Valvoline Saves 7 Analyst Hours a Day with Torq Hyperautomation
Case Study Contents
Legacy SOAR Tools Were Breaking, Blocking, and Burning Time
When Corey Kenning stepped into the role of Senior Director of InfoSec at Valvoline, the company was in the midst of a massive divestiture. His team had been cut in half, down from 24 to 12, and urgently needed tools that empowered them to do more with less.
Their legacy SOAR was a bottleneck: deeply customized, code-heavy, and difficult to maintain. Only a handful of SMEs had the skills to build new use cases or troubleshoot integrations, and when the SOAR broke, it broke everything.
“We needed a platform that didn’t require hard-to-find coding skills. Our SOAR was slowing us down, not scaling us up.”
Corey Kenning, Senior Director of InfoSec at Valvoline
No-Code Scalable Automation That’s Easy to Use
Valvoline put Torq Hyperautomation™ to the test in a head-to-head evaluation against their legacy SOAR — and Torq delivered immediate wins. Within 48 hours, the team saw operational value. The result was clear: Torq delivered faster integrations, more intuitive workflows, and a future-proof foundation that even non-developers could manage.
“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”
Corey Kenning, Senior Director of InfoSec at Valvoline
Rapid7 integrated in days
One of the key tests during the proof of value was a Rapid7 integration that their legacy SOAR couldn’t get working after hundreds of hours. Torq got it running in under a week. Alerts now flow directly from Rapid7 into Torq and then into Slack, complete with automated context and response.
Real-time phishing response
Phishing was one of Valvoline’s biggest pain points. Before Torq, analysts spent up to 12 hours daily reviewing and triaging suspicious emails. Now, Torq automatically checks inboxes, correlates across security tools, and pushes actionable alerts into Slack. Analysts only step in when necessary.
Automated containment and case management
If a user clicks a malicious link, Torq not only alerts the Valvoline team, it can also initiate automated password resets, kick users off sessions, and launch containment actions across integrated platforms. All actions are tracked within Torq’s built-in case management system, enabling full visibility and metrics across incidents.
Built for everyone, not just developers
The team validated that even non-developers could build workflows in Torq. Features like drag-and-drop logic and in-platform testing made it easy for technical users without a coding background to automate confidently.
Immediate Time Savings, Long-Term Strategic Gains
Torq Hyperautomation delivered fast, measurable value to Valvoline’s SOC — eliminating the manual tasks that once consumed their analysts’ days. Within 48 hours of deployment, the team was running no-code workflows that automated phishing triage, accelerated alert handling, and reduced response times across the board.
The results were transformative. Analysts reclaimed hours of time, containment actions became automatic, and the security team evolved from reactive responders to proactive strategists.
6–7 analyst hours saved per day
Torq quickly converted high-friction phishing workflows into fully automated processes, reclaiming up to 7 analyst hours daily. Torq Hyperautomation autonomously monitors user email activity, correlates data across Microsoft 365, Defender, and CrowdStrike, and escalates only when necessary, cutting noise while increasing precision.
Improved analyst experience
The impact on team morale and performance has been significant. By removing tedious Tier-1 tasks and enabling fast, intuitive workflow building — even for non-developers — Torq has empowered Valvoline’s analysts to focus on innovation and deeper investigations.
Real-time response and containment
With Torq, high-risk user actions like clicking malicious links trigger immediate, automated responses: password resets, session terminations, and coordinated containment across integrated platforms. All activity is logged and tracked through Torq’s native case management, providing real-time visibility, audit-ready metrics, and accelerated incident resolution.
Operational ROI from day two
Valvoline realized value within 48 hours of deploying Torq — and they continue to expand its use across security and adjacent teams. What was once bottlenecked and brittle is now fast, flexible, and future-ready. With Torq, Valvoline has built a scalable automation foundation that grows with their business and unlocks new levels of operational efficiency.
“My team is in love with the product. Sometimes, I have to tell them to stop having so much fun and go do something else.”
Corey Kenning, Senior Director of InfoSec at Valvoline
Watch the Full Conversation
Valvoline Inc. is a leading automotive service provider, delivering fast, reliable preventive maintenance to keep customers safely on the road. With 17 consecutive years of same-store sales growth, Valvoline is rapidly expanding its network of more than 2,000 retail locations across the U.S. and Canada, aiming for 3,500 service centers. As the car park evolves, Valvoline continues to innovate, scaling operations and technology to meet the changing needs of modern drivers.
