Accelerating Torq’s Vision: Announcing Our Series C Funding Round
By Ofer Smadari, CEO
September 24, 2024
4 Minute Read
I’m excited to share some significant news that marks a pivotal milestone in Torq’s journey. We’ve successfully closed our Series C funding round, securing a $70M investment to propel our mission of revolutionizing SecOps through the Generative AI-based Torq Hyperautomation Platform and cutting-edge Torq HyperSOC solution.
A Journey Fueled by Innovation
When we launched Torq three years ago, our vision was clear: To transform SOC automation and operation teams with solutions that not only defend against sophisticated threats, but also streamline and hyperautomate SecOps at the largest global enterprises. During the past three years, our dedicated team has worked tirelessly to build the Torq Hyperautomation Platform which seamlessly integrates with any existing infrastructure and security tool, providing the unparalleled ability to instantly and precisely remediate security events, and orchestrate complex security processes at scale.
This funding round is more than just a financial boost. It reflects the confidence of our investors and the strength of our technology. We’re thrilled to continue pushing the boundaries of what’s possible in cybersecurity, particularly with a focus on Hyperautomation.
Doubling Down on Generative AI
A key highlight of this funding round is our commitment to double down on Generative AI. We recognize that Generative AI has transformative potential in enhancing cybersecurity. By integrating these advanced technologies into our platform, we aim to provide even more sophisticated threat detection, response automation, and predictive capabilities.
Generative AI will empower our systems to analyze vast amounts of data and generate actionable insights in real-time. This will not only improve the accuracy and efficiency of SecOps, but also enable our customers to stay ahead of adversaries with cutting-edge defensive measures.
What Series C Means for Us and Our Customers
Series C will accelerate our growth in several key areas:
Innovation and R&D: We’ll invest heavily in R&D to enhance our platform’s capabilities, ensuring we stay ahead of emerging threats and provide our customers with state-of-the-art solutions.
Expansion of Our Talent Pool: To drive our vision forward, we need the best minds in the industry. This funding will allow us to expand our team and bring in experts who are as passionate about cybersecurity and Hyperautomation as we are.
Market Penetration and Customer Growth: With this capital, we’ll accelerate our go-to-market strategy and scale our operations to reach more businesses and organizations globally. Our commitment to innovation has already attracted a rapidly growing customer base, and we are excited to extend our reach even further. New and existing customers will benefit from enhanced features, faster deployment, and robust security measures designed to meet their evolving needs.
Customer Success and Support: We’re dedicated to providing exceptional products and ensuring our customers have the support they need to maximize their investment in our technology. This funding will help us enhance our customer success programs and provide top-tier support to our growing client base.
Value for Our Growing Customer Base
Our expanding customer base is clear validation of our approach and the value we deliver. For our existing customers, this funding means we can continue to enhance and refine our platform, offering sophisticated tools and capabilities to keep their operations secure. For new customers, it represents an opportunity to leverage our state-of-the-art technology from a company committed to pushing the boundaries of cybersecurity and automation.
A Thank You to Our Partners and Team
This achievement would not have been possible without the unwavering support of our investors, partners, and incredible employees. Your collective belief in our vision and dedication to our mission have been instrumental in getting us to where we are today.
Looking Ahead
As we move forward, our commitment to innovation and excellence remains steadfast. We’re excited about the possibilities ahead and are more determined than ever to lead the way in cybersecurity and Hyperautomation. Together, we will continue to build a safer, more resilient digital world.
Thank you for your continued support and trust in us. Here’s to the next chapter of our journey!
The Evolution of Automation and AI for Security Operations
By Bob Boyle
September 23, 2024
8 Minute Read
Contents
In an era where cyber threats are constantly evolving, and security teams are overwhelmed by an ever-expanding flood of alerts, tech sprawl, and an ongoing talent shortage, modernizing the SOC is no longer optional — it’s imperative. AI for security operations offers the speed, intelligence, and resilience that today’s SOCs need to survive.
According to Gartner and IDC, automation and AI for security operations are the keys to unlocking new levels of efficiency, accuracy, and resilience in the fight against cyber threats. Learn how SecOps automation has evolved way (way) past SOAR and how SOC teams are putting agentic AI into action to elevate their teams and achieve machine-speed response times.
From Legacy SOAR to Hyperautomation + AI
Legacy SOAR came — and went. The security operations automation journey began with Security Orchestration, Automation, and Response (SOAR) as the primary automation and orchestration option for SecOps teams. However, as the cybersecurity landscape grew more complex and the volume of threats increased, SOAR’s limitations became glaringly evident. Gartner even went as far as to say “SOAR is Obsolete” in their latest ITSM Hype Cycle (2024), placing SOAR at the bottom of their “Trough of Disillusionment”.
Hyperautomation unleashed limitless potential. Unlike SOAR, Hyperautomation offered unlimited security integrations, simple-to-build automations, and cloud-native scalability. The incorporation of case management into a Hyperautomation engine helped mitigate alert fatigue by enabling automated remediation of false positives and other low-risk threats while more intelligently prioritizing comprehensive security cases in a meaningful way.
AI for security operations sped up the SOC. The next evolution of security automation involved leveraging generative AI to augment human expertise, enabling SOC teams to achieve machine-speed detection and response.
Agentic AI takes the wheel:Agentic AI is the next logical evolution of AI for security operations, delivering autonomous decision-making capabilities that can reason, plan, and execute goals without constant human supervision. It’s the brain behind the autonomous SOC, freeing up analysts to do the strategic work. IDC’s report highlights that agentic AI can solve problems, adapt to its environment, and make complex decisions without human intervention. This shift moves SOCs from human-in-the-loop to human-on-the-loop supervision.
The modern SOC has arrived. As Gartner recently highlighted, to overcome the existential challenges that continue to plague SOC teams, security operations must continue to adapt. This brings us to the future of SecOps, where the gold standard for the modern SOC is a purpose-built combination of Hyperautomation and agentic AI to achieve the autonomous SOC.
