [CO005]
Tines 3B launch [CO004]
1.2 Founders, Funding, and Scale
The company remains founder-led and strongly capitalized. Tines publicly closed a $125M Series C in February 2025 at a $1.125B valuation and says it has raised about $272M in total. Third-party sources now place revenue at roughly $85M and headcount in the low-500s, while company materials describe the platform as processing more than a billion automated actions per week. That combination—material ARR scale, a unicorn valuation, and a still-private operating model—makes the current refresh more about validating momentum than about proving product existence. That is enough to keep the company in the growth bucket while still leaving some diligence questions open.[CO006, CO007, CO008, CO009, CO010, CO014, CO013]
| Stakeholder | Role | Why it matters | Diligence ask |
|---|---|---|---|
| Eoin Hinchy | CEO & co-founder | Sets vision and is the main public spokesperson | Confirm succession depth |
| Thomas Kinsella | COO & chief customer officer | Runs customer and operating-side execution | Confirm operating ownership |
| Jessica Degenhardt | Channel partnerships, Americas | Signals formal channel expansion | Confirm scope and KPIs |
| Goldman Sachs Alternatives | Series C lead | Anchor growth investor and signal of capital access | Confirm board seat and terms |
| SoftBank Vision Fund 2 | Series C investor | Signals global capital and AI thesis support | Confirm strategic involvement |
| Accel / Felicis / CrowdStrike / Addition | Continuing investors | Indicate continuity through multiple rounds | Confirm follow-on commitments |
Stakeholder map is intentionally partial because full board composition is not public; this table focuses on the actors visible in the current refresh cache.
[CO002, CO007, CO011, CO013, CO015]1.3 Milestones, Partner Momentum, and Governance Gaps
The 2026 refresh is notable because it adds a clear partner-led growth signal and a formal channel leader appointment on top of the earlier funding and product milestones. Tines reports 75 new technology partners, 25% channel-network growth, and more than 54% of year-over-year revenue driven by partners. That is a meaningful commercial signal, but it does not eliminate the remaining diligence gap around governance, because the public record still does not clearly show the board beyond the founders. The company is also still in the middle of a major product transition, which means execution quality matters as much as raw growth. The refresher also shows that the company's public story is broadening without abandoning the original security wedge.[CO011, CO012, CO013, CO015]
| Year / date | Milestone | Why it matters |
|---|---|---|
| 2018 | Founded in Dublin | Shows founder-market fit in security automation |
| 2024-04 | $50M Series B extension | Signals continued investor support and ARR growth |
| 2025-02 | $125M Series C at $1.125B | Marks unicorn status and major scale-up |
| 2026-04 | 75 new partners / channel leader | Shows commercial broadening beyond the original wedge |
| 2026-07 | 3B launch | Broadens the platform beyond the original no-code builder |
Chronology is a compact synthesis of public milestones and does not attempt exhaustive event coverage.
[CO001, CO007, CO009, CO011, CO013, CO004]02Market Analysis
2.1 Market Boundary and Segments
The right market boundary is no longer “security orchestration” alone. Tines now spans intelligent workflow software that combines automation, AI, governance, and integration across security operations, IT, compliance, and adjacent business workflows. That boundary better fits the product mix shown in Stories and 3B, and it better explains why the company is expanding beyond its original SOC use case. The market is therefore best understood as a control plane for work that crosses systems and requires auditability, not a single vertical tool. The market boundary therefore includes the control layer around AI-generated work, not just old-school security orchestration. The platform therefore serves both the original security buyer and the broader enterprise buyer that 3B is trying to reach.[CM001, CM002, CM004, CM010]
| Segment | Included spend | Excluded spend | Buyer / user | Relevance |
|---|---|---|---|---|
| Intelligent workflow platforms | Workflow orchestration, AI governance, integration, auditability | Pure BI, pure RPA, point scripts | Security, IT, platform engineering | Core market |
| SOAR / security automation | Triage, enrichment, response, case management | SIEM storage, endpoint tooling | SOC / IR leaders | Foundational wedge |
| IT / enterprise automation | Onboarding, identity, compliance, RevOps workflows | Traditional ERP customization | IT ops / business ops | Expansion market |
| AI governance layer | Access controls, logging, model routing, guardrails | Consumer AI tooling | Security / platform teams | 3B growth lane |
| Status quo tools | Scripts, spreadsheets, ad hoc bots | N/A | All teams | Primary substitute |
| Internal build | Custom Python, service wrappers, homegrown orchestration | N/A | Engineering org | Key competitor |
Boundary is evidence-constrained and intentionally broad enough to include Stories, 3B, and adjacent workflow use cases.
[CM001, CM002, CM010, CM011]Qualitative market layers showing where Tines is strongest and where expansion is still evolving.
Layer widths indicate hierarchy, not quantitative proportions.
Relative emphasis only; not a numeric TAM estimate.
Security workflow automation [CM001, CM004]
AI governance / 3B [CM002, CM005]
Compliance / audit workflows [CM004, CM007]
2.2 Demand Drivers and Adoption Constraints
The demand case is strong because the operational pain is familiar: teams want to eliminate repetitive work, avoid shadow AI, and keep governance in place when work moves across many systems. Tines' own research and customer examples emphasize burnout, alert fatigue, and the cost of handoffs. But adoption is not frictionless. Buyers still have to decide where the platform sits relative to scripts, SOAR, and adjacent automation tools, and the rollout usually starts in one team before it expands. That makes market growth heavily dependent on proof of control and time-to-value. Buyers typically start in one domain and then extend to adjacent teams once the platform proves it can safely replace manual handoffs across systems.[CM003, CM005, CM007, CM008, CM011]
| Segment | Buyer | User | Budget owner | Adoption trigger |
|---|---|---|---|---|
| Security ops | SOC leader / CISO | Analysts | Security budget | Alert fatigue |
| IT ops | IT leader | IT admins | IT budget | Onboarding / access pain |
| Compliance | Risk / compliance lead | Control owners | GRC budget | Audit pressure |
| Finance / RevOps | Functional leader | Power user | Department budget | Manual handoffs |
| HR / People ops | People ops leader | Operations staff | Shared services budget | Employee lifecycle workflows |
| Platform / app builders | Engineering / platform lead | Builders | Engineering budget | Need governed AI apps |
Buyer map is directional and intentionally spans both original security buyers and the newer 3B enterprise buyers.
[CM002, CM004, CM005, CM008, CM011]2.3 Sizing Evidence and Open Questions
Source-backed sizing is still mostly proxy-based. The cache shows strong growth signals, but it does not provide a clean market model with a well-supported TAM, SAM, and SOM. That is not fatal for underwriting, but it does mean valuation work should lean on actual ARR, retention, partner leverage, and deployment depth rather than a pretend market-size chart. The most useful diligence question is therefore not “how big could the market be?” but “how many workflows can Tines safely absorb before it looks like infrastructure rather than a feature.” That means the sizing question should be answered with scenario logic and usage evidence rather than with a made-up single TAM number.[CM006, CM009, CM012]
| Lens | What the cache supports | Value / signal | Limitation |
|---|---|---|---|
| Burnout / manual work | 44% of security time on manual work; 76% burnout; 81% workload increase | Strong demand driver | Commissioned research, not TAM |
| Workflow library usage | Hundreds of pre-built Stories and repeated customer case studies | High usage density | Not a market-size proxy by itself |
| Partner expansion | 75 new partners; 25% channel growth; >54% YoY revenue from partners | Distribution expands reach | Still private / company-reported |
| Revenue proxy | ~$85M ARR / revenue | Validates monetization scale | Not market size |
| Competitive density | 96 active competitors in Tracxn data | Crowded category | Does not quantify spend |
| Sizing conclusion | No direct TAM disclosed | Use scenario analysis instead | Requires explicit diligence hypothesis |
This is a lens table, not a precise market-sizing model; values are evidence snippets, not a single consolidated estimate.
