Inside the Zero Trust SOC: How Zscaler and Torq Automate Defense

By Bob Boyle

October 22, 2025

5 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Torq AMP spotlights the partners redefining what’s possible in security operations. Each partner brings a unique strength that seamlessly extends Torq’s autonomous SOC platform. Together, these partnerships help SOC teams achieve speed, accuracy, and scale that were once out of reach. Explore the future of SOC in the AMP’d Sessions video series.

Today’s SOCs face never-ending alerts, hybrid environments, and fast-moving threats that exploit even momentary blind spots. Zscaler has long led the charge on Zero Trust, enforcing least privilege, secure access, and inspection across every user and workload. But even with strong prevention, threats inevitably slip through, hidden in user traffic, cloud workloads, or endpoint activity.

That’s where detection and response become critical — and where traditional SOC tools fall short. Manual triage, delayed investigation, and fragmented tooling leave SOCs reactive and overworked.

The solution is an autonomous, Zero Trust SOC — powered by real-time detection from Zscaler and automated, context-aware remediation from Torq HyperSOC™. Together, they create a closed feedback loop in which detection and response happen at machine speed without sacrificing human oversight or control.

“What excites me is the opportunity for security outcomes that one tool can’t do alone.”

– Jeff Spencer, Senior Sales Engineer, Zscaler

Inside the Torq + Zscaler Integration

This integration brings together two pillars of modern security operations:

Zscaler’s Zero Trust Exchange provides continuous inspection, policy enforcement, and high-fidelity detections across every user, device, and application.
Torq HyperSOC™, which applies AI-driven automation, agentic AI, and case management to orchestrate instant, context-aware incident response.

Together, they form the foundation of a Zero Trust SOC — a system where every alert is verified, every workflow is automated, and every response is precise.

Step 1: Zscaler Deception: Proactive Zero Trust Detection

Zscaler’s Zero Trust Exchange is the industry standard for secure access — continuously verifying users, devices, and applications. With Zscaler Deception, that protection extends beyond prevention into active defense.

Zscaler deploys SaaS-based decoys across endpoints, networks, and applications, convincing high-value assets designed to lure attackers and expose lateral movement early in the kill chain. When a decoy is touched, accessed, or queried, Zscaler instantly flags it as a true positive event because legitimate users never interact with decoys.

These decoys reveal “patient zero” moments — detecting staged or dormant threats before execution — and provide defenders with the earliest possible warning to act.

*Zscaler Deception reveals lateral movement through decoys — identifying real attacker behavior before impact.*

Step 2: Torq HyperSOC: Autonomous Correlation and Response

Once Zscaler Deception raises an alert, Torq HyperSOC™ automatically springs into action. Torq’s AI SOC Analyst, Socrates, instantly correlates Zscaler telemetry with data from SIEM, EDR, IAM, and cloud systems to understand the full scope of the incident. From there, Socrates executes an agentic runbook — autonomously investigating, validating, and containing the threat.

The workflow looks like this:

Case Creation: Torq auto-generates a case populated with all Zscaler observables, file hashes, and context.
User Verification: Torq contacts the endpoint owner via Slack or Teams to confirm activity. If verified, a multi-factor authentication (MFA) check in Okta confirms legitimacy.
AI Reasoning: If suspicious, Socrates escalates and begins machine-speed containment, isolating the device, blocking the user, and updating Zscaler policies.
Remediation: Torq coordinates across EDR and IAM to revoke sessions, rotate credentials, and update blocklists.
Documentation: The entire process — from detection to containment — is logged automatically and complete with AI-generated summaries for compliance and audit.

Together, Zscaler and Torq create a closed feedback loop between detection and response in which:

Zscaler traps attackers with decoys and identifies threats with surgical precision.
Torq responds instantly, isolating endpoints, blocking IPs, and disabling compromised accounts before attackers can pivot.

This integration extends Zscaler’s zero-trust principles into the SOC itself, ensuring continuous verification and the least privilege at access throughout the entire response lifecycle.

Zscaler and Torq — *Torq HyperSOC™ transforms the Zscaler alert into an automated, AI-driven case — isolating the endpoint instantly.*

The Zero Trust SOC Advantage

Zscaler + Torq deliver a SOC experience that’s both faster and smarter, with:

Near 100% detection fidelity from Zscaler Deception
Sub-minute containment triggered by Torq HyperSOC™
Full auditability with automatic case creation, evidence tracking, and AI summaries
Built-in human oversight, so analysts validate and learn from autonomous decisions

For SOCs, that means fewer false positives, faster containment, and measurable improvement. Zscaler and Torq close the loop between visibility and action, transforming zero-rust detection into instant containment.

Better Together: Torq + Zscaler

Every enterprise has a unique security stack: a mix of legacy systems, modern SaaS tools, and homegrown integrations. Zscaler and Torq meet customers where they are. The integration is API-first, customizable, and built to respect each organization’s ecosystem, delivering precise outcomes without forcing architectural changes.

The Zscaler + Torq partnership represents a new model for modern SOCs — one where AI agents and automation reinforce zero-rust principles across detection, investigation, and response.

See how Torq and Zscaler provide a foundation for the Zero Trust SOC. Watch AMP’d Sessions Episode 3 to see Torq + Zscaler in action.

Watch Now

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Autonomous SOC Hyperautomation Research

The Shift in SOC Escalation: From Manual to AI-Powered

By Patrick Orzechowski

October 21, 2025

6 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Torq Field CISO Patrick "PO" Orzechowski, SOC leader and expert

Patrick Orzechowski (also known as “PO”) is Torq’s Field CISO, bringing his years of experience and expertise as a SOC leader to our customers. PO is a seasoned security veteran with a deep understanding of the modern security landscape. You can find him talking to SOC leaders and CISOs from major brands at cybersecurity events around the world.

Every SOC has an escalation process — but not every SOC has one that is truly effective.

Most still run on an outdated, human-only escalation matrix built for simpler times. A world where analysts could manually sift through a few hundred alerts a day and escalate what “felt” risky.

Now, we’re dealing with tens of thousands of alerts daily, hybrid environments, and adversaries who use AI to move faster than humanly possible. The escalation matrix, once designed to bring order, now struggles under the weight of automation gaps, alert overload, and static processes.

With Torq HyperSOC™, threat escalation moves beyond manual handoffs and playbooks. Teams gain dynamic, automated escalation workflows that adapt in real time, reduce response times, and ensure the right people act the moment an incident occurs.

What Is an Escalation Matrix and Why It Matters

An escalation matrix is a structured framework that defines how incidents, alerts, or service disruptions are escalated to higher authority levels when they aren’t resolved within specific timeframes or exceed impact thresholds.

In traditional SOCs, escalation follows a severity-based model: Critical, High, Medium, Low, and Informational. But modern SOCs are replacing this with context-driven escalation, where business risk, asset criticality, and data sensitivity guide prioritization.

An automated threat escalation matrix enables:

Faster and more accurate incident routing
Clear accountability across escalation levels
Consistent communication and response times across teams outside the SOC
Reduced noise, false positives, and human fatigue

For security teams, the automated threat escalation matrix dynamically adjusts based on contextual signals — asset importance, user behavior, and ongoing attack patterns.

Manual SOC Threat Escalation: The Old Model

Here’s how escalation still looks in many SOCs:

Tier-1 analysts triage thousands of alerts by hand.
Anything that looks “real” gets escalated to Tier 2 for deeper analysis.
Confirmed incidents go to Tier 3 or the incident response team.

Sounds structured, right? In reality, it’s chaos disguised as process. Alerts bounce from person to person, critical signals get buried under false positives, and by the time something reaches Tier 3, the attacker’s already moved on.

I’ve seen SOCs where 70% of an analyst’s day is spent reclassifying alerts that should’ve been auto-dismissed. It’s not an efficiency problem — it’s a design problem. A lot of vendors do not allow for fundamental reclassification of alert severities.

AI-Powered Threat Escalation for SOCs

Torq HyperSOC brings the Autonomous Threat Escalation Matrix to life — an AI-powered framework that redefines how alerts flow, how context is applied, and how response happens. Instead of human triage being the first filter, AI takes that role — automatically scoring, enriching, and routing alerts based on real business impact.