Benefits of Adopting Automation and AI for Security Operations
AI for security operations is critical not just for efficiency but for survival. It’s about alleviating the pressure on SOC teams, helping to avoid burnout and reducing the four million+ talent shortage gap that exists in the cybersecurity industry today.
Gartner predicts that “by 2028, AI in threat detection and incident response will rise from 5% to 70%, primarily augmenting — not replacing — human analysts.”
As Gartner highlights, while the growth of AI continues to expand, its primary aim should be to augment the existing staff operating the SOC, not replace them entirely. This is good to keep in mind, as many organizations are hesitant to fully entrust AI with their security operations. However, with the rise of AI used in targeted attack campaigns, most organizations do recognize that it is near impossible for humans alone to keep pace with today’s quantity and complexity of threats.
When implementing AI for security operations, the most successful benchmarks to strive for are:
The benefits of automation and AI for security operations are not in removing human decision-making altogether but rather in upskilling the most junior SOC analysts while preventing the most experienced analysts from burning out in their role.
To fully realize the potential of AI for security operations, organizations need a solution that combines context awareness and autonomous action. That solution is Socrates.
Introducing Socrates: Your AI SOC Analyst
Torq Socrates is our AI SOC Analyst capable of deep research, planning, and autonomous execution of end-to-end security case management. Socrates acts as an OmniAgent, coordinating multiple specialized AI Agents for contextual alert triage, incident investigation, and auto-remediation of Tier-1 tasks.
For critical threats, Socrates augments your team’s expertise — enabling them to take action faster thanks to natural-language, human-AI collaboration.
There are two primary ways SOC teams are using Socrates to handle security cases today:
Assigning cases to Socrates for end-to-end autonomous remediation
Faster human-on-the-loop remediation with AI augmentation
1. Autonomous Remediation
First, SOC teams can assign specific cases to Socrates for auto-remediation without requiring any human intervention.
In traditional analyst remediation, when a case is assigned, the analyst typically consults a runbook to guide them through the response required to contain the specific event (or events) that appear within the case.
From start to finish, the triage, investigation, and remediation of a single case can take a human analyst 30 minutes or more, depending on the experience level of the analyst. In larger enterprises, there may even be multiple analysts with varying responsibilities involved in the lifecycle of a case — one for the initial triage, one for the Tier-2 investigation, and another for the incident response.
Socrates follows the same runbook planning and execution process but instead leverages a team of AI agents to craft, plan, and execute highly customized incident response strategies — at machine speed. Socrates’ leverages agentic AI to analyze SOC-defined runbooks written in natural language, learn from past outcomes, identify attack patterns, and continuously refine response plans to adapt to new threat vectors — resulting in complete auto-remediation of 95% of cases in mere minutes.
For cases that increase in severity based on Socrates’ agentic investigation or as new case data is added, raising the threat to a critical level, SOC teams can build off-ramps into each runbook that tell Socrates when to escalate cases to a human analyst for intervention.
2. Faster Human-on-the-Loop Remediation
Which brings us to the second use case: leveraging Socrates to help SOC teams investigate and take action on the cases that do require human decision making — faster.
Analysts who are assigned critical cases for human-guided remediation can take advantage of Torq’s Multi-Agent System (MAS) by using natural language to chat with Socrates and ask for:
AI-generated case summaries: Faster access to real-time and historical case observables, attachments, associated indicators of compromise (IOCs), or current case status enables streamlined decision-making by eliminating irrelevant noise.
Deep research investigations: Enrich cases by uncovering hidden attack patterns across diverse data sources and third-party threat intelligence to help precisely assess the threat impact and improve strategic threat prioritization.
Agentic AI-augmented remediation: Take action across the security stack using AI agents to trigger complex remediation workflows through Torq’s Hyperautomation platform, significantly reducing the amount of time from case assignment to case resolution.
With Socrates, even a brand new analyst who hasn’t been trained on how to leverage the full functionality of every security solution in their stack can easily ask Socrates to deploy AI agents that can quickly quarantine devices, isolate hosts, or kick off a password reset — without the risk of human error.
In its simplest form, Socrates was built to do what Torq has set out to do from the very beginning: Hyperautomate SecOps. By coordinating a team of AI agents, Socrates can automate the most repetitive tasks and reduce Tier-1 triage and investigation by 90% — helping humans respond to threats faster.
Embracing Hyperautomation and AI for Security Operations
In an era where cyber threats are constantly evolving, the modernization of the SOC is no longer optional — it’s imperative. The inclusion of AI for security operations — like Torq Socrates — marks a pivotal shift in how SOC teams can combat alert fatigue, tech sprawl, and talent shortage.
By integrating Hyperautomation and AI, Torq HyperSOC exemplifies how AI for security operations drives faster detection, smarter decisions, and machine-speed remediation, achieving:
Up to 90% reduction in investigation times
3-5x increase in SOC alert capacity without additional headcount
Autonomous remediation of over 95% of security threats
AI for security operations lets teams regain significant amounts of time, allowing human analysts to focus on more strategic tasks while maintaining control over critical operations. The future of the SOC lies in this harmonious blend of human expertise and intelligent automation, setting a new standard for operational efficiency in security operations.
Want to learn more about the SOC’s evolution from automation to autonomy? IDC’s Spotlight Report explores why agentic AI for security operations is the next leap in the autonomous SOC.
The Future of Automated Threat Intelligence: 6 Enrichment Use Cases
By Torq
September 20, 2024
7 Minute Read
Contents
Cyber threats move fast — your threat intelligence should move faster. But most SOC teams spend more time drowning in false positives and manually correlating threat data than actually responding to real threats.
Automated threat intelligence changes this. With AI-driven automated intelligence, security teams can instantly collect, analyze, and act without sifting through endless alerts and indicators of compromise (IOCs). This shift from playing catch-up to a proactive, automated defense is critical to outpace attackers.
