Torq AI SOC Platform

My main use case for Torq is for security incident management and automation around it. I use it to streamline my alerts, investigate security incidents, and automate repetitive tasks across my security tools. When a SIEM alert is triggered, Torq can automatically collect the relevant information from connected systems, enrich the alert, and create a case for investigation.

A specific example of how Torq helped automate one of those repetitive tasks and improved my incident management process is when a suspicious security alert was triggered in my SIEM. Torq automatically collected the relevant information, connected the security tools, and enriched the incident. It gathered details about the affected user or machine and summarized the findings to create a case for the SOC team, so the manual switching between multiple tools is reduced and I can investigate the alert more quickly and efficiently.

The specific challenges in my SOC that led me to consider changes before implementing Torq included a high volume of security alerts, repetitive manual triage, and the time spent on collecting manual information. Alert fatigue was another concern as analysts needed to prioritize genuine threats while managing routine alerts. I searched for a solution that could automate repetitive tasks, improve incident visibility, streamline case management, and allow my security team to focus more on high-priority threats.

The impact that Torq has created on my organization is mainly positive, focusing on improving security operations efficiency and reducing the manual effort on incident management. Its automated workflows help streamline alert triage and investigation while integrating multiple security tools. When security alerts are generated, Torq helps me connect and organize relevant information in one place, making it easier for my team to investigate and respond.

I have noticed a meaningful reduction in manual effort since Torq introduced the automation workflows. Tasks that previously required an analyst to manually collect information from multiple security tools can now be handled automatically.

From my perspective, Torq's unified platform approach to AI-driven SOC automation and case management offers a clear advantage over managing multiple point solutions across the security stack. Having automation, AI-driven alert triage, and case management in one platform helps reduce tool switching and makes incident handling more streamlined. Additionally, it improves visibility by bringing relevant security data together in a single window or task workflow. Managing separate tools can create challenges and requires extra manual effort to coordinate investigations, but Torq helps reduce that complexity and automate repetitive tasks. The main benefit I feel from my experience is improved operational efficiency.

Torq's agentic AI capabilities can help increase my alert handling capacity by automating repetitive investigations and reducing the recurring manual workload on my SecOps analysts. When my SIEM generates a suspicious alert, Torq gathers relevant information from connected security tools and enriches the alert with additional context, summarizing the findings for the analysts. This allows my team to process alerts more efficiently by focusing on high-priority and complex incidents. I know where the alert originates, which helps reduce the time spent switching between tools. Human validation is still important, but I view agentic AI as a valuable means to improve analyst productivity and handle a higher volume of alerts without proportionally increasing manual effort.

The measurable security outcomes that matter most to my leadership team are reduced mean time to respond (MTTR) and incident resolution rates. The faster I respond, the more effective I am viewed by leadership. Additionally, reducing false positives is crucial. Torq helps demonstrate SOC impact by automating repetitive investigation tasks, enriching alerts, and providing relevant context. Analysts can spend less time collecting information manually and focus more on high-priority threats.

Torq has changed the day-to-day experience for my security analysts by making their workload more manageable and enhancing how they feel about their job. The depth of the automation I achieve depends on the available integrations and how effectively I configure the workflows. Torq has the potential to make analysts' day-to-day experiences more manageable by reducing manual repetitive tasks and simplifying alert investigations.

Analysts can now spend less time gathering information from multiple tools and no longer need to manually gather information or enrich alerts and create cases because Torq handles it for them. This allows them to focus on more complex threats and engage more fully in their security analyses. From an operational perspective, automation improves consistency and helps my team handle more alerts efficiently, but human oversight is always required.

Using Torq's agentic AI reduces stress levels for my SecOps staff as it takes over repetitive alert triage and assists in investigating tasks that contribute to alert fatigue. By automatically gathering context and enriching alerts, analysts can now prioritize complex or high-priority alerts and complete their work earlier than before.

The best features Torq offers are essential for my operations.