How it works:

AI filters out 99% of alert noise and enriches the remaining 1% with full context and risk scores.
Analysts only see cases — not alerts — prioritized by business impact.
Human analysts validate AI-generated insights and approve or refine the automated responses (e.g., isolate a host, revoke credentials).

A few examples:

A malware alert on a retired test server is logged and archived automatically.
A suspicious login to the CFO’s laptop from two countries apart is escalated immediately with risk context attached.
A confirmed beacon from a domain controller is triggered with AI for containment before humans even wake up.

How the Autonomous Threat Escalation Matrix Works

Think of the Autonomous Threat Escalation Matrix as an intelligent, risk-based hierarchy — not built on severity labels, but on context. Each alert is scored dynamically using signals like:

Asset criticality: Is this production or a test?
User behavior: Does this deviate from baseline patterns?
Threat intelligence: Is this IOC part of an active campaign?
Historical context: Has this alert been a false positive before?

The result is a living, automated escalation matrix that determines: what gets handled automatically, what needs a quick human validation, and what demands immediate escalation.

The Autonomous Threat Escalation Matrix operates on a dynamic, context-driven hierarchy that replaces rigid severity scoring with real business risk. Instead of static labels like Critical or Low, each alert is automatically analyzed and scored based on asset importance, user behavior, threat intelligence, and historical reliability. Routine telemetry and low-impact alerts are logged and enriched for trend analysis without human intervention.

Moderate-risk activity — such as suspicious logins or unusual SaaS behavior — triggers automated containment and creates a case for analyst validation. High- and critical-risk incidents, like privileged account compromise or ransomware in production, prompt immediate containment actions and human escalation to senior SOC leadership. This flexible design allows organizations to calibrate AI autonomy to their risk tolerance — fully automated, human-in-the-loop, or hybrid.

This model gives organizations flexibility — tune AI autonomy up or down depending on your risk appetite. Some CISOs want near-total automation; others prefer AI assistance with human checkpoints. Torq HyperSOC™ supports both.

From Framework to Action

In the old SOC model, escalation was linear — an alert passed from Tier 1 to Tier 2 to Tier 3, bleeding time and risking loss of context at every handoff. In the new world, escalation is dynamic — AI does 80% of the heavy lifting, humans focus on the 20% that actually matters.

Here’s what that looks like in a phishing or malicious payload workflow:

Scenario: A user reports a suspicious email with an attachment.

Automated Workflow:

The email is flagged via user report or spam detection.
A phishing classifier analyzes the message structure, links, and language patterns.
Torq runs a user impact analysis, checking who received and clicked the email.
If the message is determined risky, the system performs auto-quarantine across all affected mailboxes.
If a VIP or finance team user is impacted, the case is escalated automatically to the incident response team for immediate validation.

Behind the scenes, AI agents handle the enrichment and scoring, while human analysts step in only when risk or ambiguity demands it.

The impact is tangible:

Faster MTTR: Response times shrink from hours to minutes.
Lower burnout: Analysts deal only with validated, risk-ranked cases.
Smarter prioritization: AI understands which systems and identities matter most.
Governance built in: Human-in-the-loop checkpoints maintain control and compliance.

It’s not about replacing analysts. It’s about giving them time to think, hunt, and innovate — not just click “escalate.”

Why Risk Beats Severity Every Time

Severity-based models like CVSS are still essential, but they tell only part of the story. Two alerts might share a Critical score — yet a compromised test VM and a compromised production database have vastly different business impacts.

AI-powered escalation models fix that by injecting real-world context into every decision. They understand that Critical doesn’t always mean “important” — and that Medium sometimes means “urgent.”

That shift — from static severity to dynamic risk — is what separates modern SOCs from legacy ones.

It’s time to rethink SOC triage. See how the Autonomous Threat Escalation Matrix works.

Get the Matrix

FAQs

How does a threat escalation matrix work?

A threat escalation matrix is a structured, hierarchical framework that defines how security threats progress through different response levels based on their severity, impact, and urgency. It outlines clear roles, responsibilities, communication channels, and response timelines to handle every threat with the right priority and accountability.

In practice, a Level 1 threat might be handled by a SOC analyst for initial triage and validation. If the incident shows indicators of compromise or potential data exposure, it escalates to Level 2, where specialized security engineers or threat hunters perform deeper analysis. Level 3 may involve executive or crisis-level coordination when the threat poses a critical risk to operations or compliance.

With Torq Hyperautomation™, organizations can automate their threat escalation matrix, linking detection, triage, and response workflows across platforms like SIEMs, PagerDuty, Slack, and Jira. This ensures that threat alerts escalate automatically, eliminating manual bottlenecks and guaranteeing that the right team addresses every security incident at the right time, with complete visibility and auditability.

What are the levels of escalation?

Torq’s threat escalation matrix includes four levels of escalation, each representing a different response tier. Level 1 handles initial detection and triage by analysts, Level 2 escalates to security engineers for deeper investigation, Level 3 involves management or cross-functional coordination, and Level 4 activates executive or crisis response. Automating these escalation levels through Torq ensures that incidents move seamlessly through the hierarchy with full traceability and faster resolution.

Why is an escalation matrix important in security operations?

An escalation matrix is critical in security operations because it prevents delays, confusion, and missed alerts during high-pressure incidents. It defines exactly who acts, when, and how communication flows during an active security threat or incident escalation. By automating the matrix through Torq’s Hyperautomation platform, SOC teams can enforce consistent, real-time escalation workflows that reduce mean time to respond (MTTR) and strengthen their overall security posture.

What is the difference between functional and hierarchical escalation?

In a threat escalation matrix, functional escalation occurs when a threat is passed to someone with the required technical expertise — for example, escalating a network anomaly to a forensics specialist. On the other hand, hierarchical escalation moves the incident up the management chain when additional authority or resources are required. Torq Hyperautomation™ supports both models by automatically routing incidents to specialists or leadership based on the escalation criteria defined in your workflow.

How can automation improve the threat escalation process?

Automation enhances the threat escalation by removing manual handoffs and ensuring rapid, reliable response coordination. Using Torq, organizations can automatically trigger escalations when predefined conditions are met, such as time thresholds, severity scores, or detection from integrated tools like PagerDuty or CrowdStrike. This ensures the threat escalation matrix remains consistent, measurable, and scalable — even in complex enterprise environments — while giving SOCs complete visibility into every step of the response chain.

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Autonomous SOC Hyperautomation

The 5 Nightmares Haunting SOCs — and How Torq HyperSOC™ Puts Them to Rest

By Torq

October 9, 2025

6 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

The real horror story is happening inside SOCs every single day. Analysts are buried alive under endless alerts. Silent screams when critical threats slip through. Empty chairs as burnout claims another teammate.

Here are the five nightmares every SOC analyst knows too well — and how Torq HyperSOC™ turns them from never-ending sequels into closed cases.

Nightmare 1: Buried Alive (Alert Fatigue & Data Dumping)

The Nightmare: A SOC analyst stares into the endless abyss of dashboards: 3,000+ alerts a day across 28+ tools. No matter how many they close, more keep spawning. There’s no time to separate real threats from the noise.

That’s why 42% of SOCs admit they shove everything into a SIEM without a plan to analyze or retrieve it. It’s like digging your own grave in data, one ticket at a time.

The Wake-Up Call with Torq HyperSOC™:

Torq automatically enriches raw alerts with context such as asset data, identity information, and threat intelligence, so analysts only see cases that matter.
AI-powered case-first automation prioritizes alerts based on severity, correlation, and potential business impact instead of overwhelming analysts with raw logs.
Known false positives are automatically identified and closed out, preventing analysts from wasting time on noise.

The Morning After: With Torq, analysts finally see daylight. Instead of being buried under thousands of raw alerts, they’re presented with clean, prioritized cases enriched with context and scored by severity. False positives are automatically suppressed, freeing analysts from chasing ghosts.

Customers report 80%+ reductions in alerts, faster MTTD/MTTR, and reclaim thousands of hours annually that were once lost to manual triage. The SOC shifts from drowning in noise to focusing on the handful of alerts that truly matter.

Nightmare 2: The Silent Scream (Critical Alerts Ignored)

The Nightmare: The alert queue builds and builds.. Is this alert real? Or another false positive? Fatigue sets in. But that one missed alert might just be the one that can take the business down.

