Welcome to The Torqtionary. From agentic AI and context graphs to SOC memory and autonomy controls, this is your go-to glossary for building, scaling, and owning an AI SOC.
An AI SOC runs the complete threat lifecycle: triage, investigation, response, and remediation, with your analysts in control. The plainest test: if it can’t take action, it isn’t an AI SOC.
Torq Hyperautomation™ puts deterministic and agentic logic on the same canvas, so you get predictability where you need it and reasoning where you want it, across more than 400 integrations.
Instead of waiting for human input, agentic AI autonomously evaluates conditions and responds, freeing up analysts to focus on critical threats, not busy work.
The difference between AI that answers and AI that gets better. Context grounds every decision in your environment, memory gives it precedent from cases your team already closed, and learning turns your analysts’ judgment into how the platform rules next time.
Agentic AI
Autonomous, goal-oriented AI that plans, executes, and adapts across multi-step processes without human intervention.
Agentic Builder
Your SOC engineer’s new favorite coworker. Describe what you need in plain language, and Agentic Builder plans, codes, tests, and deploys a production-ready AI Agent across your stack.
Agentic SOC
The SOC that fights back without being told to. Powered by autonomous AI Agents that reason, decide, and act across the full case lifecycle so humans focus on judgment, not triage.
AI Adoption
The moment your team realizes humans shouldn’t be doing all the work and decides to integrate AI technologies into existing security workflows and systems.
AI Agent
An AI-powered specialist that handles specific tasks like enrichment, remediation, or ticket updates.
AI Cybersecurity Tools
Software platforms that use AI to make security operations more integrated, seamless, and fast.
AI Data Transformation
Turns messy security data into clean, actionable intelligence — no code required.
AI Guardrails
The rules, filters, and controls that keep AI from misinterpreting instructions or going rogue.
AI Hallucinations
When AI makes stuff up and presents it with confidence.
AI SOC
A Security Operations Center (SOC) powered by artificial intelligence (AI) to automate threat detection, triage, investigation, and response.
AI SOC Platform
The full package. A unified platform that runs the complete threat lifecycle autonomously, from triage through investigation, response, and remediation, with transparent reasoning and controls the security team sets. The plainest test: if it can’t take action across the lifecycle, it isn’t an AI SOC.
AI SOC Analyst
The AI team leader that directs specialized AI agents to deal with low-level security threats from start to finish independently. It also gives human analysts context and insights to make better, faster decisions for critical cases.
AI Washing
Slapping exaggerated “AI-powered” claims on old tech like it’s a rebrand.
Alert Fatigue
The exhaustion analysts feel when bombarded by excessive alerts — many of which are false positives or low-priority. Often leads to missed threats or slower response.
All Gas, No Brakes
A mindset. How we build, ship, and support. We move fast because our customers need us to. Just bold ideas, rapid execution, and relentless focus on delivering real outcomes.
AMP (Alliance and Momentum Partners)
A bold new model for cybersecurity partnerships — AMP strips out red tape to help partners build, integrate, and grow fast.
Artificial Intelligence (AI)
Robots that can reason. In cybersecurity, AI detects threats, predicts attacks, automates responses, and handles case grunt work.
Auto Triage
The agentic triage engine in the Torq AI SOC Platform. It applies business context, threat intelligence, and your own history to deliver a verdict and suppress noise before an analyst is involved, turning true positives into cases automatically.
Automated Incident Response
The use of AI-driven workflows to instantly detect, investigate, and remediate security threats without human intervention.
Automated Security Operations
Using scripts, platforms, or AI to execute security tasks through technology-driven workflows. Essential for reducing manual effort and improving SOC efficiency.
Automated Threat Hunting
Proactive, always-on AI sleuthing that uncovers the threats hiding in your blind spots.
Automated Threat Intelligence
Data about cyber threats and threat actors used to inform detection, investigation, and response.
Autonomous SOC
Your dream come true. A fully automated SOC where AI independently handles most Tier-1 alerts, freeing analysts to focus on critical cases and strategic work.
Auto-Remediation
Automated actions taken to fix or contain a security issue without human input.
Bone Bucks
An ancient currency shrouded in mystique, exclusively redeemable in the Torq store in exchange for our iconic merch.
Case Management
Tracking evidence, actions, and decisions from the beginning to end of a security issue, all in one place.
Case Summaries
Recaps of security incidents. Like TL;DRs for alerts.
Cases Dashboards
Gives real-time visibility into case volume, status, ownership, SLA tracking, and resolution metrics — so security leaders stop guessing and start proving what their team actually delivers.
Chatbot
An AI-driven assistant that collects information, initiates workflows, and streamlines SOC processes.