The most valuable features of Torq for me are its drag-and-drop workflow automation, extensive integrations, and AI-powered alert summaries. The drag-and-drop interface makes it easier to build customized security workflows without having to create everything from scratch. I find its SIEM, EDR, and other security tools very useful because they centralize the incident information. Additionally, the AI summarizes quickly so that I understand the alerts quickly and can prioritize my investigation. Overall, these features reduce manual effort and make security operations more efficient.

I would like to highlight the flexibility of Torq's workflow customization and its ability to automate complex and multi-step security processes.

Regarding Torq's AI capabilities, I think they have a promising approach to governance and security. The ability to automate security investigations while maintaining control over workflows is valuable. I believe proper access controls, data privacy, and human oversight are required.

Regarding Torq's AI capabilities, I find them trustworthy when it comes to summarizing security alerts and supporting investigations. I find the output generally helpful when prompts are clear and relevant data is available. However, AI-generated findings are not always completely accurate. I believe analysts should validate important recommendations to ensure clarity on whether the AI provides a proper response. Overall, its AI capabilities are valuable for reducing manual effort and requiring human oversight, which I trust.

When I compare Torq to other tools, I find that it has the ability to automate triage, investigation, and response across different security tools, which is one of its key strengths. Torq can bring together information from endpoint, identity, cloud, and IT security systems to enrich alerts and support coordinated workflows.

For example, when I get a suspicious alert from an endpoint, a workflow can gather related identity and device information, enrich the incident, and initiate appropriate response actions based on predefined conditions. Compared to traditional point solutions, Torq offers greater flexibility in connecting tools and orchestrating end-to-end processes. I find its unified workflow approach very valuable for reducing manual coordination between teams and platforms.

Torq can be improved mainly around emerging cloud security platforms and newer technology. I would like to see more pre-built playbooks for common security incidents, which would make automation easier to implement. AI capabilities could be enhanced with more accurate investigation recommendations, and there should be better explanations on the UI. Additionally, improved customization for case filtering, customizable dashboards, and more detailed case filtering would be helpful.

I would appreciate broader integration support for cloud security tools, along with more flexibility when connecting to third-party APIs. Sometimes, integrating a new tool requires additional workflows, so more ready-to-use connectors would be helpful. From a support perspective, detailed troubleshooting documentation, practical implementation examples, and faster guidance for complex integration issues would enhance the overall experience. These improvements would make it easier for teams to adapt to Torq and utilize more advanced automation tools.

I have been using Torq for more than nine months.

Torq is pretty stable.

Torq's scalability depends on the organization's architecture and how it wishes to scale. Torq's scalability is a notable strength, as its workflow-based automation allows expansion from managing a few repetitive security tasks to handling more complex and high-volume SOC operations.

Customer support for Torq is good. On a scale of 1 to 10, I would rate Torq's customer support at eight out of 10.

Torq is deployed in my organization on-premises.

It did not take long to realize value with Torq. AI-generated findings still need human validation, so the goal is not to eliminate analyst responsibility but to reduce unnecessary effort and help my team work more effectively. I realized value from Torq relatively quickly once the initial integrations and workflows were configured. The first benefits arose from automating the repetitive alert triage.

I would not say I have seen significant improvement on investment, but I will definitely say analyst productivity has improved. Rather than engaging in manual efforts, I now utilize tools to assist in my work. However, this has not significantly affected overall costs.

Comparing pricing, setup cost, and licensing for Torq reveals that its value needs to be assessed against the operational efficiency and reduction in manual effort it provides. It is not overly expensive, and while the initial setup requires some investment in integration and workflow configuration, the platform's flexibility makes the implementation worthwhile over time. Licensing costs vary based on the organization's needs, usage, and the scale of deployment within the organization's architecture.

I would rate Torq at six out of 10. I choose six because Torq offers strong security automation, flexible workflow creation, and valuable integration that helps reduce manual effort in incident handling. Its AI-powered capabilities and centralized case management also make security operations more efficient. I would rather rate it higher because there is still room for improvement in coverage, integration coverage, AI accuracy, workflow usability, and reporting. Overall, Torq is a powerful platform that delivers significant value to security teams.

I would advise others looking into using Torq to analyze its capabilities before making a purchase. They should test it on alert triage, automation of alerts, and workflow management. Once they find it suitable for their architecture, they can proceed with the purchase.