62% of SOCs admit they’ve ignored alerts that later turned out to be critical.

The Wake-Up Call with Torq HyperSOC™:

Autonomous triage ensures critical alerts automatically rise to the top of the queue, instead of being buried under low-priority noise.
Each case is enriched with supporting evidence — including correlated telemetry, threat intelligence, and asset data — so analysts don’t waste time searching for context.
Torq’s AI SOC Analyst, Socrates, generates clear, narrative-driven case summaries that help analysts quickly validate which alerts are genuine threats.

The Morning After: Torq ensures no alert slips through the cracks. Every critical alert is enriched with telemetry, threat intel, and AI-generated summaries before reaching an analyst’s desk. SOC teams cut MTTR by 75%+, giving them the time and confidence to respond before attackers can entrench themselves.

Instead of second-guessing whether an alert is real, analysts wake up to cases that come with everything they need to take action quickly — no more missed warnings turning into full-blown incidents.

Nightmare 3: Code Red (Reactive Firefighting)

The Nightmare: 85% of SOCs are stuck reacting to endpoint alerts, always one step behind attackers who move laterally in under a minute. By the time the fire alarms go off, the whole house is already burning.

The Wake-Up Call with Torq HyperSOC™:

Agentic AI orchestrates automated containment actions across the SOC stack in seconds, from isolating compromised endpoints to disabling risky accounts.
Torq connects EDR, IAM, SIEM, cloud, and ITSM systems in unified workflows, ensuring coordinated responses rather than siloed firefighting.
Every containment and remediation action is automatically logged, providing a complete, auditable timeline of decisions and outcomes.

The Morning After: SOC teams stop reacting to the fire after it spreads and start containing it at the first spark. Torq customers now respond to incidents 10× faster than industry averages, often containing intrusions in seconds.

Endpoint isolation, account disablement, and malicious process termination happen automatically, documented in real time. Instead of endless firefighting, the SOC shifts to proactive prevention — with confidence that lateral movement is being shut down before adversaries can gain ground.

Nightmare 4: The Empty Chair (Burnout & Turnover)

The Nightmare: The fluorescent glow of the SOC hides the empty chairs. Another analyst gone. Another shift to cover. 62% of SOC professionals say their organizations aren’t doing enough to keep top talent. With an average tenure of only 3–5 years, the SOC becomes a revolving door.

The Wake-Up Call with Torq HyperSOC™:

Torq automates over 90% of Tier-1 tasks, including triage, enrichment, evidence collection, and initial containment, eliminating the repetitive work that drives burnout.
Socrates, Torq’s AI SOC Analyst, is an always-on teammate who handles investigations and remediation at scale so humans don’t have to.
Analysts are freed up to focus on engaging work like proactive threat hunting, strategy, and advanced incident response, restoring meaning to their roles.

The Morning After: The revolving door of SOC turnover slows. By automating more than 90% of Tier-1 tasks, Torq frees analysts from the endless grind of low-value work. SOCs running on Torq handle 4× more alerts with the same headcount, while giving their teams time to focus on threat hunting, strategy, and professional growth.

Analysts are no longer chained to ticket queues — they’re energized by higher-value work that keeps them engaged, reduces burnout, and extends tenure.

Nightmare 5: The Monster You Can’t Kill (Legacy SOAR)

The Nightmare: Legacy SOAR was supposed to help. Instead, it became another monster. Playbooks that don’t work. Endless scripting. Broken integrations. Whenever you think it’s dead, it rises again — blocking progress and draining resources.

The Wake-Up Call with Torq HyperSOC™:

Torq replaces playbooks with a modern, event-driven, multi-agent architecture that adapts to real-world complexity.
Teams can build workflows using no-code, low-code, or pro-code — removing the dependency on Python developers to maintain basic automations.
Torq comes with 300+ pre-built integrations, making it easy to connect existing security tools without months of custom development.

The Morning After: Organizations that migrate off legacy SOAR discover freedom. Instead of spending months scripting, patching, and babysitting fragile automations, Torq customers go live with critical workflows in under 30 days.

Operational overhead drops by 50%, and the SOC gains resilience. With a flexible, event-driven architecture and 300+ integrations, the endless cycle of broken workflows and failed promises ends. The monster is finally defeated — replaced by a platform built to evolve with your team, not against it.

Wake Up From the Nightmare

The nightmares SOCs face aren’t just scary stories — they’re daily realities for teams buried in alerts, burning out talent, and battling attackers who move at machine speed.

Torq HyperSOC™ puts an end to the nightmare. Combining agentic AI, Hyperautomation, and case-first architecture transforms SOCs from reactive firefighting units into resilient, autonomous operations. SOCs can now respond faster, deal with fewer false positives, have happier analysts, and finally get ahead of adversaries.

Sleep peacefully. We’ll leave the Torq on.

Get a Demo. Get a Skeleton Plushie.

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Autonomous SOC Hyperautomation Integrations

Smarter, Faster, Autonomous: Cloud Security with Wiz + Torq

By Bob Boyle

October 7, 2025

6 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Torq AMP spotlights the partners redefining what’s possible in security operations. Each partner brings a unique strength that seamlessly extends Torq’s autonomous SOC platform. Together, these partnerships help SOC teams achieve speed, accuracy, and scale that were once out of reach. Explore the future of SOC in the AMP’d Sessions video series.

Cloud has changed everything: how we build, how we deploy, and how attackers strike. Environments are dynamic, identities multiply, and workloads spin up and down by the second. And yet, most SOCs are still running with playbooks designed for static, on-premises networks.

Wiz provides the unified, contextual cloud security platform; Torq turns those high-fidelity detections into action. Together, the Wiz and Torq integration delivers autonomous cloud security that triages, investigates, and remediates threats at machine speed — so that teams can finally keep up.

“Cloud changed everything. Organizations today are required to innovate fast and to deliver product as fast as they can into production.”

– Oron Noah, VP of Product, Wiz

Silos, Alert Overload, and Fragmentation

Rapid innovation and expanding attack surface: Cloud-native architectures evolve constantly. That agility is great for business, but it creates an ever-shifting attack surface. Attackers don’t care about org charts or silos; they’ll exploit the weakest misconfiguration, leaked secret, or exposed workload they can find.

Fragmented tooling: DevSecOps teams use code scanners, cloud security uses posture tools, and SecOps uses runtime detectors. Each tool generates its own alerts in its own language. This brings slow, error-prone handoffs and endless “context switching” for analysts.

Alert fatigue: Analysts spend more time triaging and correlating low-value alerts than actually defending. Critical issues get buried, remediation stalls, and the SOC becomes reactive rather than proactive.

Wiz’s model breaks the silos with one platform across Wiz Cloud, Wiz Code, and Wiz Defend — what Wiz calls democratized cloud security. Torq extends that context into Hyperautomated response across teams and tools.

Inside the Torq + Wiz Integration

1. Detection and Handoff

Wiz Cloud + Wiz Defend continuously monitor for misconfigurations, vulnerabilities, and active threats.
When Wiz identifies an issue — enriched with context, IOCs, and attack path metadata — it generates a high-fidelity alert.
That alert is sent directly into Torq HyperSOC as the trigger for automated action.

*When Wiz detects a cloud misconfiguration or active threat, it sends a context-rich, high-fidelity alert — complete with IOCs and attack path data, directly into Torq HyperSOC™.*

2. AI-Powered Triage and Enrichment

Torq’s Hyper Agents immediately triage the alert.
They calculate business risk and exploitability, check for known attack techniques, and correlate data across SIEM, EDR, IAM, and cloud logs.
A case is created automatically, with an AI-generated summary and recommended actions.

*Torq’s Hyper Agents instantly triage the alert — assessing business risk, correlating signals across your stack, and auto-creating a case with AI-generated context and next steps.*

3. Workflow Orchestration Across Teams

Torq kicks off a Hyperautomated workflow that aligns all stakeholders.
A Slack channel is spun up instantly to notify DevSecOps, Cloud, and SecOps.
Jira tickets are pre-populated with all context from Wiz.
Parallel playbooks run across tools — updating SIEM rules, tagging EDR alerts, and preparing remediation steps.

