Sold by: Torq
Deployed on AWS
Torq is the AI SOC platform that combines agentic insights and automation so that enterprises can triage, investigate, and respond to actual risks, faster. Torq streamlines every step from alert through resolution. The platform analyzes your risk context to identify your biggest threats. Working alongside your SecOps staff, the Torq platform integrates with your security stack to facilitate containment and remediation workflows.
4.8
Overview
Torq is the AI SOC platform that combines agentic insights and automation so that enterprises can triage, investigate, and respond to actual risks, faster. Torq streamlines every step from alert through resolution, expanding capacity and throughput. First, Torq ingests and normalizes telemetry from across your security stack, preparing the data for agentic reasoning at scale. Auto Triage filters out noise and prioritizes actual threats. Next, cases are automatically opened and assigned to highly specialized AI agents designed for investigation and response. Using tools and actions you specify, they gather evidence, assemble timelines, and transparently record decisions and authorized actions. Your team is in complete control. With Torq, your SOC delivers more results, more efficiently, from triage through remediation. Torq customer base includes major multinational enterprises such as Chipotle Mexican Grill, Informatica, Kyocera, Lego, Macys, Marriott, Prudential, Siemens, Telefonica, Uber, Valvoline, Virgin Atlantic, and Wiz.
Highlights
- Torq is the AI SOC platform transforming how enterprises manage risk. By combining agentic reasoning, case management, and automation, Torq manages the entire threat lifecycle, from triage through remediation. Torq augments your SecOps staff, working under their control and with complete transparency to offload basic, repetitive tasks. The Torq AI SOC Platform streamlines SecOps by expanding operational capacity, focusing staff on prioritized risks, and reducing MTTI and MTTR at scale.
- With Torq at the heart of their agentic SOC, enterprise security leaders dramatically reduce the noise entering the SOC. They prioritize real risk through agentic analysis of their own environment and context. And they accelerate every investigation, containment, and remediation action across the security stack. The results are measurable: customers commonly see a 60x increase in SOC throughput and velocity, and a 90%+ reduction in Mean Time to Respond (MTTR).
- "Our vision of the agentic SOC is delivered through one unified Torq platform. Auto Triage cuts noise, separating true positives from false and malicious from benign. HyperAgents™ are customizable AI agents your team directs. Case Management holds evidence, timelines, and summaries in one source of truth. Socrates™ is the agentic captain, coordinating agents to manage cases autonomously via natural language. Torq Hyperautomation™ turns recommendations into action across your security stack."
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Torq Essential | Essential Plan | $450,000.00 |
Torq Enterprise | Enterprise Plan | $450,000.00 |
Torq Elite | Elite Plan | $450,000.00 |
Dimensions summary
You buy the Torq AI SOC Platform through a contract that bills by units. Three plan levels are available: Torq Essential, Torq Enterprise, and Torq Elite. These form a tiered structure, letting you pick the level that matches your security operations needs. Within each plan, you choose the number of units, so the total cost scales with the quantity you commit to. All three plans use the same unit-based billing model and share the same term. The plan you select determines the scope of platform capabilities included.
Top-of-mind questions for buyers
All three plans bill by units under the same contract term. The plan you pick sets the scope of platform capabilities you can access. Higher plans expand what is included. To confirm which specific features fall under each plan level, contact the vendor, since the pricing table does not detail per-plan feature splits.
The plans bill by units, and you choose the quantity you commit to. The available data does not define what a single unit maps to, such as an agent, workspace, case, or seat. Contact the vendor to confirm the exact unit definition before committing to a quantity.
You select the number of units within your chosen plan, and the total scales with that committed quantity. Cost is driven by two factors together: the plan level you pick and the unit count under it. Adding units raises the total; the plan level sets the capability scope.
torq.io
Helpful?
Vendor refund policy
Please contact us at sales@torq.io
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
https://support.torq.io support@torq.io . By purchasing, deploying, accessing, or using this product, you agree to comply with the AWS Marketplace Standard EULA, and the terms of applicable open source software licenses bundled with the product. In addition, if you elect to use any artificial intelligence (AI) features made available by Torq as part of the product, the Torq AI Terms shall govern your use thereof. Pursuant with the Data Processing Addendum, you authorize the engagement of the sub processors listed at: https://torq.io/legal/subprocessors/ , as may be updated by Torq from time to time.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Torq
By Trellix
By Deepwatch
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Telemetry Ingestion and Normalization
Ingests and normalizes telemetry from across the security stack, preparing data for agentic reasoning at scale.