CISA Secure By Design
A government-backed pledge to build cybersecurity in from the start, not bolt it on later. (Yes, we signed it.)
Cloud
Hosts your apps, data, and infrastructure off-prem.
Cloud-Native
Built for the cloud from Day 1. Designed to run, scale, and evolve in dynamic cloud environments.
Cloud Security
The technologies and processes used to protect cloud-based infrastructure, applications, and data.
Cloud Security Automation
Automated workflows and tools that monitor, detect, and remediate cloud-specific threats, such as misconfigurations, unauthorized access, or insecure APIs.
Cloud Security Posture Management (CPSM)
Tools that identify and fix cloud misconfigurations and compliance issues to reduce risk.
Compliance
Adhering to cybersecurity standards, laws, and frameworks like PCI DSS, HIPAA, or NIST.
Confidence Score
A calibrated measure of how sure a model is in its verdict. High confidence drives automated action, low confidence routes to a human. It’s what makes autonomy safe rather than reckless.
Continuous Integration and Continuous Deployment (CI/CD)
Automates building, testing, and deploying code so updates go live fast and securely.
Context Graph
A live, organization-specific model of your environment covering identities, assets, privileges, policies, and past decisions. A knowledge graph tells you what you have. A context graph determines what it means.
Cyber Crisis Simulation
A dress rehearsal for your worst day. A scenario emulating a real cyber threat, challenging teams to prioritize actions, assess risks, and make decisions under tight time constraints so you’re ready for the real thing.
Cyber Resilience
How well your organization can prepare for, respond to, and recover from cyber threats.
Dashboards
Visual interfaces used to monitor SOC operations, track security metrics, and gain insight into alerts, threats, and automation performance.
Data Agent
The data wrangler. This Hyperautomation agent transforms JSON on the fly, generating JQ commands to ensure seamless compatibility between workflow steps.
Data Security Automation
Automated controls and policies that keep sensitive data locked down, even when environments shift.
Data Transformation
Reformatting and enriching raw data so it’s compatible across tools and can actually be used in workflows and alerts.
Deterministic Automation
Automation that executes the same way every time. In an AI SOC, it’s what carries out what the agentic reasoning decides, so you get machine speed without unpredictable machine behavior.
DevOps
The fusion of software development and operations into one fast-moving, automation-first machine.
DevSecOps
DevOps with security baked in, not bolted on. DevSecOps weaves security checks, scans, and controls into every stage of the software pipeline.
Email Security
Technology that protects against phishing, spam, and malware threats delivered via email.
Endpoint Detection and Response (EDR)
Security tools that detect, investigate, and respond to threats at the device level.
Enterprise-Grade Architecture
Structural foundation that connects business goals to IT and security processes, data, and tech so you can drive change fast, stay aligned, and automate securely.
Extended Detection and Response (XDR)
A unified approach to threat detection and response that pulls together data from across endpoints, networks, cloud, and more.
Fraud Response (Automated)
Instant, AI-driven action triggered by suspicious activity, like freezing accounts, blocking transactions, or triggering investigations.
Generative AI (GenAI)
AI that learns from massive datasets to write, explain, and summarize.
gRPC
An open-source framework that enables high-performance communication between services.
Human-in-the-Loop
The AI waits for a human to approve before it takes action.
Human-on-the-Loop
The human has seen the agent work and trusts it to act under defined conditions, and can always go back and check the agentic work afterward.
Human-AI Collaboration
The cybersecurity dream team. AI gives insights, analysts lead, and AI executes.
HyperAgents
Torq HyperAgents® are purpose-built, transparent, and autonomous AI specialists that reason, decide, and act across security workflows — adapting to edge cases and evolving threats without brittle playbooks or constant hand-holding.
Hyperautomation (Security Hyperautomation)
The automation foundation underneath the Torq AI SOC Platform. Deterministic and agentic logic on the same canvas, so you get predictability where you need it and reasoning where you want it.
Identity and Access Management (IAM)
Managing who gets in, what they do, and how fast they’re locked out if things go south.
Impossible Travel Detection
Flags logins from geographically distant locations that defy physics — often a sign of credential compromise.
Indicators of Compromise (IOC)
Digital breadcrumbs left behind by attackers, like malicious IPs, domain names, file hashes, or registry changes, that signal your environment may have been breached.
Incident Response Automation
Automating the detection, triage, containment, and remediation of security incidents.
Incident Response Tools
The arsenal your SOC uses to detect, investigate, and neutralize threats. From SIEM and EDR to ticketing and communication platforms — the tools themselves matter less than whether they actually talk to each other.
Integration
Tool A talks to Tool B, C, D, and E. Your workflows get more effective.
