Overall, I would rate Torq a 10.
When it comes to Torq’s approach to AI and SOC automation compared to other solutions in our security stack, it is hard for me to give a very strong opinion. Like most companies today, Torq is evolving its AI capabilities, and AI is being added across many areas. From what I can see, they are generally on par with other solutions at this stage.
It is worth noting that we mainly use Torq for its automation capabilities and workflow builder. We do not use their case management functionality. We do use some of their AI-related features, such as the AI agent. I am also aware of other AI components like Socrates for case management, but that is not something we currently use. Overall, AI in this space is still evolving everywhere, and it is difficult to clearly differentiate vendors at this point.
From a practical perspective, the safest and most valuable use of AI for us today is around information handling, aggregation, summarization, and notifications. These are areas where AI can reliably save time. There is still no way to guarantee fully consistent or deterministic outcomes from AI, so we are very cautious about where we use it. For example, I would never use AI in a critical workflow like offboarding a user, because I cannot fully guarantee the results. That applies to any AI model, not just Torq’s.
Where AI has been a real game-changer for us is in simplifying workflows. In the past, sending a Slack message based on multiple data points required many steps to collect, process, and format the information. With the Torq AI agent, we can sometimes replace five or ten steps with a single AI step that aggregates the data and acts on it. This has significantly reduced complexity and saved a lot of time.
From a security perspective, I found Torq is especially useful for large-scale manual remediation (Instead of writing and running scripts). For example, during a security incident where we needed to rotate keys or change settings at scale, such as in GitHub, Torq allowed us to do this efficiently through automation. This is not fully automatic remediation, but rather manual remediation executed at scale using automation. For fully automatic remediation, we rely more on specialized security tools but they are limited each one to it's own specialized field.
In terms of time to value, it took me some time to fully appreciate Torq. I was not the one who initially brought it into the organization; my manager did. At first, I was somewhat resistant, without a strong reason. There was also a learning curve, although Torq helped mitigate it. Once I started using the system seriously and understood its potential, it completely changed how we operate in IT.
Today, the entire IT team uses Torq. We may not use it daily, but on a weekly basis we are constantly looking for new things to automate. Torq is used even in production and is deeply integrated into how the IT department works. When we evaluate new tools or solutions, we always think about how Torq can be used to automate processes around them if native automation is missing.
Even though IT may not be Torq’s primary target audience, it has become a core platform for us. It significantly increased our capabilities and responsiveness, and it is something I believe should be a staple in IT departments. We are extremely happy with the system, which is why I give Torq an overall rating of 10.