*Torq launches a Hyperautomated workflow that unites teams — spinning up Slack channels and running coordinated response playbooks.*

4. Autonomous Remediation and Validation

DevOps and Cloud teams patch the vulnerable container, rotate exposed secrets, or adjust IAM policies.
Torq HyperSOC monitors progress, validates that the fix was successful, and continues hunting for related environmental threats.
Once the issue is fully remediated, Torq updates Jira, closes the case, and documents every action taken.

*As teams remediate the issue, Torq HyperSOC tracks progress, verifies the fix, and automatically closes the case.*

5. Audit Trail and Reporting

Every decision, escalation, and action is logged automatically.
SOC leaders gain compliance-ready reports, replayable case histories, and metrics for MTTR, accuracy, and workload reduction.

*Torq automatically records every decision, escalation, and action.*

“Security runs autonomously while collaborating with Dev, Cloud, and IT operations — everyone gets what they need in real time.”

– Bob Boyle, Product Marketing Manager, Torq

How Wiz + Torq Close the Loop in Minutes

Imagine this scenario:

Exposure: A Kubernetes container is accidentally exposed to the public internet. Wiz flags it as a critical issue tied to a vulnerable image and leaked IAM keys.

Threat identified: Moments later, Wiz Defend detects unusual activity — a reverse shell attempt — and maps the attack path directly to sensitive S3 data.

Alert handoff to Torq: The enriched Wiz alert is passed to Torq, where Hyper Agents triage the case, confirm severity, and trigger automation.

Coordinated response across teams: Slack and Jira light up, instantly connecting DevSecOps, Cloud, and SecOps. Remediation tasks are aligned and executed in parallel.

Autonomous remediation: The DevOps team patches the container. Torq validates the fix, updates Jira, closes the case, and produces a full audit trail.

Closed loop in minutes: What once took days of manual back-and-forth now resolves in minutes — fully autonomous, fully documented, and without silos.

“With Wiz’s real-time visibility and Torq’s machine speed response, Torq is turning Wiz’s detection engine into a full-stack tournament’s defense system.”

– Bob Boyle, Product Marketing Manager, Torq

Impact You Can Measure

Customers running Wiz + Torq see:

90% reduction in manual case handling
3–5× increase in SOC throughput
95%+ of Tier-1 and Tier-2 alerts remediated autonomously
5x improved visibility and coverage of cloud workloads
10x faster time to detect and respond to threats, with many customers reporting MTTRs under an hour
<24hr immediate visibility to 0-day threats
10x lower effort to investigate and remediate issues

“The beauty about this partnership is that Torq was always there side by side as one of our design partners as we have evolved.”

– Oron Noah, VP of Product, Wiz

Better Together: Torq and Wiz

The Torq + Wiz partnership isn’t just another integration; it’s a model for how SOCs will thrive in the cloud era. By unifying visibility and context from Wiz with Torq’s Hyperautomation and AI-driven response, organizations finally get an operating model that matches the speed and scale of the cloud.

Together, Torq and Wiz deliver what security leaders have been waiting for: autonomous cloud security that’s proactive, collaborative, and built for the cloud-first world.

Watch AMP Sessions Episode 2 to see Torq + Wiz in action.

Watch Now

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Autonomous SOC Hyperautomation Integrations

Agent-to-Agent: How Torq + Intezer Power the Autonomous SOC

By Bob Boyle

October 2, 2025

4 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Torq AMP spotlights the partners redefining what’s possible in security operations. Each partner brings a unique strength that seamlessly extends Torq’s autonomous SOC platform. Together, these partnerships help SOC teams achieve speed, accuracy, and scale that were once out of reach. Explore the future of SOC in the AMP’d Sessions video series.

Security operations centers (SOCs) have long been stuck in a reactive, overwhelmed state. Analysts are swamped with alerts. Triage is repetitive. Even the biggest teams can’t keep up.

Torq and Intezer are rewriting the SOC playbook with agent-to-agent AI collaboration. Together, we’re showing how two AI-driven platforms can work seamlessly to handle the entire alert lifecycle — from detection to triage to remediation — completely autonomously, at machine speed.

Why SOCs Need Agent-to-Agent AI

Every SOC leader knows the math doesn’t add up. Cloud adoption, SaaS sprawl, and AI-powered adversaries have all converged to push SOCs beyond their limits. Alert volumes climb year after year, yet most teams can only investigate a fraction of them. Burnout is rampant, with analysts stuck in repetitive triage instead of higher-value work.

Traditional SOAR tools tried to automate some of the load, but rigid playbooks and partial integrations left the real problem — scale — unsolved. The result is a SOC that remains reactive, noisy, and perpetually behind.

Intezer and Torq are solving that together:

Intezer AI agents emulate elite analysts, performing deep, forensic-grade investigations at speed.
Torq’s agentic AI SOC Analyst, Socrates, takes the lead, orchestrating remediation across the entire stack with Hyperautomation.

The result: The entire alert lifecycle is handled without human bottlenecks, with analysts only stepping in when their judgment is truly needed.

“This really starts to cut down everything that has made the SOC a sore place for decades.”

– Mitchem Boles, Field CISO, Intezer

Inside the Torq + Intezer Integration

Step 1: Intezer’s AI Agents Triage Alerts

Intezer is known for forensic-grade analysis — and they’ve built AI agents to scale that expertise. Their agents investigate alerts like a senior analyst would by:

Asking the right triage questions
Checking tools and data sources in the right order
Validating threats even if a mitigation attempt has already occurred

By automating these investigation steps, Intezer filters out noise and escalates only the threats that truly matter. Customers see 4% of alerts escalated in as little as two minutes with 97.6% accuracy.

Intezer alert flows into Torq — Intezer confirms a high-severity PowerShell exploit with malicious URLs and anomalies, escalating to Torq for automated response.

Step 2: Triage and Remediation with Torq AI Agents

Once Intezer triages the initial event, Torq Socrates, the AI SOC Analyst, and its AI agents, designed to act like a Tier-1 and Tier-2 team, take over. Here’s what happens next:

Case creation: Torq automatically builds a case enriched with all IOCs, observables, and investigation notes from Intezer.
Context enrichment: Socrates correlates data across SIEM, EDR, IAM, cloud, and more, ensuring the case has full context.
Runbook planning: Socrates generates a remediation plan, which includes isolating hosts, locking accounts, resetting credentials, or running endpoint scans.
Autonomous execution: Socrates triggers Hyperautomation workflows that execute those actions across the connected stack, step by step, until the threat is contained and remediated.
Resolution: The case is closed with full audit-ready documentation.

The handoff is seamless. Intezer ensures the right alerts are surfaced, and Torq ensures they’re fully resolved.

Speed, Accuracy, and Scale

The numbers tell the story:

97.6% accuracy in Intezer’s AI-driven triage
90% reduction in manual investigation effort for Torq customers
3–5× increase in alert handling capacity without adding headcount
95%+ of Tier-1 and Tier-2 cases remediated autonomously

For analysts, this means less alert fatigue and burnout and more time for threat hunting, detection engineering, and strategic projects. For SOC leaders, it means world-class outcomes without ballooning costs.

“Everyone is looking for speed, but we’re also removing burnout — freeing analysts to focus on the most important cases.”

– Mitchem Boles, Field CISO, Intezer

Better Together: Torq and Intezer

This is the future of the SOC: AI agents collaborating seamlessly to handle the noise and remediate threats at scale. Most importantly, it gives analysts back the time and focus they need to do the kind of cybersecurity work that truly matters.

Watch AMP Sessions Episode 1 to see Torq + Intezer in action.

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Autonomous SOC Hyperautomation

Beyond Agent-Washing: How Torq Delivers True Agentic Automation for Security

By Eldad Livni

September 30, 2025

5 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Eldad Livni is the Co-Founder and Chief Innovation Officer at Torq. Prior to founding Torq, Eldad co-founded and served as CPO of Luminate Security, a pioneer in Zero Trust/SASE. Following Luminate’s acquisition by Symantec, he went on to act as CPO of Symantec’s Zero Trust/Secure Access Cloud offering.

The security industry has a new buzzword problem. Walk through any major security conference, and you’ll hear every vendor claiming they’ve built “agentic AI” into their platform. But strip away the marketing speak, and most solutions are just basic automation with an AI label slapped on top.