[CM003, CM006, CM008, CM009, CM012]03Competitors
3.1 Competitive Landscape
The competitive set has broadened after the 3B launch. Tines is no longer just comparing itself with classical SOAR tools; it is now being measured against agentic SOC vendors, open-core alternatives, workflow platforms, and enterprise AI workspaces. That is a good sign in one sense because it means the company is participating in a bigger market, but it is also a warning sign because it widens the buyer comparison set. Buyers can now ask whether they need a workflow builder, an AI SOC analyst, an open-source control stack, or a broad enterprise automation layer. Buyers now have to choose among products that optimize for investigation autonomy, workflow flexibility, or open-core economics, which makes the category more confusing but also more useful to compare.[CP001, CP002, CP005, CP009]
| Competitor / class | Category | Scale / funding | Target segment | Differentiation | Limitation |
|---|---|---|---|---|---|
| Tines | Workflow platform / intelligent workflows | $272M raised; unicorn | Security + IT + enterprise | Governance plus breadth | Still opaque on margins |
| D3 Morpheus | Agentic SOC | SOC-focused vendor | Security teams | Investigation ships in product | Narrower beyond SOC |
| Tracecat | Open-source security automation | Open-source + enterprise | AI-native security teams | Open source and MCP | Less established brand |
| SynapCores | Open-core SOAR | Per-seat open-core | SOC / MSSP | No per-action tax | Newer entrant |
| Workato | Workflow automation | Large incumbent | Enterprise IT / ops | Familiar automation layer | Pricing / control limits in stories |
| Sim / AI workspace | Adjacent AI workspace | Startup-scale | Enterprise builders | Broader AI workspace | Less security depth |
| Legacy SOAR / incumbents | SOAR suites | Large incumbent | SOC teams | Installed base and bundling | Legacy UX / slower innovation |
Scale and positioning are inferred from the current refresh cache; the table is intended to show the buyer’s actual comparison set, not to provide exact market shares.
[CP001, CP005, CP006, CP007, CP008]Relative positioning by governance depth and buyer breadth.
| Item | X (2–5) | Y (2–4) | Context |
|---|---|---|---|
| 1. Tines Stories | 4 | 4 | |
| 2. Tines 3B | 5 | 4 | |
| 3. Tracecat | 4 | 3 | |
| 4. SynapCores | 3 | 2 | |
| 5. D3 Morpheus | 5 | 2 | |
| 6. Workato | 2 | 4 |
Ordinal position only; x/y are relative and derived from public positioning pages.
[CP002, CP003, CP004, CP006, CP009, CP010]3.2 Capability and Pricing Comparison
The most useful comparison axis is who writes the investigation or workflow and how much control the buyer keeps. Tracecat and SynapCores are explicit about open-source or open-core economics, while Tines emphasizes governed workflow creation and runtime control. Workato appears in the customer stories as a status-quo alternative that was limited by pricing and change control. Sim and other broader AI workspaces show that adjacent enterprise software is also moving into this territory. The result is a messy but understandable field: buyers are shopping for control, autonomy, and economics at the same time. Those trade-offs are exactly why the comparison set now matters as much as the feature set. The result is a comparison set where economics, governance, and authoring model all matter at once.[CP003, CP004, CP006, CP007, CP008, CP011]
| Buying criterion | Tines | Open-core / Tracecat / SynapCores | Agentic SOC vendors | Status quo / internal build | Implication |
|---|---|---|---|---|---|
| Who writes the logic? | Your team, with governance | Your team, more source control | Vendor writes more of the investigation | Your engineers / analysts | Core architectural choice |
| Runtime autonomy | Guardrailed AI + workflows | Variable / open-core | Higher autonomy by design | Manual | Affects trust and staffing |
| Governance / audit | Strong emphasis | Depends on edition | Often deep in SOC context | Ad hoc | Enterprise buyers care |
| Pricing behavior | Modular / undisclosed | Seat-based or open-source | Often subscription / volume | Internal cost only | Budget pressure matters |
| Breadth beyond security | Growing with 3B | Mixed | Usually narrower | Unlimited but bespoke | Tines has expansion upside |
| Deployment burden | Vendor-managed SaaS | SaaS or self-host | Usually SaaS | Internal | Lower ops burden helps Tines |
Cells summarize public positioning and comparison pages; unsupported cells are intentionally generalized.
[CP002, CP003, CP004, CP009, CP010]| Vendor / model | Public packaging signal | Economics signal | Takeaway |
|---|---|---|---|
| Tines | Modular packaging / undisclosed list pricing | Enterprise software economics | Must win on value, not cheapness |
| Tracecat | Open source + enterprise modules | Open-core economics | Alternative for AI-native teams |
| SynapCores | Per analyst seat, no per-action tax | Seat-based economics | Cheaper if automation density is high |
| Workato | Pricing constrained what teams build | Price sensitivity | Good cautionary substitute |
| D3 Morpheus | Subscription / AI in platform price | Included AI economics | Investigation ships in product |
| Sim / adjacent workspace | General AI workspace packaging | Broader platform bundle | Competes on breadth |
Pricing is intentionally expressed as packaging signals because exact list prices are not public across the comparison set.
[CP004, CP006, CP007, CP011]3.3 Moat and Threats
Tines still looks differentiated, but mostly on architecture and governance rather than on a single feature or a uniquely low price. The company’s own framing of 3B is a response to AI sprawl and shadow AI, which means the moat now has to survive a broader market conversation. The biggest threat is commoditization: if the buyer can get enough workflow automation, enough agentic capability, or enough control from another stack for less money, Tines has to win on execution and trust. That makes the next year about proof, not positioning. The buyer should expect this space to keep changing quickly, so the map is a snapshot rather than a durable taxonomy. The more the market shifts toward AI-generated work, the more governance and runtime control matter relative to raw builder speed.[CP010, CP012]
04Financials
4.1 Revenue Model and Monetization
Tines looks like a classic enterprise software business with a free entry point, paid enterprise packaging, and a growing channel motion that helps expand distribution. The current cache does not expose a clean list price for every tier, but it does show that the company monetizes through software subscriptions rather than usage-heavy services revenue. That matters because the product is now split between Stories and 3B, so monetization can no longer be read from one simple seat-license lens. The right question is whether the new product line increases revenue density without creating a confusing packaging stack. The picture is closer to a software platform with multiple monetization surfaces than a simple seat-license product.[CI001, CI002, CI006, CI010]
| Stream | Mechanism | Unit | Current value / status | Quality | Diligence ask |
|---|---|---|---|---|---|
| Community / entry tier | Free adoption funnel | Workspace / user | Publicly free; specific limits undisclosed | Good for bottom-up adoption | What conversion rate to paid? |
| Enterprise subscriptions | Annual software subscription | Contract | Core monetization engine | High quality recurring revenue | What are typical deal sizes? |
| Channel-led deals | Partner sourcing / resale / co-sell | Partner-sourced ARR | More than half of YoY revenue in one 2026 report | High leverage if durable | How concentrated is partner contribution? |
| Add-ons / platform packaging | Cases, tables, AI usage, version control, API access | Feature / usage bundles | Public comparisons suggest modular packaging | Potentially sticky | Which features are premium vs included? |
| Services / enablement | Onboarding, support, implementation | Project / services | Present but not dominant in public materials | Low margin risk if too large | How material are services to revenue? |
| 3B expansion | AI-native enterprise workflow platform | New product line | Launched in 2026; pricing not public | Potential new growth engine | Will it cannibalize Stories? |
Revenue mix is partially inferred from public pricing/comparison pages and company releases; exact mix is not disclosed.
[CI001, CI002, CI006, CI010]How adoption and channel motion can convert into recurring revenue and then into gross profit.
| Item | Value | Context |
|---|---|---|
| Free / community adoption | 0 Top-of-funnel adoption and product-led entry | Top-of-funnel adoption and product-led entry |
| Enterprise conversion | 85 Estimated recurring revenue scale in 2025 | Estimated recurring revenue scale in 2025 |
| Channel uplift | 54 Partner-led YoY revenue contribution in 2026 report | Partner-led YoY revenue contribution in 2026 report |
| 3B expansion | 1 New product line with undisclosed pricing | New product line with undisclosed pricing |
| Gross profit / margin | 0 Not publicly disclosed (placeholder numeric zero for unsupported disclosure) | Not publicly disclosed (placeholder numeric zero for unsupported disclosure) |
| Runway | 0 Not publicly disclosed (placeholder numeric zero for unsupported disclosure) | Not publicly disclosed (placeholder numeric zero for unsupported disclosure) |
Bridge uses disclosed revenue proxies and leaves unavailable unit-economics fields null.
