Insights

5 Secrets of a SOC Leader Turned Field CISO

By Patrick “PO” Orzechowski
December 2, 2024
8 Minute Read
Learn 5 lessons from a SOC leader turned CISO for modern SOC success.

Contents

Torq is thrilled to have Patrick Orzechowski (also known as “PO”) on board as our new Field CISO, bringing his expertise and years of experience as a SOC leader to our customers. PO is a seasoned security veteran with a deep understanding of the modern security landscape. By way of introduction, below he shares his five top pieces of advice for SOC leaders facing today’s security challenges.

When I say I’ve been in your shoes as a SOC leader, I mean it! I’ve spent around 25 years in the trenches of cybersecurity and security operations centers (SOCs). I’ve dealt with alert fatigue, managed incidents where our team didn’t sleep for days, and searched far and wide for an automation solution that can truly help SOC teams collaborate better and gain deeper insights into incident data.

I started my journey in a SOC at RipTech, which was acquired by Symantec. From there, I worked in the U.S. defense and intelligence communities as both a Blue Teamer and a Red Teamer, building SOCs and leading forensics and incident response as well as doing penetration testing for the U.S. government. My focus then shifted towards data analytics in security operations, and I held roles at telecom giants like TW Telecom and Level 3. 

Ten years ago, I co-founded a Managed Detection and Response (MDR) service called Deepwatch, where I built the SOC infrastructure to run and handle over 250 customers — and which is where I first came across Torq Hyperautomation as the answer to our SOC scaling challenges.

Today, as Field CISO at Torq, I’m applying my experiences as a security practitioner to help organizations navigate the complexities of modern cybersecurity. You’ll find me speaking at security conferences and events around the world, sharing my expertise in Torq content, and leading independent research projects to explore topics like SOC efficiency and case management effectiveness. 

I have seen firsthand that the old ways of doing things in cybersecurity are going away and need to be left in the dust. I truly believe Torq’s AI-driven Hyperautomation is an unprecedented solution for helping SOC leaders stay ahead of this evolution and the main reason why I am so excited to be here now. To pay it forward, below are my 5 top pieces of advice for SOC leaders facing today’s challenges.

5 Keys to Modern SOC Success

1. Evolve for the Expanding Attack Surface

The combination of cloud hyperscalers (such as AWS, Azure, GCP, etc.), legacy apps, on premise requirements, remote work, and SaaS solutions present a very complex problem set for SOC leaders. As the attack surface expands and gets more complex, attackers will have the competitive advantage of targeting disparate systems that do not talk to each other.

Therefore, as vulnerabilities and entry points multiply and digital transformation and AI adoption accelerate, security teams will need systems that become the “glue” that ties together the systems themselves (i.e., automation), the data they produce (i.e., SIEM and search), and event-driven case management. 

The sheer volume of data gives attackers an advantage as SOCs struggle to sift through the noise. Torq HyperSOC can process and triage high volumes of events to close out false positives more quickly and prioritize responses more efficiently, helping reduce alert fatigue and and intelligently escalating high-priority cases to security analysts so that nothing slips through the cracks.

2. Embrace the AI Revolution, Strategically

We are in a security AI arms race. While AI is undoubtedly a game-changer, it’s a double-edged sword because attackers are also leveraging AI — and they’ll always have the advantage over a defense team that has to worry about compliance, privacy, and red tape. 

It’s daunting to know that attackers can scale everything they do through AI and automation — and that it’s throwing traditional cyber defense rules out the window. For example, every phishing training for the last 15 years told users to “look for grammar errors or weird punctuation”, but a phishing email written with AI can look like a perfectly written email from a legitimate person. 

Deflating the AI fear factor requires strategically automated defenses that can match attackers’ AI-powered speed and scale. With Torq’s AI-powered Hyperautomation, SOC teams can automate repetitive tasks to free up analysts for complex incidents and proactive threat hunting, and can accelerate incident response through auto-remediation and AI-enhanced investigations. Torq’s platform is fully battle-tested to handle the immense data output of the modern SOC’s cloud-native security stack.