SOC teams aren’t buying it. They’re drowning in 10,000+ daily alerts, facing a global talent shortage of 4.76 million cybersecurity professionals, and up against adversaries who now move laterally in less than an hour. They need real solutions, not rebranded point tools.

That’s where true agentic automation comes in — and why Torq HyperSOC™ represents a fundamentally different approach to AI-powered security operations.

The Agent-Washing Problem

Here’s the uncomfortable truth: most “agentic AI” in security isn’t actually agentic. It’s usually one of two things: deterministic workflows — rigid rules that break as soon as attackers change tactics; or chatbot-style agents — useful for summaries but incapable of acting autonomously or coordinating at scale.

True agentic automation requires AI systems that can:

Reason autonomously across complex security scenarios
Collaborate with other agents to solve multi-step problems
Adapt dynamically to novel threats and environments
Execute actions independently while maintaining human oversight
Learn and improve from each interaction

Few platforms check those boxes. Torq does.

What True Agentic Automation Looks Like

Most SOC automation is still sequential — whether through scripted workflows or single AI agents mimicking Tier-1 analysts. Tasks run one at a time, slowing investigations and leaving room for missed edge cases.

Multi-agent systems break this bottleneck. Multiple specialized agents work in parallel, each focusing on its domain — from email analysis to endpoint forensics — while continuously sharing context. As new evidence emerges, they adapt dynamically, delivering investigations and remediation in seconds instead of minutes.

Torq takes this further with Hyperautomation: AI-driven security operations that move beyond rule-based responses to deliver autonomous detection, investigation, and remediation. At the core of our multi-agent system is Socrates, our AI SOC Analyst, supported by specialized HyperAgents that handle everything from triage to containment. Together, they achieve outcomes that traditional SOAR platforms or “AI add-ons” simply can’t match.

Take a phishing use case:

Autonomous investigation: When a potential phishing email hits your environment, multiple agents launch at once — one inspects headers, another scans attachments, and a third checks threat intel, finishing in seconds, not minutes.
Dynamic remediation: Instead of scripting every step, AI agents evaluate context in real time and choose the right actions — blocking, removing, quarantining, or notifying — simplifying maintenance and covering edge cases workflows miss.
Collaborative intelligence: Our agents continuously share context and coordinate actions. They escalate to human analysts only when necessary, meaning most phishing alerts are resolved without manual intervention.

Other agentic automation platforms? At best, you could script this with workflows and drop in an AI step for summarization. The difference: Torq executes a full case lifecycle end-to-end, autonomously.

The Business Impact of True Agentic Automation

Unlike traditional automation that requires constant tuning and breaks with environmental changes, agentic automation delivers measurable business outcomes, including the ability to:

Scale without headcount: Torq customers automate over 95% of Tier-1 security operations, effectively scaling their SOC without adding analysts.
Speed that matters: While the industry average breakout time has dropped to 48 minutes, organizations using Torq’s agentic automation contain threats in seconds, 10x faster than legacy SOAR. Speed isn’t just an advantage; it’s the difference between a contained incident and a full breach.
Adaptive defense: Traditional SOAR playbooks break when attackers change tactics. Torq’s agentic automation adjusts in real time — adapting to new findings and edge cases during a session to stay on track. Beyond that, it learns across sessions, remembering preferences and tuning rules so your defenses continually improve. Your defenses evolve as fast as the threats.

Human-AI Collaboration, Not Replacement

What separates real agentic automation from marketing hype is that it’s designed to augment human expertise, not replace it. Torq doesn’t aim to replace analysts. Instead, AI agents take on the repetitive work — triage, enrichment, initial containment — so humans can focus on threat hunting, strategic projects, and high-stakes response.

When agents do escalate to humans, they provide complete context, suggested actions, and all supporting evidence. Analysts aren’t starting from scratch; they’re picking up where AI left off, with everything they need to make informed decisions.

AI Governance that Scales

Autonomy only works if it’s safe. Torq builds trust in AI through:

Transparent decisions: Every AI (generative and agentic) action is explainable, auditable, and logged.
Human control: Escalation and override steps keep analysts in charge.
Enterprise security: Zero-trust AI architecture with encryption, validation, and attack resistance.
Compliance by default: Audit-ready trails and standards alignment (including ISO/IEC 42001) are built in. Unlike black-box AI tools, Torq combines deterministic, well-tested workflows with AI guardrails — so you decide the balance between autonomy and oversight. Sensitive actions can always stay human-in-the-loop, while AI is equipped with trusted, validated tools to operate safely and predictably.

For enterprises and MSSPs, this means confidence that every automated action is both effective and accountable.

The Path Forward with Agentic Automation

The security industry is at an inflection point. Organizations can continue patching together point solutions and calling it “agentic,” or they can embrace platforms built for autonomous security operations. With Torq, SOCs scale without adding headcount, stop threats in seconds, and empower analysts instead of burning them out.

The question isn’t whether agentic AI will transform security operations — it already has. The question is whether your organization will lead that transformation or be left behind by vendors still playing catch-up with marketing buzzwords.

Ready to move beyond agent-washing? Read the AI or Die Manifesto to learn how to approach AI in the SOC the right way.

Get the Guide

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Autonomous SOC Hyperautomation Research

GigaOm Names Torq Leader in SecOps Automation

By Bob Boyle

September 29, 2025

5 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

The 2025 GigaOm Radar Report for SecOps Automation has named Torq a Leader and Fast Mover. The category’s shift this year away from SOAR to SecOps Automation confirms what SOC leaders already know, and Torq has been saying for years: Legacy SOAR is done. Too rigid, too slow, and too fragile, SOAR can’t keep up with today’s adversaries.

Purpose-built for speed, scale, and safe autonomy, Torq HyperSOC™ is the solution closest to the high-value bullseye of GigaOm’s SecOps Automation Radar. The GigaOm report validates what our customers prove daily: Torq is helping set the pace for SecOps automation.

SOAR Is Dead — And We Were the First to Say It

When Torq declared “SOAR is dead”, it wasn’t just a marketing tagline — it was a reality check. Legacy SOAR platforms were never designed for the scale, complexity, or speed of modern SOC operations. They rely on brittle playbooks, endless scripting, and rigid integrations that collapse under today’s machine-speed adversaries.

For years, vendors tried to rebrand SOAR, but the cracks were obvious:

Too slow to keep up with modern attack timelines.
Too code-heavy for teams already stretched thin.
Too limited to unify security, IT, and business operations.

The 2025 GigaOm Radar for SecOps Automation is the clearest signal yet: the market has officially moved on. What once fell under SOAR is now evaluated through the lens of SecOps automation — end-to-end, AI-driven workflows that unify the SOC and deliver automated triage, investigation, and response at scale.

Why Torq Stood Out in the GigaOm Radar

For the past three years, Torq Hyperautomation outperformed legacy SOAR on the GigaOm SOAR Radar. With GigaOm now evolving the category to SecOps Automation, Torq once again ranks closest to the bullseye.

The Torq platform stood out in GigaOm’s 2025 Radar for its ability to combine no-code, low-code workflows with extensive integrations across the modern SOC stack and advanced case management. Analysts highlighted Torq’s strengths in key areas:

Case management and collaboration: An area where Torq earned a top score, with a built-in case management system, seamless integrations with ServiceNow, Jira, Zendesk, Slack, Teams, and Webex, plus virtual war rooms and role-based access controls to keep security, IT, engineering, and business teams aligned.
SIEM and SDL integrations: Torq consolidates multiple signals across assets, teams, and timeframes into enriched, prioritized events. With deterministic filtering and anomaly detection integrations, SOCs can cut through noise and accelerate investigations.
Red teaming and validation: Every workflow can be safely tested and validated in staging before production. Audit trails, version control, and deterministic outcomes ensure responsible deployment and compliance-ready automation.
Future-ready architecture: GigaOm highlights architecture as the top decision factor in SecOps automation. Torq’s multi-agent, event-driven design combines the predictability of deterministic workflows with the power of LLMs — delivering autonomy that adapts to real-world complexity.
AI agent guardrails: GigaOm gave Torq a perfect 5 in AI Agent Guardrails, validating what enterprises already trust us to deliver: safe, scalable AI for the SOC. Every Torq decision is explainable, auditable, and transparent, with built-in governance frameworks that ensure accuracy, compliance, and accountability. From human-in-the-loop workflows and override mechanisms to zero-trust AI architecture with continuous monitoring, Torq is built for enterprise-grade safety.