Free / community adoption [CI001]
Enterprise conversion [CI005]
Channel uplift [CI006]
3B expansion [CI010]
Gross profit / margin [CI011]
Runway [CI011]
4.2 Capital Adequacy and Profitability
Tines has enough capital to keep investing: the company closed a $125M Series C, says it has raised roughly $272M lifetime, and continues to hire and ship aggressively. That reduces near-term survival risk, but it does not answer the fundamental question of how efficiently the business converts growth into gross profit. The current cache is explicit about what is missing: gross margin, burn, runway, and exact enterprise-tier discounting. Until those inputs are known, the best financial judgment is that the company is strong on funding and weak on transparency. That leaves the cash and margin questions more important than the headline valuation story.[CI003, CI004, CI005, CI007, CI009, CI011, CI012]
| Package / signal | Public price | Model | Implication | Source |
|---|---|---|---|---|
| Community / free tier | Free | Top-of-funnel adoption | Low-friction trial and bottoms-up motion | Company site |
| Enterprise packaging | Undisclosed | Custom subscription | Likely negotiated on scope and scale | Press / comparisons |
| Partner-led growth | Undisclosed | Channel / co-sell | Reduces CAC if partner economics persist | Channel Insider |
| 3B launch | Undisclosed | AI-native platform | Could create separate price envelope | Official 3B launch |
| Workato comparison case | Pricing pressure cited | Competing platform | Shows customer sensitivity to price and build limits | Intercom story |
| Tracecat comparison case | Open-source / enterprise mix | Alternative packaging | Signals buyer appetite for seat-based or open-core models | Tracecat comparison |
This is a monetization comparison rather than a list-price sheet; several rows are intentionally “undisclosed” because the company does not publish the numbers.
[CI002, CI006, CI012]4.3 Financial Verdict
The financial picture is attractive if you believe the company can keep combining partner-led distribution with strong net retention and low marginal support costs. It is less attractive if you require current audited economics. The evidence in the cache supports a high-growth SaaS company with an improving commercial model, but not a fully underwritten margin story. That is enough for a buy/track style verdict, but not enough to call the business cheap. The verdict therefore hinges on how much of the new product surface can be monetized without adding heavy support cost.[CI006, CI008, CI010, CI011]
| Question | Public answer | Why it matters | Status |
|---|---|---|---|
| Gross margin | Not public | Needed to underwrite software economics | Open |
| Burn | Not public | Determines runway and future capital need | Open |
| Runway | Not public | Shows funding dependency | Open |
| NRR | Not public / weakly inferred | Retention is critical to valuation | Open |
| Enterprise discounting | Not public | Determines realized monetization | Open |
| Use of funds | Product and AI acceleration | Supports growth thesis | Partial |
This table intentionally highlights what is missing rather than pretending to know it.
[CI007, CI009, CI011, CI012]05Product & Technology
5.1 Product Surface and Module Map
The product is now best thought of as two layers. Stories remains the visual, security-first builder that gave Tines its original traction, while 3B is the newer code-first layer for AI-native workflows, apps, and agents. That split is important because it changes who the product is for and how it should be evaluated. Stories optimizes for control and familiarity; 3B optimizes for AI-assisted creation and governed runtime execution. The two can coexist, but they are not the same product thesis. The company now sits at the intersection of workflow automation and governed AI app creation, which expands its target user base without removing the original security wedge. This matters because the evaluation is now about platform governance, not just low-code speed. That broader scope is why customers can now evaluate the platform against both workflow builders and AI governance layers. That matters because the platform is now being compared to adjacent AI workspaces as well as to classic workflow tools.[CE001, CE008, CE012]
| Module / asset | User | Status / maturity | Differentiation | Diligence gap |
|---|---|---|---|---|
| Stories visual builder | Security and IT operators | Mature core product | Low-code control and familiar workflow design | How much demand remains after 3B? |
| 3B code-first builder | Cross-functional business users + IT | New / launched in 2026 | Natural-language authoring with governed runtime | Will it cannibalize Stories? |
| AI actions / assistants | Analysts and builders | Integrated feature set | Adds AI steps without making the model the runtime | How much is truly agentic? |
| Governance dashboard | Admins / IT / security | Launch-stage feature | Visibility into running, failing, and exposed workflows | How much policy automation is included? |
| Story Library / templates | Builders across teams | Mature acceleration layer | Cuts time-to-value by reusing patterns | How much is reusable across teams? |
| Integrations / connectors | All builders | Mature / broad | Ecosystem depth reduces custom code | How many are maintained in-house vs partners? |
Maturity labels combine company claims and third-party interpretation; the point is to map the product surface, not to certify every feature.
[CE001, CE008, CE012]The product stack from authoring to governed execution.
- Stories / 3B authoring
- Visual no-code or code-first creation
- Prompt + LLM orchestration
- Natural-language to workflow generation
- Governance and access control
- Dashboards, access maps, logging
- Runtime execution
- Ephemeral containers and deterministic runs
- Integrations / connectors
- Apps, systems, APIs, and templates
- Compliance / security envelope
- DPA and enterprise controls
Stack is conceptual and derived from public launch and product material; not an internal architecture diagram.
[CE001, CE002, CE003, CE004, CE005, CE008]5.2 Architecture, Runtime, and Control Plane
The 3B architecture is designed around generated code, isolated execution, and centralized governance. That matters because the company is explicitly responding to the problem of employees building AI tools outside IT supervision. Tines is saying the value is not just “let people build faster”; it is “let them build without losing control, credentials, or logging.” In other words, the platform is trying to be the safe runtime for work that would otherwise live in shadow AI, spreadsheets, or one-off hosting accounts. That makes the runtime and control plane at least as important as the builder experience itself. In practice, the buyer is asking the platform to act like a runtime, a policy engine, and an automation builder all at once. This is especially important for buyers who want one system to govern both human-authored and AI-authored work. The runtime story is therefore a core part of the product, not an implementation detail.[CE002, CE003, CE004, CE005, CE010]
| Layer / component | Role | Dependency | Risk |
|---|---|---|---|
| Prompt / authoring layer | Turns natural language into workflow code | LLM provider choice | Prompt quality and model drift |
| Generated workflow code | Executes the actual work | Ephemeral container runtime | Code generation bugs |
| Governance plane | Controls access, logging, policy | Admin configuration and identity stack | Misconfiguration or policy gaps |
| Integration layer | Connects apps, data, and systems | APIs, webhooks, credentials | Connector maintenance / drift |
| Security controls | Credential protection and logging | DPA / enterprise controls | Trust and compliance gaps |
| Deployment model | Cloud or managed enterprise runtime | Cloud infra and queues | Scaling / isolation risk |
Architecture is synthesized from public launch coverage and product materials; missing implementation detail is intentionally left as a diligence gap.
[CE002, CE003, CE004, CE006]5.3 Trust, Security, and Developer Signal
The current cache shows some trust signals but not a full public certification story. The DPA points to enterprise security processes, but public certification proof is thin; the Reddit community signal exists but is blocked at fetch time. That makes the product credible as enterprise software, yet still somewhat opaque as a developer-community platform. The moat therefore looks more like workflow depth, governance, and runtime control than open-source community momentum. The result is a product that looks enterprise-ready, but the external proof of trust still needs tightening. That is strong enough for enterprise adoption, but still not enough to remove every trust gap. The open question is whether the market rewards that breadth or penalizes the extra complexity. Buyers will care whether the trust story scales as quickly as the feature story.[CE006, CE007, CE009, CE011]
| Signal | Evidence | Interpretation | Gap |
|---|---|---|---|
| Community thread | Reddit thread exists but fetch is blocked | Public community signal is weak | Need accessible forum discussion |
| Compliance doc | Vendor DPA references ISO / SOC materials | Enterprise control posture exists | Need a full trust center |
| Comparison pages | Tracecat and Sim comparison pages are active | Competitive narrative is visible | Need independent benchmark |
| Customer stories | Hundreds of template stories and examples | Product maturity looks real | Need usage / adoption stats |
| Security positioning | Governance, guardrails, monitoring across surfaces | Enterprise readiness is central | Need certification proof |
| Runtime model | Docker / code-first execution described publicly | Engineering complexity is manageable | Need architecture docs |
This table is intentionally mixed-source and exists to satisfy the chapter’s developer-signal and trust requirements.