ITOps
The team managing infrastructure, uptime, and systems.
Just-In-Time (JIT) Access
Providing temporary access privileges only when needed, then revoking them automatically to reduce risk.
Kill Your SOAR
The bold, necessary act of replacing brittle, code-heavy legacy SOAR tools with AI-native, no-code Hyperautomation.
Knowledge Graph
An inventory of what exists in your environment: assets, identities, topology. Useful, but not the same as context.
Large Language Model (LLM)
The “brain” behind GenAI. It reads, writes, and predicts — but still needs context.
Lift and Shift
Moving legacy SOAR playbooks to modern automation solutions without rethinking or consolidating your workflows. (BAD)
Log
Recorded data from systems and devices that provide context for detecting and investigating security events.
Managed Detection and Response (MDR)
A third-party team that detects, analyzes, and responds to threats so you don’t have to fly solo.
Mean Time to Detect (MTTD)
How fast your tools and team spot a threat. Lower is better.
Mean Time to Identify (MTTI)
How long it takes to figure out if something is a real threat or a false positive.
Mean Time to Respond (MTTR)
The average time it takes to resolve a security incident from detection to remediation.
MTTx
Any SOC metric that starts with “Mean Time To…”
MITRE ATT&CK Framework
A knowledge base of adversary tactics, techniques, and procedures to improve threat detection and response.
Model Context Protocol (MCP)
A protocol ensuring AI outputs are grounded in the specific context of your environment and data.
Multi-Agent System (MAS)
A collection of autonomous AI agents, each with specialized tasks, working collaboratively to solve complex, multi-step problems in the SOC.
Multi-SIEM
The strategic art of juggling multiple SIEM platforms — made easier with Hyperautomation.
Managed Security Service Provider (MSSP)
A third-party provider that manages and monitors security services for organizations.
Natural Language Chats/Prompts
Everyday language to interact with AI systems and build automations without writing code.
No-Code/Low-Code Automation
Building workflows and automations without the need for programming skills.
Non-Human Identity (NHI) Management
Controlling access for bots, service accounts, and anything else that isn’t a person but still has credentials.
Orchestration
Connecting tools, people, and processes into a seamless symphony of security automation.
Phishing
Emails pretending to be legit. Don’t click.
Platform Lock-In
When your security stack traps you in one ecosystem.
Proof of Concept (POC)
A trial run of a solution to prove it works.
Pyramid of Pain (SOC Automation)
A framework showing how to gradually automate more of your security operations. The higher the pain, the better the payoff.
Ransomware
Malicious software that encrypts files and demands payment to restore access.
Retrieval-Augmented Generation (RAG)
An AI method that pulls relevant data from internal or external sources to improve the accuracy and relevance of generative AI responses.
Recall
Torq Recall is deterministic memory in Torq’s AI SOC platform. Recall matches on exact observables like IPs, file hashes, and hostnames rather than fuzzy similarity, then weighs how strong each match is, so an old verdict only counts when it’s genuinely relevant.
Reflex
Torq Reflex is the judgment layer in Torq’s AI SOC platform. Reflex learns how your analysts rule, including the evidence they demand before escalating, and applies that judgment to alerts it has never seen, with a confidence score that says when to act and when to hand off.
Retrospect
Torq Retrospect provides day-zero memory for Torq’s AI SOC Platform. Retrospect imports your historical incident data so the platform starts with your environment’s past rather than an empty one.
Runbook Automation
Automating pre-defined security procedures to standardize and accelerate incident response.
SDLC Automation
Automated enforcement of security best practices throughout the software development lifecycle.
SecOps
The collaboration of IT security and operations teams to detect, respond, and remediate threats.
SecOps Automation
Streamlining security and operations through automation to detect, neutralize, and resolve threats faster.
Security Automation
The use of technology to automatically perform security tasks and reduce manual workloads.
Security Operations Center (SOC)
A centralized team and environment that monitors, detects, and responds to cybersecurity threats.
Security Orchestration
Coordinating security tools, workflows, and processes through a centralized platform to streamline threat detection, response, and remediation.
Security Posture
Your current state of readiness against threats.
Security Stack
The collection of tools in your SOC — SIEMs, EDRs, firewalls, and (hopefully) Torq tying them all together.
Security Workflow Automation Software
Software (like Torq) that builds, runs, and scales security workflows across tools, teams, and clouds.
Shift Handover/Handoff
The SOC baton pass. Ensures incoming analysts quickly get a complete picture of ongoing incidents, open cases, and priorities.
SIEM Integration
Connecting Security Information and Event Management (SIEM) systems with automation platforms for enhanced detection and response.
