Torq
Torq sells an AI SOC platform with triage, investigation and response, and states that every verdict, decision, exception and override is captured. It places seventh of 14 at 5.74, with 13 of 25 containment actions documented. It publishes no time-to-contain figure with a method and no price.
What Torq is
Torq describes an AI SOC platform whose products include Auto Triage, HyperAgents, Socrates, Case Management and Hyperautomation (torq.io, read 2026-11-03, vendor claim). Response runs fully autonomously or with a human on the loop, and the page cites a manual override.
The integrations page shows named tools, 30 on its first screen, with no total count. Customers are published as case-study headlines. All metrics in them are customer or vendor statements with no method.
vendor claim AI SOC platform that uses agentic AI to triage, investigate and respond to threats. Products include Auto Triage, HyperAgents, Socrates, Case Management and Hyperautomation. torq.io, read
Products named: Socrates, Torq HyperAgents, Auto Triage, Case Management, Hyperautomation, Agentic Builder (launched March 2026), Torq SOC Brain self-learning layer (launched July 2026).
no figureon the pages read
Published time to contain
| Figure | Metric | Sample and who measured | Grade | Source |
|---|---|---|---|---|
| Global pharma customer cuts MTTR by 92 percent | time to respond or remediate | one customer, details not read. Measured by vendor-published customer story. Date: not stated. | C | vendor claim torq.io, read |
None of these is a time to contain, so the home table shows an open bar. Grades run A (independent, method published) to D (unverifiable). The evidence register explains each grade.
13 of 255 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Torq documents 13 as native or partner on the pages read: 13 native, 0 partner, 0 custom step only, 12 not documented. Coverage share is 52 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Torq13 of 25 documented | Torq: Kill process, not documented | Torq: Quarantine file, not documented | Torq: Remove from group or role, not documented | Torq: Quarantine a delivered message, not documented | Torq: Block sender or domain, not documented | Torq: Remove a URL rewrite exemption, not documented | Torq: Pull from quarantine, not documented | Torq: Revoke cloud session, not documented | Torq: Revoke OAuth app consent, not documented | Torq: Block IP or domain at the firewall, not documented | Torq: Disable a switch port or NAC quarantine, not documented | Torq: Add to a threat list on the NDR, not documented | |||||||||||||
Basis: Torq knowledge base integration articles and its published workflow templates. Integration articles list only the first few steps by name and then say '+N more', so the step catalogue is not fully readable. Workflow templates are Torq-published and count as native. Read 2026-11-03.
Limits: Step catalogue is partly hidden behind '+N more'. Scores for actions only seen as absent may understate coverage.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
5.74rank 7 of 14
Rubric scores
Torq is in a band with Cyware (6.11), Google Security Operations (6.09), Palo Alto Cortex XSOAR (5.91), Swimlane (Turbine) (5.84), Splunk SOAR (Cisco) (5.79), Tines (5.62). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 5.9 | 1.475 | partial. 13 of 25 containment actions documented as native or partner (52 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 4.0 | 0.600 | not documented. Page says "Slash mean time to respond" with no figure; a separate vendor claim of closing over 90 percent of cases autonomously is a closure rate, not a containment time. vendor claim torq.io, read |
| Approval, rollback and blast-radius controls documented | 15 | 6.5 | 0.975 | partial. Page says response runs fully autonomously or with human-on-the-loop oversight and cites a manual override; no tiers, rollback or scope limit. vendor claim torq.io, read |
| Explanation and audit trail | 15 | 8.0 | 1.200 | documented. Page says "Transparent audit logs" and "Every verdict, decision, exception, and override is captured with surrounding context of when and why", though stated for triage. vendor claim torq.io, read |
| Integration depth documented | 10 | 7.0 | 0.700 | partial. The Torq page read gives no count; a secondary read of Torq pages reports 300 integrations and 4,000+ steps, which needs a primary check. secondary source torq.io, read |
| Detection-to-response coupling | 8 | 5.0 | 0.400 | partial. Page describes de-duplicating "unprocessed events" but does not say whether a SIEM is required. torq.io, read |
| Pricing transparency | 6 | 3.0 | 0.180 | not documented. No price on the page; a secondary read recorded the pricing URL as a 404 on 2026-10-11. torq.io, read |
| Deployment and data handling | 6 | 3.5 | 0.210 | not documented. Deployment options are not stated; AI governance and data governance pages are linked but were not read. torq.io, read |
| Total | 100 | 5.74 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Torq is strong
- Vendor claim: the page says every verdict, decision, exception and override is captured with the context of when and why, and calls its logs transparent audit logs. The wording is about triage, not specifically about containment. torq.io, read
- Vendor claim: response runs fully autonomously or with human-on-the-loop oversight, and the page cites a manual override. That names the control, though not its tiers. torq.io, read
- Torq announced a USD 140 million Series D at a USD 1.2 billion valuation on 2026-01-12, per a Business Wire headline listed on its news index. The release page returned 403 to a direct read. businesswire.com, read