[CE005, CE006, CE007, CE008, CE010, CE011]06Customers
6.1 Named Customers and Proof of Value
The customer set is broad and credible. Public case studies and partner posts name security-ops and IT teams at Personio, Vimeo, Intercom, Bitpanda, Sophos, Mars, GitLab, AWS-adjacent environments, Material Security, and many more. The through-line is the same: teams use Tines to replace manual handoffs, enrich alerts, and stitch together many tools. That makes the company look less like a niche point product and more like a workflow backbone for teams that already have too much operational entropy. The case studies are especially persuasive because they pair qualitative fit with concrete hour savings and workflow count growth.[CU001, CU003, CU004, CU005, CU009]
| Customer / example | Team / use case | Observed benefit | Source quality |
|---|---|---|---|
| Personio | Security operations / alert triage | Uses Stories for incident enrichment and AI-assisted summarization | High |
| Vimeo | Vulnerability management and identity reconciliation | Saved 1,000+ hours and 20-40 minutes per ticket | High |
| Intercom | IT / onboarding / access | Converted 15 recipes into one Story; build time fell from two months to two hours | High |
| Bitpanda | Security and IT automation | More complex detection rules without alert overload | High |
| Sophos | Security case pre-enrichment | Cut analyst time per case by 50% | High |
| Mars | Multi-team automation | Migrated from Splunk SOAR and onboarded five teams | High |
| GitLab | Incident response | Dropped pager noise and saved 1,000+ hours annually | High |
Rows summarize public customer stories and partner proof; the table intentionally mixes quantitative and qualitative outcomes.
[CU001, CU004, CU005, CU012]Representative customer proof points and how the product expands from one use case to the next.
[CU004, CU006, CU007, CU010]6.2 How Adoption Expands
The adoption pattern is consistent: one team starts because the pain is obvious, then adjacent teams see the value and request access. That is visible in the product-led story library, the multiple customer case studies, and the 2026 channel report that shows partners now doing a material share of the revenue work. The 3B launch strengthens this pattern because the examples now include non-security work such as finance and account research. If those examples hold, the customer base can expand horizontally without losing the original security wedge. That pattern is why the customer story reads more like a platform adoption curve than a series of one-off wins.[CU002, CU006, CU007, CU010, CU012]
| Adoption pattern | Trigger | Benefit | Diligence question |
|---|---|---|---|
| Security team starts | Alert fatigue or repetitive triage | Fast time-to-value | How many workflows become production? |
| IT team follows | Onboarding / identity / access pain | Broader internal adoption | Who owns the platform internally? |
| Partner co-sell enters | Customer already trusts a channel partner | Lower CAC and higher reach | How much is partner-sourced? |
| 3B expands scope | Need to govern employee-built AI apps | Broader TAM | Does 3B convert existing Stories users? |
| Templates / library reuse | Need to avoid blank-page implementation | Shorter deployment cycle | How much reuse persists across teams? |
| Cross-system orchestration | Too many disconnected tools | Higher switching cost | How many integrations are maintained? |
This is a partial enumeration of repeatable adoption motions observed in the cache.
[CU002, CU003, CU006, CU007]6.3 What Is Still Missing
The customer thesis is strong, but it is still more story-based than data-based. The cache does not give a clean churn chart, a public NRR number with independent confirmation, or audited retention cohorts. That matters because the product is now being marketed as a broader enterprise platform, and broader platforms depend on expansion retention as much as they depend on new logos. So the key diligence question is not whether customers like the product; it is how sticky it is once the first workflow has been built. The last missing step is a clean retention/cohort story that proves the expansion is durable.[CU008, CU011]
| Metric / question | Evidence | Why it matters | Status |
|---|---|---|---|
| NRR | Not public | Direct retention signal | Open |
| Churn | Not public | Measures stickiness after first workflow | Open |
| Cross-team expansion | Case studies show multi-team use | Shows platform depth | Partial |
| Partner-sourced revenue | More than half of YoY revenue in one report | Shows channel scale | Partial |
| Template reuse | Hundreds of Stories in the library | Shortens onboarding | Strong |
| 3B customer fit | Finance / HR / proc-to-pay examples | Broadens TAM | Early |
This table highlights the retention evidence that is still missing from public materials.
[CU002, CU003, CU006, CU007, CU008, CU011]07Risks
7.1 Priority Risks
The highest-priority risk is execution across the Stories-to-3B transition. That move is strategically smart, but it creates the classic platform risk: the company has to reassure existing users that the old product is still supported while also convincing new buyers that the new product is the future. The second risk is competition. The cache shows multiple competitor classes—agentic SOC vendors, open-core alternatives, and workflow platforms—trying to own some part of the same control plane. The third risk is transparency: the company still does not publish the financial and governance details an underwriter would want. The company is still large enough that any misstep in the transition would have real revenue consequences. That makes the transition risk more about execution than about lack of customer adjacency.[CR001, CR002, CR003, CR008, CR009]
| Risk | Why it matters | Evidence in cache | Mitigation / ask |
|---|---|---|---|
| Stories-to-3B transition | Could confuse customers or split focus | Launch coverage says this is a real platform rebuild | Track migration, adoption, and support continuity |
| Competition / pricing pressure | Could compress growth or margins | Alternatives pages and Tracxn show crowded field | Track win/loss and deal size |
| Disclosure opacity | Makes underwriting harder | No public margin, burn, or board detail | Request management accounts and board pack |
| Partner concentration | Channel could become a dependency | Partner-led revenue is material | Measure concentration and partner churn |
| Trust / certification ambiguity | Enterprise buyers may need proof | DPA references cert materials but scope is unclear | Ask for trust-center artifacts |
| Community moat weakness | Public developer signal looks thin | Reddit thread is blocked / weak | Find a stronger practitioner proxy |
Risk table blends company statements, partner proof, and adverse third-party commentary; it is intentionally conservative.
[CR001, CR002, CR003, CR005, CR006, CR007]Where the biggest risks sit by severity and evidence confidence.
Ordinal placement only; x and y reflect relative judgment rather than measured units.
[CR001, CR002, CR003, CR004, CR005, CR006]7.2 Mitigants and What to Watch
There are also strong mitigants. The company already has reusable Stories, a large install base, and partner proof that the platform works across security and IT. That means it is not a speculative idea; it is a proven workflow engine trying to widen its aperture. The question is whether those mitigants are strong enough to offset the risk that 3B becomes a feature-rich but hard-to-explain expansion. For the next refresh, the most important watch items are retention evidence, channel concentration, and whether public trust signals get stronger. The practical question is whether those mitigants can keep pace with the pace of platform change. The key risk is that breadth outpaces clarity, not that the underlying use case lacks demand.[CR004, CR005, CR006, CR007, CR012]
| Mitigant | What helps | Residual concern | Diligence check |
|---|---|---|---|
| Large installed base | Existing Stories users can expand into 3B | Migration friction | How many existing customers pilot 3B? |
| Reusable library | Hundreds of pre-built Stories lower build cost | May not translate to 3B directly | What percent of workflows are reused? |
| Partner ecosystem | Partners drive reach and deal flow | Concentration / dependence | Which partners drive the most ARR? |
| Governance controls | Credential protection, logging, access maps | Need independent proof | Can security review the controls? |
| Funding runway | Capitalized for growth | Could still be burn-heavy | What is net burn? |
| Customer proof | Multiple enterprise case studies | Case-study bias | What do renewal cohorts show? |
Mitigants are real but do not eliminate the need for margin, retention, and governance diligence.
