Torq AMP spotlights the partners redefining what’s possible in security operations. Each partner brings a unique strength that seamlessly extends Torq’s autonomous SOC platform. Together, these partnerships help SOC teams achieve speed, accuracy, and scale that were once out of reach. Explore the future of SOC in the AMP’d Sessions video series.

For years, security teams have been trapped by legacy SIEM and SOAR solutions. They’re forced to make compromises — slashing data retention to 30 days to control costs, spending more time tuning brittle tools than hunting threats, and manually bridging the gap between a noisy alert and a meaningful response.

In the latest episode of Torq’s AMP’d Sessions, we sat down with Mike Olsen, Director of Partner Solutions Engineering at Panther, to discuss how customers are moving on from this broken model. They’re modernizing their SecOps data pipeline with Panther’s cloud-native data lake and Torq’s autonomous response.

Together, Torq and Panther deliver a closed-loop system that moves from detection to remediation at machine speed. Here’s how.

Panther’s Cloud-Native Data Lake: Built for the Modern SOC

The core problem with legacy SIEMs is their architecture. They weren’t built for the cloud era, forcing teams to choose between cost and visibility. Panther takes a different approach. 

The foundation to the Panther platform is leveraging a cloud-native, modern data lake architecture. This serverless approach provides four key benefits:

1. Limitless scale: “We have a customer that’s ingesting 40 terabytes daily,” Olsen noted. Teams no longer have to make compromises on what security logs to keep.
2. Long-term retention: Instead of 30 days, Panther customers can retain data for at least a year in hot storage, enabling threat hunting and long-tail investigations without requiring rehydration.
3. Data ownership: Your data stays in your cloud. Panther supports a “bring your own data lake” model, avoiding the vendor lock-in of traditional SIEM.
4. Separation of compute and storage: This allows teams to “query petabytes of data at peak performance” without bogging down the system.

On top of this data lake, Panther employs a “Detection-as-Code” model. This gives teams the flexibility to write, tune, and deploy detections using Python, a low-code builder, or even AI-assisted creation, all managed in a CI/CD pipeline.

How Torq Turns Detection into Autonomous Response

Panther provides the high-fidelity detection and AI-driven triage; Torq provides the autonomous action. When Panther generates a high-confidence alert, it doesn’t just send a raw log. It sends a rich, AI-triaged case summary. Torq HyperSOC™ ingests this data and hands it to Socrates, Torq’s AI SOC Analyst. This initiates an AI-to-AI communication that is fully explainable and auditable.

Socrates reasons through Panther’s findings, orchestrates the necessary response actions through Hyperautomated workflows, and documents every step — transforming Panther’s T1-to-T2 analyst elevation into a T3 strategic “analyst-as-validator” model.

“Panther identifies what is happening, and then Torq decides what to do about it next.”

– Bob Boyle, Product Marketing Manager, Torq

Inside the Demo: From Data Lake to Autonomous Remediation

The AMP’d session demo showcased this closed-loop system in action, remediating a sophisticated identity-based threat from start to finish.

1. The Detection (Panther)

A high-fidelity correlation rule fired in Panther, combining two separate events:

• Event 1: An Okta login from a “watch list” country (France).
• Event 2: An M365 enumeration activity (like Get Users or List Admins) from the same user within 30 minutes.

Individually, these might be noise. Together, they could be something more. Panther’s AI Triage autonomously analyzed the events, generated a summary: “This is an anomalous login. The user, Timothy, is based in the U.S., not France,” and exposed its thinking steps for human validation.

2. The AI-to-AI Handoff (Torq)

Torq ingested the correlated alert and Panther’s AI triage summary.

• AI-to-AI: A Torq AI Agent evaluated Panther’s findings: “Based on Panther’s analysis, is this showing signs of persistence?”
• The verdict: The Torq Agent confirmed “Recurrence: True,” mapped the attack to the MITRE Initial Access tactic, and automatically escalated the new case in Torq’s Case Management platform to ‘Critical’ priority.