Why This Matters for Security Leaders

Today’s SOC leaders face three hard realities:

Alert volume keeps climbing. The average enterprise SOC receives tens of thousands daily alerts, of which at least 30% are never investigated.
Analyst headcount isn’t keeping up. A 4.76 million-person global cybersecurity talent shortage leaves SOCs chronically understaffed.
Adversaries are moving faster than ever. Breakout time has shrunk to 48 minutes on average — with some intrusions moving laterally in under a minute.

Legacy tools are slowing SOCs down. Torq addresses these challenges head-on with automation built for speed, scale, and resilience.

Unified SOC operations: Case-first automation, 300+ integrations, and end-to-end workflows break down silos and align security, IT, and business teams.

Autonomy at scale: Torq auto-remediates more than 90% of Tier-1 tasks and slashes investigation times from auto-triage to full case resolution.

Enterprise-grade trust: AI guardrails, built-in governance, and continuous validation ensure autonomy is safe, reliable, and audit-ready.

And the results speak for themselves:

Cut MTTR by at least 75% with autonomous triage, enrichment, and case resolution
Automate 90%+ of Tier-1 tasks, eliminating the repetitive tasks that burn out analysts
10× faster response times across critical use cases like phishing, credential compromise, and malware investigations
80%+ reduction in alert fatigue, enabling analysts to focus on higher-value threat hunting and detection engineering
50% decrease in average cost per incident through Hyperautomation
4× more alerts handled with the same size team
35% reduction in the probability of a major breach

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for [our company] and our customers.”

– Todd Willoughby, Director, RSM Defense

Get the GigaOm Radar for SecOps Automation

The verdict: The future of SecOps automation belongs to platforms that deliver SOC autonomy at scale. Torq HyperSOC™ is the only platform built to unify the SOC, automate at enterprise scale, and deliver autonomy with the governance and trust today’s leaders demand. That’s why customers, MSSPs, and analysts agree: Torq is setting the pace for the modern autonomous SOC.

Get your copy of the GigaOm SecOps Automation Radar now.

Get the Report

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

Integrations News & Events

Your Security Product’s Favorite Integration Partner

By Chris Coburn

September 23, 2025

6 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Chris Coburn is the Senior Director of Technology Alliances at Torq, where he leads strategic partnerships that fuel innovation and growth. With experience scaling alliance programs at cybersecurity leaders like Recorded Future, he brings an execution-first mindset to ecosystem development. He’s the architect of Torq’s AMP program, redefining how partners integrate, collaborate, and win together.

Cybersecurity vendors: Your customers already have a stack they trust — your job (and ours) is to make it smarter, faster, and more connected. Torq is the automated security solution that plugs into anything, orchestrates everything, and turns alerts into action across the SOC.

Through the Torq AMP (Alliance & Momentum Partner) Program, we co-build practical solutions so our integration partners’ products shine inside live customer workflows. The AMP’d Sessions video series brings these integrations to life — showing how Torq and our partners turn big promises into real-world SOC outcomes.

AMP’D SESSIONS

Watch Now Watch Now

Why Partners Choose Torq

Security teams are overwhelmed — on average, they have 83 tools and 29 vendors, and no time to tie it all together. Torq is the execution layer that makes the whole stack work as one.

Integrates with anything. 300+ out-of-the-box connectors plus universal HTTP/webhooks, headless APIs, custom actions, and on-prem support.
Operational in days, not months. Visual no-code builder and BYO-integration framework.
Proves impact fast. Prebuilt use cases across SIEM, EDR, IAM, cloud, and threat intelligence reduce MTTR, cut manual work, and showcase real interoperability.
Co-build, co-sell, co-market. Joint solution playbooks, launch kits, and customer deployment resources that demonstrate value on day one.
Measurable outcomes. Customers report halved MTTD, ~90% of responses automated, 3–5x alert throughput, and up to 90% of T1/T2 tickets closed automatically.

How We Integrate

Prebuilt connectors for SIEM, EDR/XDR, IAM, email security, cloud, threat intelligence, ITSM, data stores, and more.

Universal HTTP/webhook steps to call any REST API, receive events, and normalize responses.

Custom integration builder to define auth, actions, and outputs in minutes (no waiting on a new connector).

Headless APIs for embedding automation behind your UI, exposing “one-click” actions inside your product.

ChatOps and Interact to run workflows from Slack/Teams or secure web forms for human-in-the-loop steps.

Hybrid and on-prem options to operate wherever your customers do — cloud, datacenter, or air-gapped.

AMP Partner Spotlights: Better Together

Torq is trusted by security teams across various industries, including finance, technology, consumer goods, fashion, hospitality, and more. Here’s how Torq works with the best in the business to deliver exceptional SecOps outcomes. You can also watch demos on how these integrations work here.

Torq + Intezer: Agent-to-Agent Collaboration

Torq and Intezer partner to deliver forensic-grade agentic alert triage and autonomous threat remediation — enabling customers to build an autonomous SOC that can handle massive alert volumes, eliminate alert fatigue, and prevent analyst burnout. With Intezer AI agents triaging and analyzing events in seconds, and Torq’s AI SOC Analyst, Socrates, auto-remediating over 95% of Tier-1 and Tier-2 security alerts, these agents work together like a seasoned SOC team, leaving humans to focus on critical threats.

Torq + Wiz: Cloud Threat Intelligence in Action

When Wiz detects a cloud security issue, like an exposed S3 bucket, dormant IAM credential, or misconfiguration, it can trigger a Torq workflow. Inside Torq, prebuilt Wiz steps let you list, query, and update findings, then fix issues automatically or with quick approvals: disable risky users, tighten access, enable versioning, and notify owners in Slack or Teams. Torq adds MITRE ATT&CK tags, AI summaries from Socrates, our AI SOC analyst, and full case management so cloud issues turn into clean, documented fixes.

Torq + Zscaler: Enforce and Respond in Real Time

Torq integrates seamlessly with Zscaler to automate cloud security enforcement and incident response. When Zscaler detects risky web traffic, policy violations, or malicious file downloads, alerts can flow directly into Torq.

Torq enriches it with context from threat intelligence, IAM, and endpoint tools and then acts in real time: blocking destinations, disabling compromised accounts, notifying users, and creating ITSM tickets. Together, Zscaler and Torq cut MTTR, keep policies consistent across devices, and lighten the load on your analysts.

Torq + Cyera: Auto-Remediate Data Risk

Joint customers can ingest Cyera detection events into Torq via webhook triggers and then enrich or act upon them with dedicated Cyera workflow steps, like retrieving classifications or datastore details, using API key authentication.

In practice, this means that when Cyera detects a data risk — say, a public-facing S3 bucket or a misconfigured access policy — Torq can immediately launch a tailored auto-remediation workflow. Whether revoking access, closing exposures, or notifying stakeholders, Torq executes those actions autonomously and at machine speed.

Torq + Panther: Cloud Detection and Response

Panther streams high-fidelity alerts from AWS, GCP, Azure, and SaaS apps into Torq. Torq enriches each alert with threat intel, identity, and asset context, then automates next steps such as isolating endpoints, rolling back permissions, pinging Slack/Teams, or creating ITSM tickets. The result is lower MTTR, less manual work, and consistent response across multi-cloud environments.

Torq + Reco: Automate SaaS Risk

Torq and Reco integrate to deliver smarter SaaS security by connecting Reco’s visibility into user activity and data sharing with Torq’s Hyperautomation engine. When Reco detects risky SaaS behaviors — such as overshared files, sensitive data exposure, or suspicious user actions — those alerts flow directly into Torq workflows.

Torq enriches each event with IAM, threat intel, and business context, then orchestrates the right response, from revoking sharing permissions to disabling compromised accounts or notifying stakeholders in Slack, Teams, or Jira. Reco and Torq enable SOC teams to quickly mitigate SaaS risks, enforce governance policies automatically, and cut down the manual work that slows SaaS security operations.