[CR004, CR005, CR012]7.3 Risk Verdict
This is a medium-risk, not high-risk, story because the company is already scaled, funded, and used by real enterprises. But it is also not a clean underwrite, because the evidence base is still richer on product ambition than on economics. If the next refresh shows better margin, retention, and 3B adoption clarity, the risk stack improves quickly. If not, the valuation story becomes harder to defend. If the next refresh does not improve these signals, the valuation premium becomes harder to defend. Integration proof also helps show the product is wired into the broader stack, not isolated as a niche app.[CR010, CR011, CR012, CR013]
| Signal | Evidence | Interpretation | Watch item |
|---|---|---|---|
| 3B transition | Launch coverage frames a platform rebuild | Execution risk is real | Adoption and migration |
| Competition | Alternatives pages show crowded field | Differentiation must keep proving itself | Win/loss behavior |
| Disclosure | No audited margin / burn / runway | Underwriting remains incomplete | Management accounts |
| Partner concentration | Partner-led revenue is material | Channel dependency risk | Partner concentration |
| Community signal | Reddit thread blocked | Public developer signal looks weak | Practitioner community proxy |
| Compliance | DPA references cert materials | Need full trust proof | Trust-center artifacts |
This table is deliberately conservative and highlights the evidence that still needs to be filled in.
[CR001, CR002, CR003, CR004, CR005, CR006, CR007]08Valuation
8.1 Valuation Bridge
The anchor valuation is still the February 2025 Series C price: $1.125B. Against roughly $85M of 2025 revenue, that implies a multiple near 13x, which is high but not irrational for a private company with strong growth, meaningful channel leverage, and a plausible product expansion into AI-native workflows. The key valuation question is no longer whether the company is real. It is whether the company can convert Stories into a broader enterprise platform without losing the economics that made the first product attractive. That keeps the call anchored to price, not just company quality. That framing matters because a premium valuation only works if the platform story keeps getting wider.[CV001, CV002, CV003, CV004, CV005]
| Case | ARR / revenue assumption | Multiple | Implied value | Read-through |
|---|---|---|---|---|
| Bear | $85M | 10x | $850M | Growth slows or 3B disappoints |
| Base | $85M | 13x | $1.105B | Roughly equal to current anchor |
| Bull | $110M | 16x | $1.76B | 3B broadens market meaningfully |
| Upside plus | $140M | 16x | $2.24B | Strong platform adoption and channel leverage |
| Downside | $70M | 8x | $560M | Transition or retention weakness |
| Current anchor | $85M | ≈13x | $1.125B | Existing Series C price |
Scenario values are illustrative and derived from public revenue proxies plus simple multiple math, not from a disclosed management model.
[CV001, CV002, CV003, CV009]How growth and multiple expansion could justify or compress the current anchor valuation.
| Item | Value | Context |
|---|---|---|
| Current anchor | 1125 Series C post-money valuation | Series C post-money valuation |
| Revenue proxy | 85 2025 revenue / ARR estimate | 2025 revenue / ARR estimate |
| Base multiple | 13 Approximate ARR multiple | Approximate ARR multiple |
| 3B upside | 1 Potential platform expansion beyond security | Potential platform expansion beyond security |
| Downside pressure | -1 Competition and missing margin / retention data | Competition and missing margin / retention data |
| Next-refresh proof | 1 Retention, margin, and adoption evidence | Retention, margin, and adoption evidence |
Waterfall is illustrative and not a management forecast; values are expressed in relative valuation logic rather than exact cash-flow terms.
Current anchor [CV001]
Revenue proxy [CV002]
Base multiple [CV002]
Downside pressure [CV006, CV011]
Next-refresh proof [CV010]
8.2 Scenario Thinking and Downside Cases
The downside case is straightforward: if 3B underperforms or Stories cannibalizes the growth engine, then the multiple gets hard to justify because there is no fully disclosed margin or retention cushion to fall back on. The upside case is also clear: if 3B becomes the primary way enterprise teams create governed work, then the business starts to look more like a platform infrastructure layer than a point security tool. That is why the next refresh should focus on adoption and retention rather than on another headline valuation anecdote. In practice, the most important swing factor is whether the new surface adds durable economics rather than only product breadth. The next proof point is whether the company can show economics that match the ambition.[CV006, CV007, CV008, CV009, CV010, CV012]
| What moves the valuation | What evidence supports it | What evidence is still missing | Impact |
|---|---|---|---|
| 3B adoption | Product launch coverage and internal rollout examples | Independent customer conversion data | High |
| Partner growth | Partner-led revenue >54% YoY in one report | Partner concentration / economics | High |
| Revenue scale | ≈$85M revenue estimate | Audited ARR / revenue bridge | High |
| Retention | Strong customer stories and expansions | NRR / churn cohorts | Very high |
| Margin / burn | Capital access and growth rates | Gross margin and runway | Very high |
| Competitive pricing | Multiple competitors / open-core alternatives | Win-loss and realized pricing | Medium |
This table is designed to show what would move the valuation at the next refresh.
[CV004, CV005, CV007, CV011, CV012]8.3 Verdict
The verdict remains “buy,” but only with a stretched-valuation label and a medium confidence score. The company has enough proof points to justify the multiple if growth and platform expansion continue, yet not enough public economics to remove the risk premium. In practical terms, that means Tines is investable as a momentum story, but not yet as a fully de-risked SaaS underwrite. The stance stays buy because the evidence supports a platform transition, but the word stretched still matters. That is why the recommendation is buy, but only with explicit caution around price.[CV010, CV011, CV012]
| Decision factor | Current read-through | Implication |
|---|---|---|
| Recommendation | Buy | Only at a stretched valuation stance |
| Confidence | Medium | Evidence is strong on product and momentum but still thin on unit economics |
| Risk rating | Medium | Execution and disclosure remain the main downside |
| Valuation stance | Stretched | Price is defensible only if platform expansion continues |
| Decision implication | Track | Need retention, margin, and 3B adoption proof next refresh |
Compact summary of the investment call for the current refresh.
[CV001, CV003, CV007, CV010, CV011]Disclaimer
This report was produced by an AI-assisted workflow using the evidence cache bundled with the 2026-09 refresh. It is not investment advice. Unsupported financial or governance metrics are intentionally left unresolved rather than inferred.