3. The Autonomous Response (Socrates)

The critical case was automatically assigned to Socrates, Torq’s AI SOC Analyst, which followed its autonomous remediation runbook:

• Investigation: Socrates reached back into Panther, querying the data lake for more user activity logs to broaden the investigation.
• User verification: Torq’s communication agent autonomously interviewed the user, Timothy, directly in Slack: “Hey, Timothy, did you log in from France recently?” Timothy’s reply: “No.”
• Containment: Based on that “No,” Socrates immediately executed its containment plan: it disabled the user’s Okta account and added the malicious IP address to a company-wide blocklist.
• Notification: For business continuity, Socrates identified Timothy’s manager and sent them a Slack message: “Hey, there’s an active SOC incident… Timothy’s account is locked, and he won’t be able to respond.”

4. The Closed-Loop SecOps Pipeline

The entire cybersecurity lifecycle — from initial detection to full containment — happened in seconds. Every AI thought process, query, and action was logged in an immutable audit trail. The case was then escalated to a human analyst, not to work the alert, but to simply validate the autonomous actions already taken and close the case.

This partnership fundamentally changes the SecOps paradigm. It’s no longer a linear, manual handoff from a legacy SIEM to a brittle SOAR. It’s a single, intelligent, and closed-loop system, or what we like to call an autonomous SOC.

“What I’m most amped about is the combination of Panther’s AI-driven context from detection, and then combining that with Torq’s Hyperautomation for response. It’s really closing that loop and eliminating the manual gap between detection and action.”

– Mike Olsen,  Director of Partner Solutions Engineering, Panther

Better Together: Torq + Panther

For security teams, the Torq and Panther partnership means:

• Limitless scale: Ingest and retain all your security data in Panther’s data lake.
• AI-triaged detections: Eliminate noise with Panther’s high-fidelity, AI-analyzed alerts.
• AI-to-AI communication: Let Panther’s detection agents talk directly to Torq’s response agents for autonomous escalation.
• Autonomous remediation: Go beyond simple automation to fully remediate threats — from investigation to containment and user verification — without human intervention.
• End-to-end auditability: Maintain full, explainable audit logs of every AI decision and action, from detection to response.

Watch this workflow unfold in real time in the Torq + Panther AMP’d Session.

In today’s enterprise, data is both the most valuable asset and the greatest risk. Security operations are only as strong as their understanding of data — yet for most SOCs, data exposure remains a blind spot, sprawling across cloud, SaaS, and AI-driven environments faster than analysts can track.

Torq’s recent episode of the AMP’d Sessions spotlighted Cyera, the leader in data security and AI protection, to explore how its platform pairs with Torq HyperSOC™ to create an autonomous feedback loop between detection and response. This powerful partnership will also be on display at Cyera’s 2025 DataSecAI conference. 

Together, Torq and Cyera give SOC teams real-time visibility into data risk — and the power to remediate it instantly. Here’s how.

Inside the Torq + Cyera Integration

Every SOC stack looks different and that’s exactly why Torq HyperSOC™ was built to integrate with anything. From SIEM and EDR to DSPM, IAM, and XDR tools, Torq connects every signal, system, and workflow through a no-code, API-first architecture. That means every detection — no matter where it originates — can trigger an immediate, intelligent response.

The integration between Torq and Cyera exemplifies that vision. Cyera delivers deep visibility into data exposure risks across cloud and SaaS environments. When Cyera detects a sensitive data incident — like an exposed file containing personal or financial information — it sends rich, contextual telemetry directly into Torq.

Torq then automatically:

• Creates a case pre-populated with Cyera’s alert data, observables, and recommendations
• Correlates the event across security systems to validate and enrich context
• Orchestrates the next best action, from isolation to user verification, through agentic AI and security Hyperautomation

Cyera’s Data Detection Engine

Cyera gives security teams the superpower they’ve always needed: complete visibility into what data exists, where it lives, and how it’s exposed. Its Data Security Posture Management (DSPM) platform continuously scans every corner of an organization’s environment — from AWS buckets to OneDrive files — to identify sensitive data at risk.

Within minutes of deployment, Cyera classifies and contextualizes data across structured and unstructured sources. It goes far beyond standard identifiers like names or Social Security numbers — uncovering context-rich categories such as patient data, financial records, or proprietary business IP.