See all of our integrations >

What Partners Get with AMP

You’re not just another logo on a page for us. Here’s what you get with Torq AMP:

Ready-to-ship blueprints: Production-ready playbooks that make your product shine inside real SOC workflows.
Fast-track integration: Your own Torq instance, hands-on SE support, and a clean path from concept to live integration without red tape.
Go-to-market that actually goes somewhere: Joint demos, field events, aligned sales plays, and enablement.
Marketplace momentum: Front-and-center placement, discoverable listings, and packaged use cases that customers can deploy in minutes.
Proof that sells: Built-in telemetry and dashboards that quantify MTTR reduction, auto-resolved cases, and analyst hours saved/
Marketing with muscle: Tap the Torq brand — social, campaigns, solution briefs, in-product exposure, and (yes) custom swag to light up launches.

Not Just Another Solution. The Solution That Makes Every Other One Better.

Torq doesn’t replace your product or your customers’ investments. It amplifies them. If you want your cybersecurity solution to do more inside the SOC — automatically — Torq is the automated security solution that makes your security product (and your customers’ entire stack) shine.

Watch The AMP’d Sessions video series to see how Torq and partners like Intezer, Wiz, Zscaler, Cyera, Panther, and Reco are solving real SecOps challenges in 15 minutes or less.

Or, build and launch a joint automation with us.

Become an AMP Partner

Watch an AMP Demo

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Autonomous SOC Hyperautomation News & Events

Fal.Con 2025 Recap: The Future of the SOC Is Autonomous

By Bob Boyle

September 18, 2025

4 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

The energy at Fal.Con 2025 was undeniable. Conversations weren’t about if AI belongs in the SOC — they were about how fast teams can adopt it, govern it, and get value fast. And across the Hub Expo floor, SOC leaders we talked to were blunt: Legacy SOAR is dead. The future is agentic AI and Hyperautomation, and it’s happening now.

The Current SOC Model is Cracking

SOCs are drowning under the weight of alerts, manual triage, and analyst churn. With thousands of alerts per day and too few analysts to investigate them, it’s no surprise so many threats slip through the cracks.

Legacy SOAR platforms like XSOAR aren’t helping — they’re holding security teams back. Monolithic, slow, and code-heavy, they trap analysts in brittle playbooks and endless swivel-chair work.

That’s why so many conversations at Fal.Con 2025 gravitated toward the joint value of Torq Hyperautomation™ and CrowdStrike Falcon. Together, they’re giving SOC teams what legacy SOAR never could: automation at scale, real-time intelligence, and a foundation for truly autonomous security operations.

What Everyone Was Talking About at Fal.Con 2025

AI or die. SOC leaders agreed: Adversaries have AI, so SOCs need AI just to survive. With Torq + CrowdStrike, AI agents and automated workflows already cut Tier-1 work by over 95%, proving autonomy isn’t a future dream; it’s a reality in production at Fortune 500s.

Bridging SecOps + IT. Conversations weren’t about Torq versus CrowdStrike, but about how the two together unify security and IT operations into a seamless, coordinated defense. Falcon Fusion provides real-time data aggregation and automation within the CrowdStrike ecosystem; Torq orchestrates it into automated case lifecycles that span broader Hyperautomated use cases across both IT and security domains.

Agentic AI in practice. SOC leaders weren’t looking for another dashboard. They wanted AI that helps analysts cut through noise and focus on real threats. With Socrates, Torq’s AI SOC Analyst, enriched CrowdStrike detections become fully triaged cases, escalated only when human judgment is needed.

Multi-SIEM strategy. With many security teams migrating log aggregation to CrowdStrike Fusion, analysts are searching for a way to adhere to data retention compliance policies while maintaining a way to take action on logs stored in multiple data lakes. Torq becomes the solution to the multi-SIEM challenge, sitting at the center of disconnected data lakes to automatically query, correlate, and streamline data management across the entire environment.

Live from the Fal.Con Theater: AI or Die

One of the highlights of Fal.Con 2025 was our standing room-only theater session, “Achieving the Autonomous SOC with AI Agents,” led by Chris Coburn, Torq’s Sr. Director of Tech Alliances. and myself. The message hit home: adversaries have AI — SOCs can’t afford to stay manual.

Key takeaways:

AI agents are the next frontier. Gartner projects that AI will increase SOC efficiency by 40% by 2026, and Torq Socrates is already proving that today.
Agentic reasoning is key to building trust. Torq’s AI agents provide clear, immutable agentic execution logs, giving security leaders trust in the decision making and autonomous actions of AI.
Autonomy is real. IDC validated that Torq HyperSOC™ enables SOC teams to cut investigation time by up to 90% and handle 3–5× more cases without adding headcount.
From burnout to resilience. Agentic AI reduces alert fatigue, eliminates Tier-1 grunt work, and empowers analysts to focus on higher-value investigations.

The audience agreed. SOC leaders don’t want more dashboards or point tools. They want a path to SOC autonomy that’s proven, practical, and safe to deploy at scale — and Torq + Crowdstrike deliver that blueprint.

Torq + CrowdStrike: Better Together

Torq Hyperautomation™ and CrowdStrike Falcon are the new foundation for autonomous SecOps. Together, they deliver:

Seamless integration. Day-one automation across Falcon detections, incident response, and vulnerability management.
Built for scale. Multi-tenant support for MSSPs and elastic performance for enterprise SOCs.
AI-driven autonomy. Socrates (Torq’s AI SOC Analyst) and Falcon Fusion power real-time triage, enrichment, and auto-remediation.

Proven outcomes:

10× faster response times
95%+ Tier-1 tasks auto-remediated
Near real-time case management with Falcon LogScale
11.5 million Torq + CrowdStrike automated actions every year across 150+ organizations

See Torq in Action

Fal.Con 2025 made it clear: the SOC model is shifting — from manual dashboards and legacy SOAR to agentic AI and Hyperautomation. Torq + CrowdStrike are already powering autonomous SecOps at scale, from enterprises to MSSPs.

Join our team for a live demo to see how your SOC can cut MTTR by 75% in under 90 days.

Register Now

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Autonomous SOC Customers Hyperautomation

90 Days to SOC Autonomy: How Torq Customers Get There

By Torq

September 16, 2025

8 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Security operations shouldn’t be defined by burnout, backlog, and brittle tools. Torq HyperSOC™ replaces the slow, manual SOC model with an autonomous system powered by agentic AI, Hyperautomation, and seamless stack integration.

In just 90 days with Torq, security teams move from reactive to proactive — automating Tier-1 triage, accelerating response, and freeing analysts to focus on what matters most.

The 90-Day Path to SOC Autonomy

30 Days: Kickoff, Connect, and Ship Quick Wins

In the first 30 days with Torq, the focus is on standing up the platform, connecting your stack, and shipping quick wins. Guided by a dedicated Torq team, your SOC enables SSO and role mapping, lights up core integrations like M365/Defender, Okta/Entra, CrowdStrike, Slack, Jira, AWS, etc, and launches the first workflows — phishing triage, EDR alert handling, or cloud misconfiguration detection.

During this phase, your builders are also trained on workflow design, testing, and debugging. By the end of the first month, automations are live, Tier-1 alert noise is already dropping, and analysts are reclaiming hours once lost to swivel-chair triage.

60 Days: Scale Coverage, Standardize, and Measure

In the next thirty days, the focus shifts to scaling and simplifying. A second wave of workflows expands coverage into IAM offboarding, IOC enrichment, login anomaly detection, and user behavior signals. Socrates, Torq’s AI SOC Analyst, is deployed to handle Tier-1 triage, enrichment, and case summaries.

Teams tune thresholds, implement deduplication and correlation rules, and adopt modular subflows and templates to accelerate workflow reuse — especially valuable for MSSPs managing multiple tenants. Automation KPIs like MTTR, suppression rate, and analyst touches per case are established to measure impact. At this stage, broader automation coverage reduces false positives, alert fatigue decreases, and builders independently ship new workflows.

90 Days: Autonomous with Humans on the Loop

By the end of three months, your SOC begins operating as an autonomous system with human-in-the-loop guardrails. Socrates orchestrates the entire case management lifecycle from ingestion through enrichment, correlation, decision, response, and documentation. Analysts only step in for escalated incidents. Standard operating procedures and runbooks are finalized, intake and closure criteria are standardized, and before-and-after benchmarking is completed to prepare for the first quarterly business review (QBR).