What is Automated Threat Intelligence?
Threat intelligence is the evidence-based collection of information and the observation of the capabilities, techniques, motives, goals, and targets of an existing threat. Simply put, it’s everything that you know about an attacker — actual or potential — based on their motives and how badly they can damage your business assets.
Threat intelligence is not a checklist. It’s a cycle of well-defined processes and operations that involves collecting raw data, cleaning and normalizing it into actionable observables, comparing it to current data to remove duplicates, and then storing it in a structured, human-readable format. That’s a lot of work.
And here’s the reality: SOCs are flooded with data — OSINT feeds, commercial intelligence, SIEM alerts, and internal security logs. Sorting through this manually is incredibly inefficient. Meanwhile, threat actors are evolving, moving faster, and becoming more evasive.
This is where security automation comes in. Instead of relying on analysts to manually collect, correlate, and respond to intelligence data, automated threat intelligence streamlines and enriches alerts, automatically prioritizes threats, and triggers incident response.
The Importance of Automated Threat Intelligence in the SOC
Threat intelligence is the backbone of a SOC, setting apart reactive teams from proactive ones. Here’s why it matters:
Automated threat intelligence adds important context to threats so teams know what they see.
It identifies attackers’ tactics, techniques, and procedures (TTPs), giving insight into how threat actors operate.
Intelligence can enable faster and smarter decision-making, reducing response time and preventing data loss.
By increasing efficiency, automated intelligence makes it easier to demonstrate ROI and value.
What is Threat Intelligence Enrichment?
Threat intelligence enrichment is the process of adding context to raw security threat data in order to better understand the threat.
Imagine this scenario: You detect a wave of port scans against your servers. You know the IP addresses of the hosts from which the port scans originated, but you don’t know much more than this.
With threat intelligence enrichment, you could immediately gain insights like:
Where the scanning servers are located
The operating systems and infrastructure they’re using
Whether the IPs are linked to known botnets, advanced attackers, or recent global threats
If these specific scans have been flagged in association with malware campaigns targeting similar organizations
With this enriched intelligence, your SOC can respond with precision and accuracy, blocking known malicious IPs, strengthening defenses against relevant attack vectors, and prioritizing investigations based on risk level.
Of course, you can manage your threat intelligence data manually by correlating and comparing it. That approach, however, is not practical at scale. So, that begs the next question: How can we automate threat intelligence enrichment?
6 Ways to Automate Threat Intelligence Enrichment
1. Enrich Alerts Across Multiple Sources
Security teams need to correlate data from OSINT, intelligence feeds, internal logs, and SIEMs — but they’re stuck manually sifting through inconsistent, raw data. This delays investigations and allows threats to slip through.
Torq Hyperautomation™ automatically collects and correlates threat intelligence across all sources, filtering out false positives and providing actionable insights. Torq ingests, correlates, and enriches raw threat intel in real time, prioritizing alerts that actually matter.
Key Benefits For Alert Enrichment
Reduces the risk of false positives and false negatives in threat detection
Automates the process of collecting and analyzing data
Prioritizes alerts, provides contextual information, and recommends response actions
Quickly and efficiently make informed decisions, reducing the response time to potential threats
2. Automate EDR, XDR, and SIEM Alerts
Manually managing alerts from EDRs, XDRs, and SIEMs can be challenging when dealing with large amounts of data. A Hyperautomation platform integrates across EDR, XDR, and SIEM platforms, automating alert handling and prioritization. It triages, enriches, and remediates alerts in real time, slashing MTTR and freeing up analysts to focus on real threats.
With Torq Hyperautomation, when an EDR alert flags a malicious file, Torq automatically quarantines, blocks the source, and launches an impact assessment. Torq is the connective tissue between these technologies, eliminating silos and enhancing data sharing.
Key Benefits For Alert Automation
Automates the process of collecting and correlating data from multiple technology sources
Rapidly identifies and responds to potential security threats
Frees up analysts to focus on critical tasks and work on strategic initiatives
Reduces response times, minimizing the impact of potential security incidents
3. Streamline Team-Based Threat Hunting
Threat hunting is the proactive search for threats that may have evaded detection by traditional security technologies. This process requires highly skilled analysts to investigate, but it is also a time-consuming and resource-intensive process. A Hyperautomation platform can centralize all the data, streamline the data correlation, and facilitate collaborative and automated threat hunts, reducing investigation times.
Torq’s AI-powered threat hunting assists SOC analysts by proactively analyzing high-velocity and high-volume data sets from multiple sources. It’s able to identify patterns, analogies, and IOCs that otherwise would have gone unnoticed.
Key Benefits For Threat Hunting
Automates the process of sharing information and delegating tasks
Provides workflows to facilitate collaboration between multiple teams in threat hunting
Improves the efficiency and effectiveness of threat hunting capabilities
Identifies and responds to potential threats more quickly and accurately
4. Align Processes
Disconnected security processes create inefficiencies, gaps, and compliance risks. Hyperautomation aligns security processes across teams and tools, ensuring every security event follows a standardized, automated workflow.
For example, if a SIEM alert flags a compromised user account, Torq Hyperautomation automatically pulls identity and access logs, verifies behavioral anomalies, and notifies the security team with recommended actions.
Key Benefits For Process and Procedure Alignment
Standardizes security processes and procedures
Ensures all security workflows are repeatable and consistently applied across the organization
Enhances visibility into potential threats allowing organizations to proactively address concern
Identifies and responds to potential threats more quickly and effectively
5. Trigger Workflows Across Disparate Infrastructures
Security teams cannot manually manage the sheer volume and velocity of security data generated by different security technologies. They need a better way to identify and respond to threats. Hyperautomation can integrate EDR, SIEM, email security, cloud security, MDM, and endpoint security, plus more, allowing organizations to trigger cross-platform security actions.