Automated Alert Triage
Auto Triage filters out noise and prioritizes actual threats by analyzing risk context to identify biggest threats.
Specialized AI Agent Investigation
Deploys highly specialized AI agents designed for investigation and response that gather evidence, assemble timelines, and record decisions and authorized actions.
Unified Case Management
Maintains centralized case management that holds evidence, timelines, and summaries as a single source of truth for threat lifecycle tracking.
Security Stack Integration and Automation
Integrates with security stack tools and actions to facilitate containment and remediation workflows through hyperautomation capabilities.
Multi-Source Threat Data Integration
Correlates and ingests security data from Trellix Security Platform and over 500 third-party tools including 13 AWS integrations to create unified threat visibility across the security stack.
AI-Driven Detection and Alert Triage
Applies artificial intelligence-driven analytics and automated alert triage to prioritize threats and provide GenAI-powered insights for threat investigation and remediation guidance.
No-Code Automation for Investigation and Response
Provides UI-driven, point-and-click automation capabilities to offload repetitive security operations tasks and accelerate investigation and response workflows.
Pre-Built Analytics and Correlation Rules
Utilizes pre-built analytics and correlation rules to rapidly correlate multi-vector threat detections and reconstruct complete attack narratives from ingested security events.
Hybrid and Air-Gapped Deployment Support
Supports deployment across cloud, hybrid, and air-gapped environments with flexible integration architecture for diverse infrastructure configurations.
Alert Prioritization Engine
Patented Dynamic Risk Scoring alert engine for precise threat identification and response prioritization
Security Monitoring Coverage
24x7x365 monitoring and managed detection & response across multiple security domains including endpoint detection, vulnerability management, and firewall management
SOC Technology Integration
Curated integration with industry-leading SOC technologies including AWS and Splunk tools through the Deepwatch Security Center
Security Posture Assessment
Proprietary Security Index providing quantitative analysis and industry benchmarking for security program maturity evaluation
Threat Hunting Capability
Proactive threat hunting services to identify and remediate security threats across the attack surface
Standard contract
No
No
No
Customer reviews
Sarfaraz Z.
Torq AI SOC Streamlines Incident Investigations with AI-Driven Automation
Reviewed on Oct 16, 2026
Review provided by G2
What do you like best about the product?
The automated incident investigation workflow is the most useful part of the Torq AI SOC platform for me. In network security, manually correlating suspicious IP traffic with firewall alerts and IDS events can be very time-consuming, especially when you’re trying to keep the investigation organized. Torq’s AI-driven approach helps bring these pieces together into a more structured workflow. For example, when I’m investigating suspicious inbound traffic, it’s very convenient to track the source IP, relevant network logs, and firewall findings within a single case view. Runbook automation, along with real-time incident updates, also helps keep the investigation moving in a clear, consistent direction. Overall, this workflow feels practical for cutting down on repetitive tasks while staying focused on the security incidents that matter most.
What do you dislike about the product?
There can be a bit of a learning curve when setting up complex workflows, especially when multiple security tools and conditional actions are involved. When a workflow runs into an error, it may take extra time to pinpoint the exact step that failed and then troubleshoot it. For beginners in particular, more ready-made network security templates, along with clearer and more detailed debugging information, would make the configuration process easier.
What problems is the product solving and how is that benefiting you?
Torq helps streamline repetitive network security investigation tasks. Activities like checking suspicious IP addresses, correlating firewall and IDS alerts, documenting incident findings, and coordinating remediation steps can be brought into a single, organized workflow. This makes it easier to maintain context across different security events and can potentially reduce the time spent on manual investigation. I find the automated runbook approach especially useful because it supports a consistent response process while keeping key incident details accessible in one place.
Gulsan P.
Autonomous threat enrichment and SOC workflow hyper-automation
Reviewed on Oct 14, 2026
Review provided by G2
What do you like best about the product?
What makes Torq AI an essential tool for SOC analysts is its seamless fusion of generative AI with event-driven security orchestration. When high-volume security signals enter our queue, Torq automatically executes complex enrichment playbooks in parallel. It queries threat intelligence feeds, parses raw nested logs, sandboxes suspicious URLs, and correlates indicators without requiring human intervention. The platform’s flexible ChatOps integration lets us build interactive Slack and Teams prompts with embedded action buttons, allowing tier-2 analysts to approve host isolations or account suspensions with a single click while maintaining full governance.