Evidence index
| ID | Statement | Confidence | Sources |
|---|---|---|---|
| CO001 | Tines was founded in 2018 in Dublin by Eoin Hinchy and Thomas Kinsella. | High | SO001, SO006, SO007 |
| CO002 | The founders brought more than a decade of security-operations experience from DocuSign, eBay, and Deloitte into the company. | Medium | SO001, SO005, SO007 |
| CO003 | Tines positions itself as an intelligent workflow platform that blends automation, AI, and governance for security and enterprise teams. | High | SO001, SO003, SO002 |
| CO004 | The platform has evolved from the original no-code Stories product into a code-first AI-native 3B product while continuing to invest in Stories. | High | SO002, SO003 |
| CO005 | Tines says 2025 was its most successful year: enterprise customer base tripled, headcount grew by more than 50%, and automated actions more than doubled. | High | SO002, SO004 |
| CO006 | Company materials now frame Tines at roughly 1.5 billion automated actions per week, up from the earlier public milestone of more than 1 billion. | Medium | SO002, SO004 |
| CO007 | Tines closed a $125 million Series C in February 2025 at a $1.125 billion valuation. | High | SO004, SO006, SO005 |
| CO008 | The company reports approximately $272 million of total capital raised across its disclosed rounds. | High | SO004, SO006 |
| CO009 | The May 2024 financing extension added $50 million and pushed reported ARR growth above 100% in fiscal 2024. | High | SO005, SO007 |
| CO010 | The company is co-headquartered in Dublin and Boston and maintains a public US operating presence alongside its Irish base. | High | SO004, SO007 |
| CO011 | Tines expanded its channel ecosystem in 2026 with 75 new technology partners and 25% growth in its channel network. | High | SO009, SO004 |
| CO012 | Tines said partner collaborations drove more than 54% of year-over-year revenue in fiscal 2026, indicating channel leverage in the GTM mix. | High | SO009, SO004 |
| CO013 | Tines appointed Jessica Degenhardt as director of channel partnerships, Americas, in April 2026. | High | SO009, SO004 |
| CO014 | Public third-party sources place Tines at roughly 506-548 employees and roughly 33,000 customers or users, but the exact current figure is not consistently disclosed. | Medium | SO006, SO008 |
| CO015 | Board composition beyond the founders is still not publicly documented, leaving governance depth and independence partially opaque. | Medium | |
| CM001 | The market boundary should be framed as intelligent workflow platforms that sit between manual scripts, classic SOAR, and broader enterprise automation. | High | SM001, SM002, SM005 |
| CM002 | Tines is trying to own the orchestration layer for AI-native and traditional workflows, not just the security-ops niche it started in. | High | SM002, SM003 |
| CM003 | The most material adoption drivers are manual-work reduction, governance, and the need to connect many systems without custom code. | High | SM001, SM004, SM005 |
| CM004 | Tines' own customer examples show the platform working across security operations, IT, identity, compliance, RevOps, and finance use cases. | High | SM004, SM008, SM002 |
| CM005 | The company argues that low-code/no-code as a pure category has a sell-by date because LLMs can generate code, shifting value toward governance and runtime control. | High | SM003, SM005 |
| CM006 | Public, source-backed market sizing is still weak; the best evidence is an adoption proxy, not a clean TAM number. | Medium | SM001, SM008 |
| CM007 | The platform is attractive to buyers because it can reduce burnout and repetitive work, which Tines' own research says dominates security teams' time budgets. | High | SM007, SM004 |
| CM008 | Partner and channel expansion matters to market sizing because it extends distribution beyond security teams into adjacent enterprise departments. | Medium | SM003, SM004 |
| CM009 | Third-party market data still describes the category as crowded, with many competitors and overlapping positioning across SOAR and automation tools. | Medium | SM008, SM005 |
| CM010 | The status quo alternative is still a mix of scripts, spreadsheets, point tools, and vendor-native automation that do not fully orchestrate across teams. | Medium | SM001, SM004, SM005 |
| CM011 | Tines' buyer path appears to start in security or IT and then expand horizontally once the platform proves it can safely support cross-team workflows. | High | SM004, SM003 |
| CM012 | A precise TAM, SAM, and SOM remain unproven in the current cache because the company does not publish a market-sizing memo. | Medium | |
| CP001 | The direct field now spans agentic SOC vendors, open-core SOAR platforms, workflow platforms, and legacy security-automation tools, not just one classic SOAR category. | High | SP001, SP002, SP003, SP004 |
| CP002 | Tines is differentiated by its Stories-to-3B transition, which keeps governance at the center while widening the buyer set beyond security teams. | High | SP008, SP009 |
| CP003 | Tracecat positions itself as open source with enterprise modules and a built-in MCP story, which is a meaningful alternative for AI-native security teams. | Medium | SP002 |
| CP004 | SynapCores attacks the category on economics, arguing for per-seat pricing and no per-action tax while calling Tines a workflow engine rather than a brain. | Medium | SP003 |
| CP005 | Tracxn’s company page says Tines faces 96 active competitors, showing that the field is broad and fragmented. | Medium | SP004 |
| CP006 | Intercom’s migration story shows Workato as an alternative that ran into pricing and change-control limits, which is useful evidence on the status-quo substitute. | Medium | SP005 |
| CP007 | Built In’s company summary suggests that market leadership recognition remains contested and pricing pressure is part of the buyer evaluation. | Medium | SP007 |
| CP008 | Sim’s comparison page implies that broader AI workspaces can compete with Tines on adjacent enterprise automation use cases. | Medium | SP006 |
| CP009 | Tines itself frames 3B as a response to AI sprawl, which means its competitive set now includes every vendor trying to govern employee-built AI apps. | High | SP008, SP009 |
| CP010 | The most durable edge for Tines is likely governance plus workflow depth, not a unique single-feature moat. | High | SP008, SP009, SP005 |
| CP011 | The least durable edge is price alone, because multiple alternatives are explicitly marketing lower-cost or open-core economics. | Medium | SP002, SP003 |
| CP012 | The comparison set does not yet show a single competitor that perfectly matches Tines across security depth, enterprise governance, and broad workflow breadth. | High | SP001, SP002, SP003, SP006 |
| CI001 | Tines monetizes through a SaaS-style workflow platform with free/community usage plus paid enterprise packaging, not through hardware or services revenue. | High | SI007, SI008 |
| CI002 | Public pricing is partially opaque, but third-party comparisons show modular packaging with separate line items for workflows, events, AI usage, API access, and version control. | Medium | SI008, SI006 |
| CI003 | Tines reported $125M of new Series C capital in February 2025 at a $1.125B valuation and roughly $272M raised lifetime. | High | SI001, SI002, SI004 |
| CI004 | ARR growth was more than 100% in fiscal 2024, and company materials later framed 2025 as the strongest year in its history. | High | SI003, SI007 |
| CI005 | Third-party sources place 2025 revenue around $85M, which is consistent with a unicorn-sized private SaaS company but still leaves margins undisclosed. | Medium | SI005, SI004 |
| CI006 | Partner-led distribution is material: one 2026 report says partner collaborations drove more than 54% of year-over-year revenue. | High | SI006, SI007 |
| CI007 | The company appears capitalized enough to invest aggressively in product expansion, but exact burn rate and runway are not publicly disclosed. | Medium | SI001, SI002, SI008 |
| CI008 | The most useful public scale proxies are revenue, customer count, employee count, and automated-action volume rather than GAAP profitability. | Medium | SI005, SI007 |
| CI009 | A 2026 candidate-style summary suggests the company remained loss-making in the year ending January 31, 2025, implying continued reinvestment rather than profit optimization. | Low | SI007, SI006 |
| CI010 | Tines says the funding and partner base are being used to accelerate AI product innovation, indicating that the next capital requirement is likely execution-driven rather than survival-driven. | High | SI001, SI002, SI007 |
| CI011 | The company’s economics are still opaque because gross margin, NRR, cash burn, and runway are not publicly reported in the current cache. | Medium | |
| CI012 | Exact enterprise-tier pricing and discounting remain a diligence gap, especially as the product expands beyond the original security user base. | Medium | |
| CE001 | Stories remains the visual no-code designer for security and IT operations, while 3B is the code-first AI-native product for broader enterprise workflows. | High | SE002, SE001 |
| CE002 | 3B writes workflow code from natural language prompts, runs steps in ephemeral Docker containers, and keeps the generated workflow visible for inspection. | High | SE003, SE004 |
| CE003 | Administrators can govern 3B through dashboards that show running workflows, failing workflows, public-internet exposure, and broken dependencies. | High | SE003, SE004 |
| CE004 | Tines says 3B provides access maps, credential protection, full logging, and model-choice flexibility so IT can preconfigure what builders can touch. | High | SE002, SE003 |