When an incident is triggered in a workflow, Torq Hyperautomation can launch containment workflows and notify stakeholders.
Key Benefits For Workflow Triggering
Extracts maximum value from existing investments by integrating disparate security technologies
Automates security workflows across the entire security tools stack
Collects and analyzes large volumes of data at scale to reduce noise
Responds to potential threats more quickly and accurately, reducing the MTTR
6. Minimize Manual Response Dependencies
Security incidents need instant response, but human remediation is too slow. The longer it takes to contain an attack, the more damage is done. Hyperautomation can speed up the entire response process, reducing manual effort and slashing MTTR.
If an endpoint security tool flags a malicious file, Torq Hyperautomation instantly isolates the device, blocks the attack vector, and launches an automated investigation.
Key Benefits For Minimizing Manual Response Dependencies
Automates the coordination of incident response activities across different teams and technologies
Responds to threats with minimal manual human dependencies, helping improve and scale incident response capabilities
Assists with centralizing the coordination and multi-team collaboration to minimize the risk of errors and miscommunications
Provides workflows to help organizations respond to security incidents more efficiently, quickly, and accurately
The Role of AI in Threat Intelligence
AI plays a pivotal role in threat intelligence automation. It rapidly analyzes massive volumes of data to detect patterns, anomalies, and indicators of compromise that human analysts might miss.
This dramatically improves detection accuracy, speeds up response, and helps organizations stay ahead of increasingly sophisticated attackers. In short, AI in threat intelligence turns reactive security into proactive, predictive defense.
Ready to automate your threat intelligence operations with AI-driven Hyperautomation? See how Torq can help.
The Team at Torq is pushing the boundaries of what’s possible in security automation, and we’re excited to share several new capabilities designed to make security analysts’ lives easier and more efficient:
Introducing AI Case Summaries
Torq AI Case Summaries leverages the power of artificial intelligence to streamline and accelerate your security operations. Imagine this: instead of manually reviewing pages of logs and incident details, your team is presented with a concise, insightful summary of each case automatically generated by Torq.
Here’s how it works:
AI-Powered Summarization: Torq AI Case Summary analyzes all the relevant data points associated with a security alert, including logs, threat intelligence feeds, and historical incident data.
Instant Insights: Our advanced AI algorithms identify the most critical information and present it in a clear, easy-to-understand summary, highlighting the potential impact and recommended actions.
Faster Response Times: Armed with these AI-driven insights, your team can quickly understand the nature of the threat, prioritize incidents effectively, and take decisive action to mitigate risks.
Torq AI Case Summary enables your security team to operate at peak performance. By automating the tedious task of case summarization, AI Case Summary frees up analysts to focus on what matters most: investigating complex threats, hunting for vulnerabilities, and proactively strengthening your security posture.
Need a department head to approve a suspicious travel request? Or perhaps you need a marketing manager to verify the legitimacy of a social media file? Torq Interact empowers security teams to automate approvals and data collection tasks with teams outside the security organization, ensuring a swift and coordinated response to security events.
As customers use Torq Interact to streamline both security team processes and end-user engagement, we continue to find new ways to improve the Interact experience. As of today, four new fields have been added to Torq Interact:
Date & Time Parameter: End users can easily select specific dates and times within interactions. For example, they can pinpoint the exact date of a thwarted phishing attempt.
Enhanced File Parameter: Users can now upload multiple files simultaneously rather than one at a time. This simplifies the user experience, especially when dealing with unpredictable files.
Download File Parameter: Now, Torq users can leverage Interact to send files directly to end users for download, either directly or through workflow context. Analysts might be looking for a secure way to send a potentially malicious file to another team member so they can execute it in a sandbox for further investigation.
Secondary Button: This enables Interact users to add flexibility to their workflows with a secondary button that allows users to submit forms without filling in all required fields, perfect for adapting to various interaction scenarios.
Conditional Elements: The conditional element introduces an advanced logic conditional element to enhance the end-user experience by dynamically presenting questions or information based on live responses, increasing the accuracy of every interaction.
Security teams are drowning in data. Every tool in your stack generates logs, alerts, and reports. But making sense of it all? That’s where things get messy. Spreadsheets buckle under the weight of hundreds, thousands, millions of rows. Custom dashboards require coding expertise and constant maintenance. You need a way to wrangle your data, not be ruled by it.
Torq Tables is a powerful, flexible way to interact with all your security data, directly within the Torq platform.
Torq Tables Enable You To:
Centralize your data: Pull in data from any source – NIST, SIEM, EDR, cloud platforms, and more – into a single, unified view—no jumping between tools and screens.
Investigate with speed and precision: Filter, sort, and analyze a significant amount of data in real-time. Uncover hidden threats and patterns that would otherwise remain buried.
Automate with ease: Trigger workflows directly from data in tables, responding to threats and anomalies at machine speed.
Torq Tables is now available for all Torq users. Log in to your Torq instance to get started, or schedule a demo.
Monitor and Manage Workspaces with Organization Management
Organization Management introduces a new single pane of glass view, simplifying the process for Torq users to monitor usage across multiple workspaces and perform org-level administrative tasks. Additionally, we’ve introduced a new Organization Manager role to grant appropriate stakeholders org-level access while adhering to a least-privilege access approach.
We’re excited to see what security teams will accomplish with these new capabilities. Keep an eye out for future updates as we push the boundaries of security automation!
A Blueprint for Hyperautomating Your Next-Gen Secure Software Development Lifecycle (SDLC)
By Aner Izraeli
August 26, 2024
5 Minute Read
Contents
Aner Izraeli is the Chief Information Security Officer (CISO) at Torq. He leads Torq’s cybersecurity strategy with a focus on innovation and resilience. Aner’s career spans over two decades in the cybersecurity field, where he has consistently demonstrated expertise in SIEM/SOC, incident response, and network security.