What do you dislike about the product?
Navigating and debugging expansive visual workflows with dozens of nested conditional branches can become visually dense. When an upstream security tool alters its REST API schema or token authentication scheme, identifying which specific action block failed inside a multi-tier playbook requires stepping through granular JSON execution traces. Additionally, mastering Torq’s advanced data transformation syntax (such as inline JSON path filters) requires initial practice for junior analysts who aren't as accustomed to raw API payload structures.
What problems is the product solving and how is that benefiting you?
Torq AI solves the acute issue of alert fatigue and high Mean Time to Respond (MTTR). Prior to deploying Torq, our SOC spent substantial time manually copying IP addresses, file hashes, and user logs between disjointed security consoles to investigate false positives. Torq automates this entire pre-triage lifecycle, delivering fully enriched, context-rich alerts directly to our ticketing system. This drastically cuts down initial response times and empowers our team to focus on active threat hunting rather than mundane administrative tasks.
Phanith V.
AI-Driven Workflows and Integrations That Could Transform SOC Efficiency
Reviewed on Oct 14, 2026
Review provided by G2
What do you like best about the product?
I’m exploring how the Torq AI SOC Platform can help automate security operations, reduce alert fatigue, and strengthen incident investigation and response. Its AI-driven workflows and integration capabilities are especially interesting to me as potential ways to improve SOC efficiency and cut down on manual effort. I’d like to better understand how it can complement my existing SIEM and EDR tools, and where it fits into the overall workflow alongside them.
What do you dislike about the product?
One potential challenge with Torq AI SOC Platform is that configuring automation workflows and integrating multiple security tools may require initial technical expertise. Complex workflows can also take time to design, test, and troubleshoot. Additionally, teams may need time to understand how to customize automation to their specific SOC requirements. Improved documentation and beginner-friendly workflow templates could make the onboarding process easier.
What problems is the product solving and how is that benefiting you?
Torq AI SOC Platform addresses challenges such as alert fatigue, repetitive manual investigations, and time-consuming incident response workflows. Its automation capabilities help streamline security operations, improve incident triage, and coordinate response activities across security tools. This can help SOC teams reduce manual effort, improve operational efficiency, and focus more on investigating high-priority threats rather than repetitive tasks.
Kirpalsinh R.
Automated security workflows and multi-step alert triage
Reviewed on Oct 14, 2026
Review provided by G2
What do you like best about the product?
Manual triage is our primary bottleneck. Torq AI is an exceptional hyper-automation platform that seamlessly bridges our security stack. By leveraging its intuitive no-code/low-code workflow builder combined with embedded AI capabilities, we can instantly orchestrate complex incident response playbooks. When an alert fires from our SIEM or endpoint detection tools, Torq automatically queries threat intelligence APIs, extracts IOCs, sandboxes suspicious attachments, and enriches the incident ticket within seconds. The platform's flexibility allows us to build custom human-in-the-loop approval steps directly into Slack, ensuring we maintain oversight without slowing down initial containment.
What do you dislike about the product?
While the visual workflow designer is powerful, managing complex conditional branching and error-handling loops across dozens of integrated SaaS tools can become cluttered. If an upstream API provider changes their schema or rate-limits our requests unexpectedly, debugging the exact execution step inside a large, nested workflow requires digging through granular execution logs. Additionally, onboarding junior analysts to write and maintain these automations requires a solid understanding of JSON path filtering and API payload structures.
What problems is the product solving and how is that benefiting you?
Torq AI eliminates the tedious, repetitive manual tasks that lead to analyst burnout and sluggish response times. Before integrating Torq, our tier-1 team spent valuable minutes copying and pasting hashes into threat-intel portals and manually closing false positives. Now, routine triage and enrichment happen instantaneously in the background. This drastically reduces our Mean Time to Respond (MTTR) and allows our security team to focus entirely on advanced threat hunting and proactive defense rather than drowning in alert noise.
Daniel M.
Easy-to-Build Workflows Speed Up Incident Response
Reviewed on Oct 13, 2026
Review provided by G2
What do you like best about the product?
I like that Torq AI SOC Platform makes it very easy to build complex workflows and handle multi-step actions. I use it to speed up incident response and eliminate slow, manual tasks. The initial setup was very easy and friendly.
What do you dislike about the product?
Nothing to be honest
What problems is the product solving and how is that benefiting you?
I use Torq AI SOC Platform to eliminate slow, manual tasks.