Where Torq is behind
- Time-to-contain evidence: none with a method. The page says to slash mean time to respond with no figure. A case-study headline says a global pharma customer cut MTTR by 92 percent, with no baseline, period or method. torq.io, read
- Autonomous or human-on-the-loop response is named without tiers, rollback or a scope limit, so a reader cannot see how a single bad action is bounded or undone. torq.io, read
- No price is published: the pricing path returned 404 on 2026-11-03. Deployment options are not stated, and the AI governance and data governance pages it links were not read. torq.io, read
What only Torq has
Torq announced the acquisition of Jit, a context-graph company, on 2026-05-19, and the price was not disclosed. torq.io, read
nonelisted
Pricing as published
vendor claim No public price list. The /pricing path returns 404 on the read date. torq.io, read
Integrations. No count published; named: 1Password, Abnormal AI, Abnormal Security, Abstract Security, AbuseIPDB, Adaptive Shield, AlienVault OTX, Anomali ThreatStream, Anthropic Claude, Anvilogic, ANY.RUN, Apiiro, Aqua, Armis. vendor claim torq.io, read
9names on its pages
Named customers
Customers below are names on Torq's own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- Valvoline, FICO, Check Point, RSM, Lennar, BigID, Deepwatch, Kenvue, HWG Sababa. torq.io, read
9dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2026-01-12 | Series D: $140 million at a $1.2 billion valuation. Series D round announced on Business Wire. Lead investor and total funding are stated in the release (not read: release returned 403); the Torq news index lists the same release. | vendor claim businesswire.com, read |
| 2026-05-19 | Torq acquires Jit, AI context graph company. Torq acquired Jit (Boston) to add an AI context graph that informs investigations with identities, roles, privileges and data sensitivity. Price not disclosed. | vendor claim torq.io, read |
| 2026-03 | Agentic Builder launch. Launch of Agentic Builder for AI-driven security workflows. Date from the news index (March 18 to 24, 2026 items). | vendor claim torq.io, read |
| 2026-05 | SilverSky strategic partnership. Strategic partnership announced with SilverSky. Date from the news index (May 27 to 28, 2026). | vendor claim torq.io, read |
| 2026-06 | Britive joins Torq AMP. Partner joins the Torq AMP agentic SecOps programme. Date from the news index (June 29, 2026). | vendor claim torq.io, read |
| 2026-07 | Criminal IP threat intelligence partnership. Threat intelligence partnership with Criminal IP. Date from the news index (July 13, 2026). | vendor claim torq.io, read |
| 2026-07 | SOC Brain self-learning layer. Launch of SOC Brain, a self-learning layer that learns from analyst decisions. Date from the news index (July 27 to 28, 2026). | vendor claim torq.io, read |
| 2026-09 | Merlin partnership for federal AI SOC modernisation. Named partner in the Merlin federal AI SOC modernisation programme. Date from the news index (September 8 to 10, 2026). | vendor claim torq.io, read |
| 2026-10 | Torq REV channel programme. Channel partner programme announced. Date from the news index (October 8 to 9, 2026). | vendor claim torq.io, read |
7graded
Claims Torq makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| Valvoline saves 7 analyst hours a day | one customer. Measured by customer. | C | vendor claim torq.io, read |
| Global pharma customer cuts MTTR by 92 percent (unnamed) | one customer (unnamed). Measured by customer. | C | vendor claim torq.io, read |
| RSM automates 82 percent of global MSSP customer cases | RSM global MSSP customer cases. Measured by customer. | C | vendor claim torq.io, read |
| FICO builds automations 99.4 percent faster with Torq | one customer. Measured by customer. | C | vendor claim torq.io, read |
| BigID increases SecOps efficiency by 10 times | one customer. Measured by customer. | C | vendor claim torq.io, read |
| Unnamed real estate firm saves 1,000 hours and $120,000 in Q1 | one customer (unnamed). Measured by customer. | C | vendor claim torq.io, read |
| Unnamed money transfer platform gets 30 percent time savings through auto-remediation | one customer (unnamed). Measured by customer. | C | vendor claim torq.io, read |
Who should shortlist Torq
- You want a per-decision capture of verdicts, exceptions and overrides stated in vendor material.
- You want a vendor with large funding and a long customer list, and will test its numbers in a pilot.
- You run a services business and want a platform that publishes MSSP-type customers such as RSM.
Torq places 7th of 14 at a total of 5.74, with 13 of 25 containment actions documented. A fit where capturing every decision matters, with 13 of 25 containment actions documented. It shares a band with Cyware, Google Security Operations, Palo Alto Cortex XSOAR, Swimlane, Splunk SOAR and Tines, so the order inside it is not settled by the evidence.
The same platform under other weights
- Regulated financial: 4th of 14, total 6.09.
- Lean team: 8th of 14, total 5.43.
- MSSP: 8th of 14, total 5.62.
- Microsoft estate: 8th of 14, total 5.52.
- CrowdStrike estate: 8th of 14, total 5.59.
Compare Torq
- Torq alternatives: 3 gaps and 5 platforms that answer them.
- Torq against Splunk SOAR (Cisco), totals 5.74 and 5.79.
- Torq against Swimlane (Turbine), totals 5.74 and 5.84.
- Torq against Tines, totals 5.74 and 5.62.
- Torq against Palo Alto Cortex XSOAR, totals 5.74 and 5.91.
Facts on this page were read 2026-11-03 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.