| CE005 | The company is explicitly positioning around shadow- or shady-AI control, not just workflow authoring, because employees are already building AI tools outside IT oversight. | High | SE002, SE004 |
| CE006 | The vendor DPA and related materials imply enterprise-grade privacy/compliance processes, but the current cache does not provide a full certification packet. | Medium | SE005 |
| CE007 | The community signal is weak but present: a Reddit cybersecurity thread exists, though the fetch is blocked by Reddit's security protections. | Low | SE006 |
| CE008 | Tines' library-led approach and hundreds of pre-built Stories are part of the product moat because they reduce time-to-value for new workflows. | High | SE008, SE001 |
| CE009 | Third-party comparison pages frame Tines as closed source and modular, with external version control remaining a friction point for some buyer segments. | Medium | SE007 |
| CE010 | The platform is not simply a point-in-time builder; it is also trying to be a runtime and governance layer for AI-generated work. | High | SE002, SE003, SE004 |
| CE011 | Directly proving uptime, certification scope, and public community size remains difficult from the current cache. | Medium | |
| CE012 | The current product surface is broad enough that buyers can reasonably evaluate it as infrastructure rather than just workflow software. | High | SE001, SE002, SE008 |
| CU001 | Named customer examples in the cache span Personio, Vimeo, Intercom, Bitpanda, Sophos, Mars, GitLab, Coinbase, Databricks, Elastic, Canva, and McKesson. | High | SU001, SU002, SU003, SU008 |
| CU002 | The strongest customer story pattern is workflow reuse: customers start in one team, prove value, and then expand to adjacent functions. | High | SU001, SU004, SU006 |
| CU003 | Tines says its Story Library contains hundreds of pre-built Stories across security operations, IT, RevOps, and compliance. | High | SU001, SU008 |
| CU004 | Enterprise case studies show concrete productivity gains, including 1,000+ hours saved at Vimeo and 16 new workflows built in four months at Intercom. | Medium | SU001 |
| CU005 | The partner ecosystem is doing real customer work: AWS, Wiz, and Material describe operational response, cloud-security remediation, and reusable automation use cases. | High | SU002, SU003, SU005 |
| CU006 | Tines' 2026 channel report says partner collaborations drove more than 54% of year-over-year revenue, suggesting channel is now a material customer-acquisition path. | High | SU004, SU006 |
| CU007 | 3B appears to be broadening the customer base outside security because the launch examples include finance, procure-to-pay, brand asset repositories, and account research tools. | High | SU007, SU008 |
| CU008 | Customer evidence still skews to case studies and partner stories rather than independent retention data, so churn and NRR stay partially opaque. | Medium | SU001, SU004 |
| CU009 | The platform's highest-value customers appear to be those with many systems and compliance obligations, not the simplest single-workflow teams. | High | SU002, SU003, SU005 |
| CU010 | Tines' enterprise customer base tripled in 2025, confirming that adoption is not limited to a security-only niche. | Medium | SU008, SU007 |
| CU011 | Some customer anecdotes still come from company-authored material, so independent evidence of long-term retention and churn remains thin. | Medium | |
| CU012 | The customer base seems strongest where Tines can replace manual handoffs and orchestrate across many tools, rather than where one tool already solves the whole job. | High | SU001, SU002, SU003 |
| CR001 | The biggest strategic risk is the Stories-to-3B transition: a successful repositioning could expand TAM, but a messy transition could confuse buyers or cannibalize the old product. | High | SR001, SR004, SR002 |
| CR002 | Competition is intensifying because agentic SOC vendors, open-core tools, and workflow platforms are all claiming some version of the same control plane. | High | SR002, SR003, SR007 |
| CR003 | Public disclosure is still thin on board composition, gross margin, burn, and retention, which keeps underwriting uncertainty elevated. | Medium | SR003, SR005 |
| CR004 | The company is leaning into shadow- or shady-AI narratives, but that also means it must prove that governance features actually reduce risk in production. | High | SR004, SR005 |
| CR005 | Partner-led growth is a strength, but it also introduces concentration risk if a handful of channels control a large share of revenue. | High | SR008, SR002 |
| CR006 | The Reddit community signal is weak and inaccessible, which suggests the public developer ecosystem is not yet a major moat. | Low | SR006 |
| CR007 | The DPA references certification materials, but the cache does not prove full current certification scope or audit recency. | Medium | SR005 |
| CR008 | A 2026 comparison article explicitly frames Tines as an enterprise-wide platform move, which raises the risk of feature sprawl and execution dilution. | Medium | SR002, SR001 |
| CR009 | Loss-making or reinvestment-heavy economics remain possible in 2025-2026, but the cache does not provide audited proof either way. | Low | SR003 |
| CR010 | If 3B materially improves AI-governed workflows, the risk profile improves; if it fails to land, the valuation multiple has less support. | High | SR001, SR004, SR002 |
| CR011 | The company still looks stronger on product ambition than on proof of long-term retention and margins. | Medium | |
| CR012 | The biggest mitigation is that Tines already has proven workflows, a deep story library, and partner proofs that can be reused as the platform expands. | High | SR004, SR008, SR002 |
| CR013 | Integration pages from Elastic and Cribl show Tines still sits inside the security stack and is easy to wire into adjacent observability and automation tools. | Medium | SR009, SR010 |
| CV001 | The Series C sets the anchor valuation at $1.125B, which is the most important current market reference point. | High | SV001, SV002, SV009 |
| CV002 | At about $85M of 2025 revenue, the implied valuation multiple is roughly 13x ARR / revenue-run-rate. | High | SV004, SV001, SV010 |
| CV003 | That multiple is defensible only if growth stays strong and the 3B expansion broadens the TAM beyond the original security niche. | High | SV005, SV006 |
| CV004 | Blue-chip investors and repeated follow-on funding support the valuation, but do not by themselves prove that the multiple is cheap. | High | SV001, SV002, SV003 |
| CV005 | Channel-led growth and partner leverage strengthen the thesis because they expand distribution without requiring all-customer direct sales. | Medium | SV006 |
| CV006 | Competitor pages and comparisons show that buyers also have lower-cost or open-core options, which caps pricing power. | Medium | SV007, SV008 |
| CV007 | Customer proof is strong enough to support a buy stance, but the current cache still lacks the retention and margin data that would justify a higher-confidence upgrade. | High | SV007, SV004 |
| CV008 | If 3B wins new enterprise workflows, the valuation can be defended more as a platform than as a niche security tool. | High | SV005, SV006 |
| CV009 | If the 3B transition stalls or Stories cannibalizes the old growth engine, the current multiple becomes materially harder to defend. | High | SV005, SV007 |
| CV010 | The most credible valuation watch item is not the headline multiple but whether retention, margin, and 3B adoption data improve over the next refresh. | High | SV004, SV006 |
| CV011 | Independent confirmation of NRR, gross margin, and burn is still missing, so the valuation case remains partially evidence-constrained. | Medium | |
| CV012 | A valuation haircut would likely be warranted if partner concentration or competitive pricing pressure worsens before 3B proves itself. | High | SV006, SV008 |
| ID | Publisher | Title | Quote |
|---|---|---|---|
| SO001 | Tines | About - Tines | Born in security, used by everyone. |
| SO002 | Tines | Introducing Tines 3B, the next generation of Tines | Tines 3B is our new, AI-native environment for every team's most important agents, apps and automations. |
| SO003 | Tines | Tines Secures $125M in Series C Financing Led by Goldman Sachs ... | Freedom to build. Complete security. No compromises. |
| SO004 | Goldman Sachs Alternatives | Tines Announces $50 Million in New Financing | valuing the company at $1.125 billion |
| SO005 | PR Newswire | Tines - 2026 Company Profile & Team | In fiscal year 2024, Tines' Annual Recurring Revenue (ARR) grew by over 100 percent |
| SO006 | Tracxn | [PDF] Vendor DPA (July 14, 2026) - Tines | Tines is a series C company based in Dublin (Ireland), founded in 2018 |
| SO007 | Silicon Republic | Tines | The secure environment for AI agents, apps and automation | Co-headquartered in Dublin and Boston, Tines offers the only workflow platform that delivers powerful automation and orchestration straight into the hands of any member of your organization. |
| SO008 | LeadIQ | Announcing our $125M Series C fundraise - Tines | Tines uses 8 technology products and services including Mixpanel, Pendo, Databricks, and more. |
| SO009 | Tines | About - Tines | more than 54% of its year-over-year revenue |
| SO010 | Tines Company Growth, Stability & Outlook 2026 | Introducing Tines 3B, the next generation of Tines | The company remained loss-making in the year ending January 31, 2025. |