At Torq, we’re all about pushing boundaries and driving innovation. But we can’t afford to treat security as an afterthought in our relentless pursuit of speed and creativity. As a lean and agile team, we’re constantly challenged to stay ahead of emerging threats without slowing down our momentum.
In this blog, I break down how we Hyperautomated our software development lifecycle (SDLC) to improve security coverage, reduce friction, and keep our R&D teams shipping fast.
The SDLC Challenge: Balancing Speed and Security
Our software engineering teams manage various components and microservices, each with unique functionalities requiring meticulous threat modeling and vulnerability assessments. Modern software engineering integrates open-source and proprietary libraries, introducing potential security vulnerabilities in individual and shared components across teams.
The primary challenge is ensuring these vulnerabilities are continuously identified and mitigated before they compromise the production environment. Simultaneously, it’s crucial to maintain an environment where teams can continue to innovate and deliver high-quality software without being hindered by security concerns.
In short, how do we ensure that potential application security vulnerabilities are identified and resolved before they threaten our production environment while empowering our teams to innovate and deliver high-quality software? That’s where SDLC automation and security Hyperautomation come in.
Building Our SDLC Automation Architecture
Our solution started with integrating an Application Security Posture Management (ASPM) platform, which provided complete control over our supply chain and SDLC. This visibility extends across open-source packages, Dockerfile dependencies, and container images — everything from the far-right side of the SDLC. But visibility alone can be overwhelming.
I used Torq’s workflows to categorize and aggregate issues, while centralized case management simplifies investigations for R&D teams. Automation facilitates generating Jira tickets, pull requests, and Slack notifications, keeping teams aligned with daily SLA reminders. This ensures our teams can focus on what matters most — innovation without compromise.
Below is an illustration of what that automated SDLC flow looks like:
The SDLC Automation Implementation In Action
When the ASPM flags a new issue, Torq automatically creates a centralized case grouped by severity and category for that specific repository — eliminating duplicate tickets and reducing noise.
The case includes a detailed table with affected packages, suggested upgrades, a risk verdict, and direct links to GitHub and ASPM findings.
If action is needed, R&D can trigger a predefined workflow with one click, auto-generating a Jira ticket, a pull request, and a Slack notification, all while staying aligned with SLA requirements.
With enriched data and automated context in hand, our dev teams can patch vulnerabilities quickly. Each remediation follows Torq’s change management and SDLC policies, flowing through peer review and automated deployment like any standard feature or update.
SLA Compliance Made Simple
In line with Torq’s policy, every issue is assigned a severity-based SLA. To ensure timely resolution, a daily automated workflow reviews open cases and notifies each R&D team of their remaining time to address these issues. SDLC automation keeps teams on track, ensuring vulnerabilities are managed effectively without disrupting ongoing development.
That’s the power of SDLC Hyperautomation: fast and repeatable.
When To Implement SDLC Hyperautomation
Achieving fully automated vulnerability management may sound like an ambitious goal, but it’s essential for the velocity of modern security operations. Within Torq, we strive for a seamless process from detection to merge. Successful SDLC Hyperautomation can become possible when:
The vulnerability management program is mature and well-established
There are consistent, repeatable actions required for product or software updates
The SDLC includes a robust testing process, acting as a safety net to catch any oversights during automation
The Business Impact of SDLC Automation
The result of our efforts was a fully automated vulnerability management process that has revolutionized our approach to AppSec. We’ve slashed remediation times, improved SLA adherence, and empowered our R&D teams to deliver secure, high-quality software faster than ever. Here was the quantitative impact:R&D teams to deliver secure, high-quality software faster than ever. Here was the quantitative impact:
Ready to Hyperautomate your AppSec approach? Torq can help you build SDLC automation workflows that scale, simplify security, and eliminate busy work.
Incident Response Automation and Why It’s Critical for Your SOC
By Torq
August 20, 2024
7 Minute Read
Contents
Speed is everything in security. Delayed responses to security incidents can result in the loss of business data, erosion of trust, and significant financial losses. Traditional manual incident response can’t keep pace with today’s threats.
This is where incident response automation comes in. Powered by AI-driven security automation, it allows SOC teams to detect, prioritize, and neutralize threats faster than ever — often before users even know an issue exists.
In this blog, we’ll break down what incident response automation is, why it’s essential, and real-life use cases for modern SOCs.
What Is Incident Response Automation?
Manual incident response relies heavily on human intervention and human reaction time. Analysts must identify the threat, triage, determine its impact, decide on a course of action, execute that action, and document everything — often while juggling dozens of other critical duties. It’s slow. It’s error-prone. And it leaves your organization vulnerable.
Powered by AI, incident response automation enables instant detection and response by automatically identifying and neutralizing threats — often before users even become aware of an issue. It delivers scalability by handling multiple incidents simultaneously across sprawling, complex environments without overwhelming the SOC. It empowers analysts by offloading repetitive, routine tasks, allowing human experts to focus their time and energy on strategic, high-value initiatives. And it drives operational maturity by feeding AI-driven insights back into detection and response processes, improving incident prevention.
Incident Response Automation Defined
Incident response automation utilizes AI-driven workflows and technology to detect, investigate, contain, and remediate security threats without requiring manual human intervention. It replaces slow, error-prone manual processes with real-time, consistent, and scalable actions, dramatically reducing MTTD and MTTR.
Core Components of Automated Incident Response
Tool integration: Seamlessly integrates with existing security tools like SIEMs, EDR, firewalls, and threat intelligence platforms.
Scalability: Automated responses allow SOCs to handle more incidents without increasing headcount or operational costs.
Consistency: Uniform execution of best-practice-driven response actions reduces risk and ensures predictable outcomes.
Flexibility: Retains human oversight, allowing analysts to intervene or supervise as needed.
Incident prioritization: Automated systems categorize incidents by severity, helping teams focus resources efficiently.
Remediation:Predefined automated actions such as quarantining compromised systems, blocking malicious IPs, and applying patches.
Reporting and post-mortems: Automated documentation simplifies root cause analysis and improves future responses.