When exposure occurs, Cyera’s AI-driven analytics determine whether it’s accidental (like an overly permissive sharing link) or malicious. Each alert includes detailed metadata about the affected files, identities, and access patterns, giving the SOC immediate insight into what’s at stake. This level of visibility turns blind data into actionable intelligence. SOC analysts no longer have to guess which exposures matter — Cyera shows, explains, and prioritizes them.

With Cyera pinpointing every exposure across the data landscape, the next step is turning knowledge into action. That’s where Torq HyperSOC™ takes over — closing the loop between detection and response at machine speed.

How Torq Turns Data Detection Into Instant Action

Once Cyera flags a data exposure, Torq HyperSOC™ springs into action — automatically ingesting the alert, enriching it with context, and launching an autonomous response. The alert is passed to Socrates, Torq’s AI SOC Analyst, which correlates the finding across systems to understand its scope and impact and then autonomously initiates the right response.

In the AMP’d demo, Cyera detected a Microsoft 365 file publicly shared outside the organization containing patient insurance records and personal identifiers. Within seconds, the two platforms worked together to remediate the risk from start to finish.

Here’s how it unfolded:

1. Containment: Socrates immediately revoked public access to the OneDrive file, removing all anonymous sharing links.
2. Evidence collection: Torq automatically pulled audit logs from Microsoft 365, confirming when permissions changed and whether the file had been accessed.
3. User verification: Torq’s AI agent messaged the employee directly in Slack to confirm intent:
   1. “Hey, the sharing link for sensitive files from your OneDrive was set to Public Access, which violates policy. Did you mean to share this?” 
   2. “No, that was a mistake,” replied the user.
4. Manager notification: Socrates notified the user’s manager and documented the entire exchange in the case record.
5. Awareness and closure: The employee was automatically assigned a short data security awareness course. With no evidence of external access, the case was closed.

The entire process — from Cyera’s detection to Torq’s full remediation — took less than five minutes. Every action happens in real time, without waiting for a human to step in. SOC teams maintain oversight, but Torq handles the heavy lifting, creating a continuous feedback loop between Cyera’s detection and Torq’s autonomous response. 

“When Cyera flags a sensitive risk, Torq’s Hyperautomated workflows instantly take the next step — eliminating the gap between detection and response.”

– Jeremy Goldsmith, Cyera

The Reflexive SOC: From Reactive to Autonomous

For years, SOCs were reactive, flooded with data but slow to respond. The partnership between Cyera and Torq creates a reflexive SOC — one that doesn’t just see risk, but acts on it instantly.

“When you combine Cyera’s data intelligence with Torq’s orchestration, you get a new level of granularity and precision in how data risks are detected and resolved.”

– Ash Hunt, Cyera

Together, Cyera and Torq are transforming security operations into a closed, intelligent system where data protection becomes continuous, adaptive, and autonomous.

Better Together: Torq + Cyera

Every enterprise has unique SOC tools, data landscapes, and compliance demands. Torq and Cyera meet SOC teams where they are — integrating seamlessly via APIs to unify detection, investigation, and response across the entire data lifecycle.

For security teams, this partnership means:

• Real-time data exposure detection and containment
• End-to-end visibility and auditability across data flows
• Autonomous workflows that eliminate manual triage
• Faster MTTR and measurable customer value

Watch this workflow unfold in real time in Torq + Cyera’s AMP’d Session, where Britt, Bob, Ash, and Jeremy walk through how Torq HyperSOC™ autonomously remediates Cyera-detected data exposures.

Join Torq at DataSecAI 2025 to explore the future of autonomous data and AI security.

Today’s SOCs face never-ending alerts, hybrid environments, and fast-moving threats that exploit even momentary blind spots. Zscaler has long led the charge on Zero Trust, enforcing least privilege, secure access, and inspection across every user and workload. But even with strong prevention, threats inevitably slip through, hidden in user traffic, cloud workloads, or endpoint activity.

That’s where detection and response become critical — and where traditional SOC tools fall short. Manual triage, delayed investigation, and fragmented tooling leave SOCs reactive and overworked.