The outcomes are transformative: up to 90% of Tier-1 alerts are automated end-to-end, MTTR drops by more than 60% on core use cases, and analysts shift from reactive case handling to proactive oversight, threat hunting, and strategic improvements.

What to Measure in the First 90 Days of Your AI SOC

Adopting Torq isn’t just about improving detection and response; it’s about proving measurable business impact within the first 90 days. Here are the key metrics to track:

MTTR/MTTI: Compare before-and-after times across common use cases to demonstrate immediate efficiency gains.
Automation coverage: Track the percentage of Tier-1 alerts that Torq fully handles end-to-end. Mature customers often see ~90% automation coverage by day 90.
Suppression rate: Measure how many false positives are automatically identified, documented, and closed with retained evidence — cutting analyst workload and improving accuracy.
Analyst touches per case: For Tier-1 incidents, the target is near-zero touches. Analysts should only step in for risk-gated actions or escalations.
Onboarding hours per tenant (MSSPs): For managed services, this is a critical margin lever. Track the reduction in time to first value when onboarding new customers.
Tool consolidation savings: Document scripts, point automations, and legacy SOAR licenses retired as Torq unifies orchestration into a single platform.
Audit readiness: With evidence generated automatically in real time, compliance prep shifts from weeks of manual effort to hours of reporting.

Torq ensures customers hit these ROI milestones with a dedicated team, JumpStart implementation accelerators, and the Torq Academy training program. Teams also have 24/7 access to the Torq Knowledge Base for self-service support. This combination of hands-on guidance and self-service enablement ensures both rapid adoption and long-term maturity.

90-Day Autonomous SOC Wins From Torq Customers

Valvoline: Saving Analysts 6–7 Hours a Day

When Valvoline’s security team faced major resource constraints during a corporate divestiture, they needed a platform that could help them do more with fewer analysts. Within just one week of deploying Torq, Valvoline was up and running on its top-priority use cases, including phishing response and EDR alert handling.

Torq’s no-code workflows immediately cut down on repetitive triage work, saving analysts between six and seven hours every single day. A Rapid7 integration that had stalled for months under their legacy SOAR was delivered in just days with Torq, proving the platform’s ability to integrate seamlessly and deliver value fast.

Learn how to easily migrate from SOAR to Torq >

Global Health and Wellness Company: Proving SOC Value with Data in 60 Days

A global health and wellness company needed a way to bring visibility and maturity to its in-house SOC. With Torq, they stood up full end-to-end case management in just six weeks, consolidating data across SIEM, cloud, and identity tools. Within two months, the team had automated 89% of cases and reduced MTTR by 60%.

Beyond efficiency gains, Torq’s case taxonomy and structured workflows gave this organization the ability to present clear, data-driven ROI narratives to executives, transforming the SOC from a reactive cost center into a proactive value generator.

HWG Sababa: Doubles SOC Output Without Adding Headcount

Italian MSSP HWG Sababa serves customers across Europe, the Middle East, and Central Asia. Before Torq, their analysts were drowning in manual Tier-1 tasks, struggling to meet customer SLAs without expanding headcount. By deploying Torq Hyperautomation™, HWG Sababa automated 55% of their monthly alerts within weeks. MTTR dropped by 95% for low- and medium-priority incidents and by 85% for high-priority threats.

This surge in security automation nearly doubled the SOC’s operational capacity, allowing analysts to focus on advanced investigations and strategic work while still delivering faster, more consistent outcomes to customers.

Global Online Money Transfer Platform: Cuts Alert Handling Time by 30%

A leading financial services provider replaced its in-house threat management system with Torq Hyperautomation and saw immediate results. Within days, the team unified its entire security stack — AWS, Microsoft 365, Active Directory, SentinelOne, and more — into Torq’s platform.

The outcome: 30% time savings, 90%+ of alerts automatically investigated and remediated, and IAM tasks reduced from a full day of work to just three minutes. With enterprise-grade, multi-tenant architecture meeting strict regulatory demands, the company now scales security operations efficiently without adding headcount, all while maintaining compliance across global finance regulations.

Why Customers Ramp Up Fast with Torq HyperSOC

Agentic AI (Socrates): At the core of Torq HyperSOC™ is Socrates, our AI SOC Analyst, designed to handle the full case lifecycle for Tier-1 and Tier-2 incidents. Socrates automatically triages incoming alerts, enriches them with context from threat intelligence and internal data sources, documents every step, and even remediates routine cases without human intervention. By offloading repetitive triage and investigation tasks, Socrates drastically reduces MTTR while ensuring every action is logged, auditable, and defensible. Analysts are only engaged when higher-value judgment or escalations are required.

No-code/low-code and AI workflow builder: Torq empowers both analysts and engineers with a no-code/low-code and AI workflow builder, while still offering full-code capabilities for team members who want to go deep. Teams can design and deploy complex workflows in hours instead of weeks using a drag-and-drop canvas. Reusable subflows and golden templates accelerate scale, while audit-ready logging ensures every action is captured for compliance and accountability. This approach eliminates the need for scarce developer resources while allowing security teams to easily adapt and expand their automations as threats evolve.

300+ prebuilt integrations: Torq connects to virtually any tool in the modern SOC ecosystem, with hundreds of prebuilt integrations covering SIEM, EDR/XDR, IAM, cloud platforms, ITSM systems, email and chat, and threat intelligence sources. Torq offers containerized and custom connectors for niche or proprietary tools to ensure nothing is left out. This deep integration library makes Torq the connective tissue of your SOC, breaking down silos and ensuring every system can work together in real time.

Built for scale: Unlike legacy SOAR, Torq is designed for modern enterprise and MSSP scale. Its multi-tenant, event-driven architecture supports seamless onboarding across multiple environments without duplicating infrastructure. Workflows execute in parallel at massive scale, enabling real-time enrichment and response even in the face of thousands of daily alerts. Enterprise-grade role-based access control (RBAC) and single sign-on (SSO) provide the governance and security compliance needed to run automation at scale across complex organizations and managed service environments.

Get Your SOC Autonomous in 90 Days

If you’re building a modern SOC, you don’t need more dashboards — you need outcomes.

In 90 days, Torq HyperSOC turns “too many alerts, too little time” into a repeatable, autonomous system: ~90% of Tier-1 handled end-to-end, MTTR slashed, and analysts freed up for threat hunting and strategy. Socrates drives the case lifecycle, the no-code and AI workflow builder scales your best practices, and 300+ integrations make your entire stack work as one.

Stop fighting backlog with headcount. Start operationalizing automation with guardrails, evidence, and real ROI your leadership can see by the next business quarter.

Get the 90-Day Roadmap

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

Contents

Get a Personalized Demo

Inside the Torq + Zscaler Integration

Step 1: Zscaler Deception: Proactive Zero Trust Detection

Step 2: Torq HyperSOC: Autonomous Correlation and Response

The Zero Trust SOC Advantage

Better Together: Torq + Zscaler

Related Articles

Smarter, Faster, Autonomous: Cloud Security with Wiz + Torq

Agent-to-Agent: How Torq + Intezer Power the Autonomous SOC

Get AMP’d: Introducing the Torq Alliance & Momentum Partner Program

Ready to automate everything?

Contents

Get a Personalized Demo

What Is an Escalation Matrix and Why It Matters

Manual SOC Threat Escalation: The Old Model

AI-Powered Threat Escalation for SOCs

How the Autonomous Threat Escalation Matrix Works

From Framework to Action

Why Risk Beats Severity Every Time

FAQs

Related Articles

The Autonomous Threat Escalation Matrix

Life in the SOC Sucks. Here’s How HyperSOC Can Save Us

Security Operations Center Best Practices to Boost Security & Automate Smarter

Ready to automate everything?

Contents

Get a Personalized Demo

Nightmare 1: Buried Alive (Alert Fatigue & Data Dumping)

Nightmare 2: The Silent Scream (Critical Alerts Ignored)

Nightmare 3: Code Red (Reactive Firefighting)

Nightmare 4: The Empty Chair (Burnout & Turnover)

Nightmare 5: The Monster You Can’t Kill (Legacy SOAR)

Wake Up From the Nightmare

Related Articles