Torq builds an AI SOC platform for security operations teams that are buried in alerts. AI agents triage, investigate and respond to incidents across the security stack, either fully on their own or with an analyst overseeing each step, so people spend their time on the cases that need judgement.
The Torq AI SOC Platform is aimed at teams that have more alerts than analysts and want the routine part of the job done before a person looks at a case.
At A Glance
| Vendor | Torq |
|---|---|
| Category | Security operations (AI SOC platform) |
| Identities covered | Identity response, joiner and leaver, and Just-in-Time access workflows across identity providers |
| Deployment | SaaS hosted on GCP and AWS |
| Agentic AI | Auto Triage, Torq HyperAgents, Socrates |
| Customers | Blackstone, Carvana, Chipotle, Marriott, PepsiCo |
| Certifications | SOC 2 Type II, BSI C5 |
| Market classification | Security Operations |
What Torq Does
A modern SOC receives more alerts than analysts can read, and alert fatigue means real threats slip through. Torq hands most of that work to AI agents that act in the tools the team already owns. Each agent decision is grounded in what the customer’s environment actually looks like, so an alert about a privileged account is weighed differently from one about a test machine. Teams choose how much autonomy to give, and analysts move from doing the work to directing it.
Products
Auto Triage
Auto Triage is the first filter for a noisy alert queue. It removes duplicate events, screens out false positives and gives each alert an AI verdict that learns from earlier decisions. Analysts can see why a verdict was reached in the audit log and override it by hand.
Case Management
Case Management is the shared record that follows an incident from investigation to remediation. Each case gathers evidence, a timeline and a summary, and cases can be created, assigned and tracked without manual effort.
Torq HyperAgents
HyperAgents take routine SecOps tasks off analysts’ plates. These customisable agents gather evidence, build timelines and recommend actions, and their reasoning stays visible so teams can trust what they do.
Socrates
Socrates coordinates the specialised agents through investigation, evidence gathering and summary. It runs cases end to end and takes instructions in natural language, giving analysts one point of control over the agent workforce.
Hyperautomation
Hyperautomation is the workflow layer that turns decisions into actions across the security stack, built from 300 pre-built integrations and more than 4,000 pre-built steps. It suits teams that want to automate response without writing glue code.
Context Graph And Memory
The Context Graph keeps a transparent, continuously updated model of the customer’s environment, covering identities, roles, privileges and data sensitivity, which agents use to judge what an alert means.
How It Works
Torq is a SaaS platform running on infrastructure from providers such as GCP and AWS, with production environments isolated on the network.
| Component | What it does |
|---|---|
| Ingestion | Telemetry from across the security stack is ingested and normalised, then correlated and deduplicated before triage. |
| Data handling | Customer data is identified, segregated and encrypted at each stage of the data funnel. |
| Access | Users sign in through enterprise single sign-on and MFA providers and work under role-based access control. Torq’s own access to production follows Zero Trust and least privilege, and all activity is audited. |
Identities And Systems Covered
| Identity workflows | Response to unauthorised access, employee onboarding and offboarding, and Just-in-Time (JIT) access. |
|---|---|
| Identity providers | Okta, Microsoft Entra, Microsoft Active Directory, PingIdentity, OneLogin and JumpCloud. |
| Identity security tools | Silverfort, Britive, Astrix Security and 1Password. |
| Cloud platforms | AWS, Google Cloud and Microsoft Azure. |
Agentic AI Capabilities
Agentic Runbooks And Building
For threat hunting, agentic runbooks search historical cases and summarise patterns. The Agentic Builder lets AI agents help engineers build new integrations and workflows.
Autonomy Levels
Teams decide how far the agents may go, and Torq reports that over 90% of cases are remediated autonomously. Response can run completely autonomously, or with human-on-the-loop oversight where an analyst watches and can step in, and the audit log with manual override in Auto Triage keeps every agent verdict reviewable.
Integrations
| Area | Integrations |
|---|---|
| EDR and XDR | CrowdStrike, SentinelOne, Microsoft Defender, Cortex XDR, Carbon Black |
| SIEM | Splunk, Microsoft Sentinel, IBM qRadar, Elastic Security, Exabeam |
| Cloud security | Prisma Cloud, Orca Security |
| Ticketing | Atlassian Jira, ServiceNow, PagerDuty |
| Communications | Slack, Microsoft Teams, Google Chat |
Company Background
| Founded | 2020. |
|---|---|
| Headquarters | Americas headquarters in Denver, Colorado, United States. |
| Team | More than 430 employees across the United States, Canada, Israel and Europe. |
| Leadership | Ofer Smadari (co-founder and CEO) and Josh Morris (Chief Revenue Officer). |
| Funding | A reported $140 million Series D in January 2026, led by Merlin Ventures at a $1.2 billion valuation, for $332 million raised in total. Other investors are Greenfield, Evolution Equity Partners, Notable Capital, Bessemer Venture Partners and Insight Partners. |
| Acquisition | Jit, a Boston-based company, in May 2026. |
| Recognition | Recognised as an AI SOC platform by Gartner, SACR and KuppingerCole in 2026. |
Note: This overview is compiled from Torq’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.