Why Manual Incident Response Falls Short
Traditional manual incident response often suffers from:
Slow response times: Manual investigation wastes precious time during an active attack.
Inconsistency: Human error introduces risk at every step.
Alert overload: SOCs are overwhelmed by alerts. Manual triage is not sustainable.
Resource constraints: Manual processes are resource-intensive and don’t scale efficiently.
Automated incident response solves all of this. It scales with increasing volume, enforces consistency, and frees up your team’s time and energy to focus on strategic security initiatives.
Rapid response: Significantly reduced MTTD and MTTR
Improved accuracy: Elimination of manual errors through standardized workflows
Reduced alert fatigue: Intelligent prioritization and handling of alerts
Cost efficiency: Optimized resource allocation and lowers operational costs
Enhanced compliance: Documentation and consistent actions facilitate regulatory compliance
Examples of Incident Response Automation
Here’s how incident response automation plays out across different attack scenarios.
Phishing Attacks
When a phishing email bypasses perimeter defenses and lands in an employee’s inbox, time is of the essence. Automated incident response detects indicators like suspicious URLs, anomalous user behavior, or credential harvesting attempts. The automation system instantly isolates the affected inbox, revokes access to compromised credentials, removes the phishing email from all mailboxes, blocks the sender, and notifies impacted users.
Malware Containment
If malware is detected on an endpoint, automated workflows instantly disconnect the infected endpoint from the network, trigger forensic scans, kill malicious processes, and initiate recovery steps — containing the spread before it can escalate.
IAM Security
Identity and Access Management (IAM) is a prime target for attackers. Automated incident response continuously monitors for unusual login patterns, privilege escalation, dormant accounts, and policy violations. Upon detection, automation can instantly disable user accounts, enforce password resets, revoke elevated privileges, or require multi-factor authentication (MFA).
Cloud Detection and Response
Cloud security automation monitors cloud environments for misconfigurations (like exposed storage buckets or open firewall ports). Upon detection, the system automatically isolates compromised assets, reaches out to the correct owners, executes remediation, and minimizes damage before analysts need to step in.
How to Automate Incident Response with SentinelOne and Torq
One of Torq Hyperautomation™’s greatest strengths is its ability to integrate with virtually any security tool. We team up with leading platforms like SentinelOne to create seamless automations that simplify SOC workflows, eliminate manual grind, and dramatically improve incident response times.
Here’s how Torq and SentinelOne combine forces to bring autonomous incident response to life:
1. Auto-Enrich SentinelOne Incidents with Intezer
Torq continuously polls SentinelOne for any unresolved threats. It extracts file hashes from those incidents and queries Intezer for threat intelligence enrichment. The results from Intezer are posted directly into the SentinelOne incident notes.
At the same time, Torq launches a Deep Visibility query to determine the extent of the threat across your environment. If Intezer flags a file as malicious or suspicious, Torq automatically prompts your SOC team in Slack to decide whether to launch an Intezer Live Scan. If the team answers yes, Torq remotely installs the Live Scan agent, runs the scan, gathers the results, and updates both the Slack channel and the SentinelOne threat notes.
2. Threat Hunt for SHA1 Signatures Across SentinelOne Endpoints
Torq enables rapid threat hunts that can be triggered directly from Slack. When a SOC analyst sends a Slack command containing a platform and a SHA1 file signature, Torq initiates an immediate threat hunt.
Torq adds the file hash to the SentinelOne blacklist and launches a Deep Visibility query to find all instances of the file across your managed endpoints. It identifies and notifies endpoint owners by integrating with Jamf or Intune. Torq updates the relevant Slack channel and then triggers a full disk scan on any affected endpoints to eliminate threats promptly.
3. Enrich SentinelOne Findings with Advanced Threat Intelligence
Torq enhances SentinelOne incident analysis by layering in threat intelligence from VirusTotal and Recorded Future. Torq regularly polls SentinelOne for newly detected threats. For each threat, Torq extracts relevant file signatures and queries VirusTotal and Recorded Future for enrichment data, including reputation scores, malicious behavior indicators, and associated threat actors. This context is automatically added to the incident notes within SentinelOne.
Torq can also run a Deep Visibility query for additional results associated with the same file hash, ensuring SOC teams have complete situational awareness without lifting a finger.
Incident Response Automation with Torq
Torq transforms the way SOC teams do incident response. Our platform empowers organizations to:
Deliver faster, more accurate automated incident responses without requiring major increases in staffing.
Automate repetitive tasks while maintaining human oversight when needed.
Enable analysts to focus on strategic initiatives that harden security postures, rather than burning out on alert triage.
Socrates, Torq’s OmniAgent, coordinates specialized AI agents that autonomously handle enrichment, investigation, containment, and remediation.
Torq Hyperautomation makes it easy to deploy integrated incident response automation across your security environment. Let Torq automate your incident response — and everything that comes with it.
See how to generate a Torq workflow in seconds to automate incident response.
Modern threats don’t come crashing through the front door — they slip quietly through gaps in the side of your house that your legacy tools don’t even know exist. Automated threat hunting is how you find threats before they find your sensitive data.
Automated Threat Hunting Overview
Automated threat hunting uses rule-based logic, AI, automation, and real-time telemetry to identify suspicious behaviors across your environment. While manual threat hunting is resource-intensive and dependent on expertise, automation levels the playing field.
Automated threat hunting is the practice of using automation and AI to continuously search for hidden threats across an organization’s environment. Unlike traditional reactive monitoring, threat hunting is proactive, and when automated, it removes the bottlenecks of manual investigation, helping decrease a potential threat’s “exposure window”.
Let’s break down five ways to automate threat hunting in your SOC.
1. Automate EDR, XDR, SIEM, and Anomaly Detection Queries
Your stack is loaded with tools. Torq seamlessly integrates your stack to make them work together. When EDR, XDR, SIEM, and anomaly detection platforms are paired with automation, these tools can detect threats and act on them.