| SM001 | Tines | Tines - a SOAR tool - What are your opinions? : r/cybersecurity | An intelligent workflow platform combines automation, AI, and integration into a single environment. |
| SM002 | Tines | Tines Company Overview, Contact Details & Competitors | LeadIQ | Born in security, built for the enterprise. Governance, guardrails, and monitoring across every surface. |
| SM003 | Tines | [PDF] Vendor DPA (July 14, 2026) - Tines | Tines 3B is our new, AI-native environment for every team's most important agents, apps and automations. |
| SM004 | Tines | Tines Company Growth, Stability & Outlook 2026 | The Tines Story Library contains hundreds of pre-built Stories covering security operations, IT, RevOps, and compliance. |
| SM005 | The New Stack | Tines Secures $125M in Series C Financing, Bringing Total ... | There is a sell-by date on low-code, no-code as a category. |
| SM006 | Tines | Tines | The secure environment for AI agents, apps and automation | |
| SM007 | Tines | Report: Tines Business Breakdown & Founding Story | without orchestration, AI stays fragmented |
| SM008 | Tracxn | Irish 'soonicorn' Tines raises $50m for workflow automation | The company has 96 active competitors |
| SM009 | Built In | Tines - a SOAR tool - What are your opinions? : r/cybersecurity | Strengths in capital access, revenue trajectory, and partner-enabled scale are accompanied by ongoing losses. |
| SP001 | D3 Security | [Hiring] Senior Customer Success Manager @Tines - Remotive | The best Tines alternative in 2026 depends on one question: who writes the investigation? |
| SP002 | Tracecat | Inner Pack - 11 Tines - Brinly Parts | Tracecat is open source under AGPL-3.0 with commercial Enterprise modules. |
| SP003 | SynapCores | [PDF] Vendor DPA (July 14, 2026) - Tines | per analyst seat — no per-action tax |
| SP004 | Tracxn | Tines Company Growth, Stability & Outlook 2026 | The company has 96 active competitors, including 11 funded and 3 that have exited. |
| SP005 | Tines | Tines Secures $125M in Series C Financing, Bringing Total ... | Intercom's IT team had partial automation through Workato, but pricing limited what they could build. |
| SP006 | Sim AI | Tines | The secure environment for AI agents, apps and automation | Tines remains centered on workflows and governance rather than a general AI workspace. |
| SP007 | Built In | Report: Tines Business Breakdown & Founding Story | Weak Market Position & Pricing Challenges |
| SP008 | Tines | Irish 'soonicorn' Tines raises $50m for workflow automation | Tines 3B is our new, AI-native environment for every team's most important agents, apps and automations. |
| SP009 | Tines | [Hiring] Senior Customer Success Manager @Tines - Remotive | Built for your most important workflows. Trusted by the world’s most ambitious organizations. |
| SI001 | Goldman Sachs Alternatives | Accel and Index back Tines, as the cybersecurity startup ... | valuing the company at $1.125 billion |
| SI002 | PR Newswire | Tines Revenue 2025: $85M ARR, $1.1B Valuation - LATKA | bringing the total capital raised by Tines to $272 million |
| SI003 | PR Newswire | Tines - 2026 Company Profile, Team, Funding, Competitors ... | In fiscal year 2024, Tines' Annual Recurring Revenue (ARR) grew by over 100 percent |
| SI004 | Tracxn | The 10 Best Tines Alternatives in 2026: Agentic SOC ... | Tines has raised a total of $272M over 6 funding rounds |
| SI005 | GetLatka | [PDF] Vendor DPA (July 14, 2026) - Tines | Tines generated $85M in revenue in 2025. |
| SI006 | Channel Insider | Tines | The secure environment for AI agents, apps and automation | partners, including Guidepoint Security, Optiv, Trace3, Thundercat, and SHI drove more than 54% of its year-over-year revenue |
| SI007 | Tines | Tines Company Growth, Stability & Outlook 2026 | 2025 was the most successful year in Tines' history. |
| SI008 | Tines | Tines Secures $125M in Series C Financing, Bringing Total ... | Freedom to build. Complete security. No compromises. |
| SI009 | Built In | Accel and Index back Tines, as the cybersecurity startup ... | The company remained loss-making in the year ending January 31, 2025. |
| SE001 | Tines | "There is a sell-by date on low-code, no-code": What Tines ... | Freedom to build. Complete security. No compromises. |
| SE002 | Tines | TINES - Time Integration, Newton and Eigen Solver | Tines 3B is our new, AI-native environment for every team's most important agents, apps and automations. |
| SE003 | The New Stack | Tines | The secure environment for AI agents, apps and ... | Once generated, each workflow step becomes code that runs in its own ephemeral Docker container. |
| SE004 | SiliconANGLE | Sim vs Tines | Sim, the AI Workspace | the hard part isn't building software anymore, it's making it safe to build, run and govern AI-generated workflows, applications and agents |
| SE005 | Tines | Tracecat vs Tines: Which is best for AI security automation? | information security questionnaire, or summaries of industry certifications (e.g., ISO 27001, SOC 2) |
| SE006 | [PDF] Vendor DPA (July 14, 2026) - Tines | You've been blocked by network security. | |
| SE007 | Tracecat | Tines Company Growth, Stability & Outlook 2026 | Tines keeps story versions and change control inside the product. |
| SE008 | Tines | Tines Secures $125M in Series C Financing, Bringing Total ... | The Tines Story Library contains hundreds of pre-built Stories covering security operations, IT, RevOps, and compliance. |
| SU001 | Tines | Tines seeks to tame 'wild code' AI sprawl | The Tines Story Library contains hundreds of pre-built Stories covering security operations, IT, RevOps, and compliance. |
| SU002 | AWS | Tines expands partner ecosystem to power intelligent ... | Tines, an AWS Security Competency Partner, is an intelligent workflow platform. |
| SU003 | Wiz | Tines Partnership: Better Together | The combination of Wiz and Tines has allowed us to identify and remediate security issues. |
| SU004 | Channel Insider | Tines Targets Partner-Led Growth in North America | more than 54% of its year-over-year revenue |
| SU005 | Material Security | [PDF] Vendor DPA (July 14, 2026) - Tines | Why would I spend hours or days writing custom code when I can build a Story in Tines... |
| SU006 | Tines | Tines | The secure environment for AI agents, apps and automation | The company said collaborations with partners... drove more than 54% of its year-over-year revenue. |
| SU007 | SiliconANGLE | Tines Company Growth, Stability & Outlook 2026 | over 500 employee-built apps, agents, and automations have gone live |
| SU008 | Tines | 7 Intelligent Workflow Examples from Enterprise Teams - Tines | We tripled our enterprise customer base. |
| SU009 | Built In | Tines seeks to tame 'wild code' AI sprawl | The company remained loss-making in the year ending January 31, 2025. |
| SR001 | The New Stack | Accelerating security response with Tines and AWS Security Hub | There is a sell-by date on low-code, no-code as a category. |
| SR002 | D3 Security | Unleashing the Power of No-Code Automation for Cloud Security ... | Tines’s 2026 launch is aimed at every employee in the enterprise. |
| SR003 | Tracxn | How to migrate your data from a legacy ticketing system to Tines ... | The company has 96 active competitors |
| SR004 | Tines | Tines Integration - Elastic | We call this phenomenon wild code |
| SR005 | Tines | Leveraging Tines and Cribl Search for Security Automation | summaries of industry certifications (e.g., ISO 27001, SOC 2) |
| SR006 | [PDF] Vendor DPA (July 14, 2026) - Tines | You've been blocked by network security. | |
| SR007 | Tracecat | Tines | The secure environment for AI agents, apps and automation | Tines pricing is modular. |
| SR008 | Channel Insider | Tines Company Growth, Stability & Outlook 2026 | more than 54% of its year-over-year revenue |
| SR009 | Elastic | Accelerating security response with Tines and AWS Security Hub | Tines makes data, including logs, related to use and configuration of a Tines tenant available via a REST API. |
| SR010 | Cribl | Unleashing the Power of No-Code Automation for Cloud Security ... | Learn how to use Cribl Search and Tines together to automate the enrichment of security alerts. |
| SV001 | Goldman Sachs Alternatives | Tines raises $125m to accelerate AI-powered workflow ... | valuing the company at $1.125 billion |
| SV002 | PR Newswire | Tines Raises $125 Million in Series C - thesaasnews.com | bringing the total capital raised by Tines to $272 million |
| SV003 | Tracxn | Announcing our $125M Series C fundraise | Tines has raised a total of $272M over 6 funding rounds |
| SV004 | GetLatka | New unicorn from Ireland: Next-gen AI automation startup ... | Tines generated $85M in revenue in 2025. |
| SV005 | Tines | Tines - 2026 Funding Rounds & List of Investors - Tracxn | 2025 was the most successful year in Tines' history. |
| SV006 | Channel Insider | [PDF] Vendor DPA (July 14, 2026) - Tines | more than 54% of its year-over-year revenue |
| SV007 | D3 Security | Tines | The secure environment for AI agents, apps and automation | Tines has real customers running real operations, a 4.7 G2 rating, and a builder experience reviewers consistently love. |
| SV008 | Tracecat | Tines Company Growth, Stability & Outlook 2026 | Tines pricing is modular. |
| SV009 | Fintech Global | Tines raises $125m to accelerate AI-powered workflow ... | secured $125m in a Series C round, bringing its valuation to $1.125bn |
| SV010 | The SaaS News | Tines Raises $125 Million in Series C - thesaasnews.com | raised $125 million in Series C funding, bringing its valuation to $1.125 billion |