Skelly
Torq’s 20-foot mascot, first spotted at RSAC 2026, Skelly doesn’t sleep, doesn’t take breaks, and never misses a threat. Now available in plushie form.
Slack Event
A trigger or action in a security workflow that involves collaboration or alerting in Slack.
SOAR is Dead
A legacy approach to automating security tasks using pre-scripted playbooks. It tried to help analysts move faster — but often ended up complex, brittle, and hard to scale. RIP.
SOAR Migration
Moving from a traditional SOAR platform to a next-generation automation solution to gain scalability, flexibility, and AI-driven capabilities.
SOAR Replacement
Your current SOAR isn’t cutting it. Torq does. Enough said.
SOC Automation
The use of software, AI, and orchestration to streamline and execute SOC tasks with minimal human intervention.
SOC Brain™
The learning layer of the Torq AI SOC Platform, made up of the Context Graph, Recall, Reflex, and Retrospect. It’s what makes the platform get more accurate with every case your team works.
SOC Nightmare
The daily horror show of alert fatigue, swivel-chair investigations, understaffed shifts, and threats slipping through because your team is buried in noise. The AI SOC is the wake-up call.
SOC Tool Sprawl
When your security stack breeds faster than your team can manage it. The average SOC runs seven AI tools — most of them disconnected. More consoles, more context-switching, more noise, less actual defense. The AI SOC consolidates the chaos.
Socrates
The agentic orchestrator of the Torq AI SOC Platform. It plans, reasons, and directs a fleet of specialized HyperAgents across the threat lifecycle, and it keeps every one of them scoped to the job it was given.
SOC Rationalization
Justify your SecOps budget by consolidating tools, cutting redundancies, and simplifying your stack with smarter automation.
SOC Reporting
Insights on SOC performance, response times, and incident trends.
SOC Transformation
The evolution from manual, reactive security to proactive, AI-powered, autonomous operations.
SOC 2
A must-have security standard for cloud vendors. SOC 2 proves your data handling is secure, trustworthy, and compliant.
Spear Phishing
Targets specific individuals with tailored messages using personal details scraped from LinkedIn, company websites, or previous breaches.
Stress Test
Simulated pressure on your SOC workflows to uncover failure points before attackers do.
Tactics, Techniques, Procedures (TTPs)
The blueprint behind every cyberattack. How adversaries operate: high-level goals, how they achieve them, and the specific tools they use.
Task Agent
Executes custom tasks from natural language prompts, unlocking endless automation possibilities. Drop it into any workflow stage and choose your preferred LLM to power it.
Threat Detection
Identifying malicious activity before it becomes an incident.
Threat Enrichment
Enhancing alerts with additional context from internal logs, threat intelligence, or user behavior to improve accuracy.
Threat Escalation Matrix
The rulebook for who gets paged when things go sideways — and how fast. A good matrix routes critical threats to the right humans instantly; a bad one buries real incidents in ticket queues.
Threat Hunting
Actively searching for hidden threats that bypass traditional defenses.
Tier 1 Alert
High-volume, low-complexity alerts — think noise, false positives, and known threats. With Torq, 95% are triaged, enriched, and resolved automatically by agentic AI before an analyst ever needs to look.
Tier 2 Alert
Escalated alerts that demand deeper analysis. These require context correlation, threat intel, and tailored response.
Torq
The AI SOC Platform. Torq combines agentic AI and automation to run the complete threat lifecycle: triage, investigation, response, and remediation, with your analysts in control.
TorqTV
Our official broadcasting network — home to all things chaotic, creative, and occasionally informative.
Triage
Analyzing and prioritizing alerts to determine which require immediate attention.
Trigger
An event or condition that kicks off an automated workflow or security action.
Vendor-Agnostic
Flexible by design. A vendor-agnostic platform works across any tool, stack, or provider, so you’re never locked into one ecosystem and can adapt as your needs evolve.
Vulnerability Management Tool
Continuously identifies, prioritizes, and helps remediate software and system vulnerabilities across your environment.
Workflow
A structured sequence of automated tasks or actions used to respond to a security event.
Whaling Phishing Attack
For the big fish. Targets C-suite executives and senior leaders with highly personalised attacks designed to exploit their authority and access.
XSOAR
Palo Alto Networks’ legacy SOAR platform. Requires heavy coding and manual maintenance. It’s time to move on.
Zero Trust
A security model that assumes no user or device is trustworthy by default, requiring continuous verification for access.
You’ve made it to the end of The Torqtionary!
Consider yourself fluent in the language of modern SecOps. Now want to see what the agentic SOC looks like in action? Get a demo.
Torq helps you harness AI in the SOC to detect, prioritize, and respond to threats faster.
Is your security team ready to automate more, faster?