With threat hunting automation, you can:
Trigger a SIEM alert to automatically query EDR logs
Parse XDR telemetry to extract IOCs and enrich investigations
Respond to anomaly detection with distributed searches across email, cloud, identity, and endpoint logs
2. Share and Standardize Threat Hunting Templates
Every SOC team uses custom automation templates, which are shared with team members to ensure the most efficient threat hunting workflows. These threat hunting templates serve as playbooks for automating investigations received from the SIEM/EDR/XDR queries.
Teams can:
Standardize how alerts are prioritized and triaged
Automatically detonate suspicious files in sandboxes
Use natural language prompts to build or modify workflows
This makes threat hunting more accessible, scalable, and consistent. Now, even junior analysts can execute expert-level investigations.
3. Trigger Search Processes With Workflows
Manual searching is slow. Automated workflows can activate search processes across various systems to identify further events and evidence.
Once a threat is confirmed, it’s go time. Depending on the threat, workflows may automate remediation by:
Quarantining compromised files using EDR
Removing malware from cloud storage or inboxes
Blocking malicious IPs and updating firewall rules
Rolling back affected systems from backups
Automated Threat Hunting with Torq
With Torq, threat hunting can be fully automated with our AI-driven Hyperautomation platform. Here’s how we do it:
Automated Case Management: Torq Hyperautomates case management by automatically creating, updating, and managing cases in response to incoming alerts. High-fidelity signals get prioritized instantly, and cases are enriched in real-time with contextual data from across your stack.
Observables:Observables like IPs, hashes, URLs, and domains are more than just data points. They’re trackable objects tied directly to cases and alerts, fully compliant with OCSF standards. This lets security teams link activity across seemingly unrelated investigations and surface patterns faster than ever before.
Relationship Tracking: Torq’s platform allows security teams to implement correlation, enrichment, and contextualization logics in their workflows, leveraging the relationships between observables, cases, and alerts. This helps security analysts identify patterns and uncover hidden threats.
As cyberattacks grow more advanced, real-time visibility and rapid response aren’t optional — they’re essential. Automated threat hunting enables SecOps teams to stay proactive, reduce alert overload, and handle complex multi-vector attacks faster.
Torq gives security professionals the automation edge they need to hunt smarter, not harder. See how Torq can elevate your automated threat hunting strategy today.
Subtlety has never been our specialty. Our arrival in Las Vegas for Black Hat 2024 had the city abuzz with excitement as our HyperTrucks blazed through the street, broadcasting that “SOAR is dead.” Our team traveled from across the globe, and converged to make this event unforgettable. We were not just attending; we were here to revolutionize how security operations are perceived and executed.
Torq HyperSOC™: The Demo that Broke Black Hat
Torq HyperSOC™ was undeniably the star of the show. Our demo booths were consistently surrounded by security teams waiting for their turn to witness the groundbreaking capabilities of our latest solution. The reactions were phenomenal—visitors were blown away by the efficiency and innovation that Torq HyperSOC™ brings to the table. The non-stop lines at our demo stations were a testament to the immense interest and excitement generated by our cutting-edge technology.
“I’ve never seen anything like it in 20-something years of doing this.”
To raise awareness of the cyber skills gap and to encourage the next generation of young professionals to consider a career in cybersecurity, we committed to donate $10 for every person who visited our booth to Tech Queen Elite Training Institute. They caught our eye as a local Vegas non-profit organization that trains students in coding, business communication skills, and digital marketing technologies. We are also donating a pair of premium socks for every visitor to our booth via the Communities In Schools, Nevada organization. This donation is designed to inform kids about the value of a SOC career while also providing them with a useful back-to-school item. Communities In Schools is the nation’s leading dropout prevention organization. Its mission is to assess needs and deliver resources that remove barriers to success. It supports more than 100,000 students at 110 schools.
Hyperautomation™ Reaches New Heights
Our booth at Black Hat 2024 was not just a display; it was an experience. The buzz and energy were palpable, with attendees continually stopping by to see what the excitement was all about. We made it loud and clear that “SOAR is Dead,” and the hundreds of security professionals we spoke to agreed.
Torq, Out.
Black Hat 2024 was a monumental success for Torq, as we showcased our commitment to pushing the boundaries of cybersecurity and automation. Stay tuned for more exciting updates and innovations from our team – and be sure to catch us back in Vegas next month for Fal.Con.
SecOps, DevOps, ITOps, DevSecOps: What’s the Difference and How to Build a Strategy
By Torq
July 30, 2024
5 Minute Read
Contents
In cybersecurity, collaboration isn’t just helpful — it’s mission-critical. Evolving threats, hybrid infrastructure, and growing operational complexity have forced organizations to rethink how their teams work together. That’s where SecOps, ITOps, DevOps, and DevSecOps come into play.
These terms may sound similar. And they are — to a degree. But they have different areas of focus and philosophies. This guide will break them down, show how they overlap, and explain why automated SecOps is essential to a modern securitystrategy.
What is SecOps?
SecOps (Security Operations) is the fusion of IT operations (IT Ops) teams and security teams, processes, and technologies. It transforms security from a siloed afterthought into an integrated, continuous part of infrastructure management and incident response.
Unlike traditional models where IT and security operate independently, SecOps encourages real-time collaboration, shared visibility, and automation-powered workflows. The result is faster detection, smarter triage, and reduced risk.
At the heart of SecOps is the SOC (security operations center), which can be physical, virtual, or hybrid. The SOC centralizes collaboration among security analysts, IT operations engineers, system admins, and others, all aligned under the CISO.
Why SecOps Matters
Security complexity is exploding. The average enterprise juggles hybrid infrastructure, sprawling cloud environments, and a distributed workforce. Meanwhile, attackers are faster — and smarter — than ever.
Siloed security and IT operations can’t keep up. Digital SecOps helps you scale. It reduces response times, minimizes risk, and improves visibility by aligning security into other parts of the business.