The solution is an autonomous, Zero Trust SOC — powered by real-time detection from Zscaler and automated, context-aware remediation from Torq HyperSOC™. Together, they create a closed feedback loop in which detection and response happen at machine speed without sacrificing human oversight or control.

“What excites me is the opportunity for security outcomes that one tool can’t do alone.”

 – Jeff Spencer, Senior Sales Engineer, Zscaler

Inside the Torq + Zscaler Integration

This integration brings together two pillars of modern security operations:

• Zscaler’s Zero Trust Exchange provides continuous inspection, policy enforcement, and high-fidelity detections across every user, device, and application.
• Torq HyperSOC™, which applies AI-driven automation, agentic AI, and case management to orchestrate instant, context-aware incident response.

Together, they form the foundation of a Zero Trust SOC — a system where every alert is verified, every workflow is automated, and every response is precise.

Step 1: Zscaler Deception: Proactive Zero Trust Detection

Zscaler’s Zero Trust Exchange is the industry standard for secure access — continuously verifying users, devices, and applications. With Zscaler Deception, that protection extends beyond prevention into active defense.

Zscaler deploys SaaS-based decoys across endpoints, networks, and applications, convincing high-value assets designed to lure attackers and expose lateral movement early in the kill chain. When a decoy is touched, accessed, or queried, Zscaler instantly flags it as a true positive event because legitimate users never interact with decoys.

These decoys reveal “patient zero” moments — detecting staged or dormant threats before execution — and provide defenders with the earliest possible warning to act.

Step 2: Torq HyperSOC: Autonomous Correlation and Response

Once Zscaler Deception raises an alert, Torq HyperSOC™ automatically springs into action. Torq’s AI SOC Analyst, Socrates, instantly correlates Zscaler telemetry with data from SIEM, EDR, IAM, and cloud systems to understand the full scope of the incident. From there, Socrates executes an agentic runbook — autonomously investigating, validating, and containing the threat.

The workflow looks like this:

1. Case Creation: Torq auto-generates a case populated with all Zscaler observables, file hashes, and context.
2. User Verification: Torq contacts the endpoint owner via Slack or Teams to confirm activity. If verified, a multi-factor authentication (MFA) check in Okta confirms legitimacy.
3. AI Reasoning: If suspicious, Socrates escalates and begins machine-speed containment, isolating the device, blocking the user, and updating Zscaler policies.
4. Remediation: Torq coordinates across EDR and IAM to revoke sessions, rotate credentials, and update blocklists.
5. Documentation: The entire process — from detection to containment — is logged automatically and complete with AI-generated summaries for compliance and audit.

Together, Zscaler and Torq create a closed feedback loop between detection and response in which:

• Zscaler traps attackers with decoys and identifies threats with surgical precision.
• Torq responds instantly, isolating endpoints, blocking IPs, and disabling compromised accounts before attackers can pivot.

This integration extends Zscaler’s zero-trust principles into the SOC itself, ensuring continuous verification and the least privilege at access throughout the entire response lifecycle.

The Zero Trust SOC Advantage

Zscaler + Torq deliver a SOC experience that’s both faster and smarter, with:

• Near 100% detection fidelity from Zscaler Deception
• Sub-minute containment triggered by Torq HyperSOC™
• Full auditability with automatic case creation, evidence tracking, and AI summaries
• Built-in human oversight, so analysts validate and learn from autonomous decisions

For SOCs, that means fewer false positives, faster containment, and measurable improvement. Zscaler and Torq close the loop between visibility and action, transforming zero-rust detection into instant containment.

Better Together: Torq + Zscaler

Every enterprise has a unique security stack: a mix of legacy systems, modern SaaS tools, and homegrown integrations. Zscaler and Torq meet customers where they are. The integration is API-first, customizable, and built to respect each organization’s ecosystem, delivering precise outcomes without forcing architectural changes.

The Zscaler + Torq partnership represents a new model for modern SOCs — one where AI agents and automation reinforce zero-rust principles across detection, investigation, and response.

See how Torq and Zscaler provide a foundation for the Zero Trust SOC. Watch AMP’d Sessions Episode 3 to see Torq + Zscaler in action.