SecOps vs. ITOps
SecOps connects security and IT operations by aligning their workflows and priorities, not by merging teams.
Traditionally, ITOps and security teams operated on parallel tracks. ITOps focused on maintaining infrastructure, keeping systems running, and resolving performance issues, while security focused on identifying and responding to threats. They might’ve shared a Slack channel, but rarely a strategy. That separation created gaps, and attackers took advantage.
SecOps closes those gaps. It ensures security is embedded into every layer of IT operations, from provisioning and deployment to monitoring and response. It’s not about turning IT teams into security experts or vice versa — it’s about building stronger collaboration.
SecOps vs. DevOps
DevOps is a collaboration between developers and IT operations teams that ensures developers understand the needs of ITOps when they write software and that ITOps teams understand what developers intend for software to do when they manage it.
While SecOps and DevOps serve different functions, they share a common goal: breaking down silos between teams to improve agility, speed, and resilience across the organization. Here’s what they have in common:
Both break down silos between teams to improve efficiency and scalability
Both emphasize automation, real-time communication, and shared accountability
Both are cultural philosophies more than strict operational frameworks
But the difference lies in focus:
DevOps = Developers + ITOps
SecOps = Security + ITOps
In short: DevOps is about velocity. SecOps is about visibility. And both benefit from strong security automation.
Where DevSecOps Fits In
You can’t really talk about ITOps, SecOps, and DevOps without hitting on DevSecOps — the (relatively) new kid on the block that pulls development, security, and operations into a single, streamlined, collaborative model.
In DevSecOps, security “shifts left”, meaning it’s embedded earlier in the development lifecycle, not bolted on at the end. Security testing, threat modeling, and policy enforcement become part of the CI/CD pipeline.
With DevSecOps, developers, IT, and security collaborate from day one. Bugs are fixed before they become breaches, and vulnerabilities are squashed in staging rather than discovered in production.
Comparing ITOps, DevOps, SecOps, and DevSecOps
ITOps
SecOps
DevOps
DevSecOps
Primary Focus
Managing IT infrastructure and services
Security + IT operations
Development + IT operations
Embedding security into DevOps pipelines
Goal
Ensure performance, uptime, and support of systems
At the end of the day, whether you’re operating under the banner of ITOps, SecOps, DevOps, or DevSecOps, one principle remains constant: collaboration is everything.
Security doesn’t happen in isolation. It happens when developers, IT, and security engineers have shared visibility, shared tools, and shared responsibility. When everyone’s aligned, security becomes part of the everyday workflow — not an afterthought or a bottleneck.
Scaling Through Collaboration with Torq
Torq’s no-codeSOC automation platform is purpose-built to connect the dots across ITOps, security, and development. It breaks down barriers between teams with collaborative, transparent workflows that streamline communication, reduce handoff friction, and automate everything. Here’s how Torq emphasizes collaboration:
Unified workflows: Bring security, IT, and engineering together in a single automation layer with shared playbooks.
No-code + Deep customization: Anyone can build and execute powerful workflows using natural language, prebuilt templates, or drag-and-drop tools.
Real-time collaboration: Triage, investigate, and remediate cases through chat tools like Slack and Teams.
Torq Gives Back and Supports the Next Generation of Cyber Talent
For the second year in a row, Torq is pleased to make donations to charities that invest in supporting the next generation of young professionals and encourage them to consider STEM-related career paths.
Torq will be at Black Hat, one of the cybersecurity industry’s leading trade shows, August 6-8 at Mandalay Bay, Las Vegas. We’ll be exhibiting Torq Hyperautomation at our booth, including the AI-driven Torq HyperSOC, a purpose-built solution that automates, manages, and monitors critical SOC (Security Operations Center) responses at machine speed. This innovation has been game-changing for tech workers in the SOC and is helping alleviate the cybersecurity skills gap that’s leading to global labor shortages and burnout.
To raise awareness of the cyber skills gap and to encourage the next generation of young professionals to consider a career in cybersecurity, Torq will donate $10 for every person that visits its booth (#960) to Tech Queen Elite Training Institute. It’s a non-profit organization dedicated to training students in coding, business communication skills, and digital marketing technologies. Tech Queen Elite Training Institute helps eliminate barriers so students can earn globally-recognized credentials and become gainfully employed, in fields that include cybersecurity and AI.
“We’re grateful to Torq for making such a generous investment in the career paths of Tech Queen Elite Training Institute students,” said Dr. Duana Malone, Founder of Tech Queen Elite Training Institute. “Our goal is to ensure every student we work with has an opportunity to devote themselves to meaningful skills development that enables them to elevate their future potential, as well as their community at large. Torq’s donation will make a real difference for many students in Nevada.”
In addition, for every visitor to our Black Hat booth, Torq will donate a pair of premium socks to local kids in need via the Communities In Schools, Nevada organization. This donation is designed to inform kids about the value of a SOC career, while also providing them with a useful back-to-school item. Communities In Schools is the nation’s leading dropout prevention organization. Its mission is to assess needs and deliver resources that remove barriers to success. It supports more than 100,000 students at 110 schools.
“Communities In Schools, Nevada, is very happy to have Torq contribute to the back-to-school packages we’re providing our students this year,” said Hayden Havon, Events Coordinator, Communities In Schools, Nevada. “Together with our other partners, Torq is helping ensure kids have the essentials they need to get up and running for their 2024-2025 academic sessions.”
“Every employee at Torq worldwide is proud to help make a positive impact in the communities in which we do business,” said Ofer Smadari, CEO, Torq. “We’re very happy to contribute to the wellbeing of students and for them to be exposed to the possibilities of cybersecurity as a fulfilling and valuable career option for the future. All of us are incredibly impressed by Tech Queen Elite Training Institute and Communities In Schools, Nevada, and we encourage others to also step forward and support their amazing work.”