It’s crucial to remember that AI is a tool, not a magic bullet. We still need skilled analysts to make informed decisions based on AI insights. Additionally, any AI solution deployed in the SOC should be able to explain how it arrived at its conclusions and provide citations to original forensic evidence so that you can understand and verify its logic.

Get the AI or Die manifesto for advice for deploying AI the right way as a SOC leader.

3. Focus on Security Operations Transformation

Security Operations rationalization is a critical component of any long-term strategy for CISOs and security leadership. While cybersecurity is now recognized as a key business risk, the era of the “blank check” from the C-suite and board to buy whatever technology you want is over. SOC leaders now have to justify your budget and show value and ROI.

Throwing money at the problem by purchasing the newest, shiniest security tools or simply increasing headcount won’t solve your problems anyway. Instead, focus on fundamentally transforming your security operations by investing in automation for routine tasks, streamlining processes, and consolidating data insights from across your stack so you can eliminate analyst burnout and empower your existing team.

4. Overcome Security Data Assumptions

The classic notion of the SOC triad has proven to fail against threat actors who have time and resources. Legacy SIEM, SOAR, EDR, and network controls are not enough to operationalize and automate detection and prevention in an era where attackers are getting faster and faster thanks to AI.

The idea of a singular SIEM to gather, correlate, and alert on all data across the enterprise needs to go extinct. As we move to the new arena of SOC automation, we need scalable, flexible systems that can interconnect not just traditional security stacks but all data sources, including traditional IT systems, HR, Accounting, Sales, and Finance.

5. Don’t Forget the Fundamentals

There’s a lot out there to distract SOC leaders, but maintaining strong cyber hygiene remains crucial. Following basic security practices like zero trust or the NIST cybersecurity framework can never fall by the wayside. 

Additionally, your SOC team’s wellbeing remains central to your security wellbeing. Many SOC challenges are people challenges. Sleep deprivation during major incidents, challenges in effective collaboration, and an inability to access data insights from across different solutions, all add up to frustrated, tired, and checked out analysts — which means a weaker defense. 

When you automate menial, routine tasks and auto-remediate the majority of low-level alerts, you free up analysts to focus on more engaging and rewarding work while also cutting down on alert fatigue. I truly believe all SOCs should be measuring “analyst happiness” as a KPI that reflects the health of security operations.

A Real-World SOC Transformation: Torq + Deepwatch

I know first-hand what happens when a solution like Torq comes in and changes not just technology, but also SOC processes to bring about a more strategic approach.

At Deepwatch, our first foray into automation was with legacy SOAR — but hosting 250 SOAR instances became very expensive, very fast. The platform we were using proved to be costly to scale and extracting critical KPIs like mean time to response (MTTR) was difficult. This hindered our ability to demonstrate value to both internal stakeholders and external customers.

To address these limitations, Deepwatch embarked on a transformative journey with Torq Hyperautomation. The stress test we ran on the Torq platform during the POC was my “aha” moment — and it only impressed me more from there. The Torq platform’s ability to handle high-volume workloads, the simplicity of Torq’s integrations, and the speed and flexibility at which the team could build new workflows accelerated Deepwatch’s analysis, triage, validation, and response. 

Read the full Deepwatch case study here >

Moving Forward, Faster Than Ever

What worked in the SOC a few years ago is often obsolete today, making the ability to adapt rapidly key to survival in the modern security landscape. But this gets harder every day as attackers’ arsenal of technology and tactics gets more complex, sophisticated, and lethal. Somehow, SOC leaders have to keep evolving their tech, people, and processes to combat these evolving threats. It’s not easy, as I know first-hand.

At Torq, we’re revolutionizing the ability of the SOC to quickly move past the challenges that once left SOC leaders in a tar pit of despair. 

Want to chat about the practicalities of transforming your SOC? Let’s talk. 

Share

Related Articles

AI Hyperautomation

Building Powerful CrowdStrike Automations: Insights from Fal.Con 2024

By Brian Higgins
November 25, 2024
4 Minute Read

Contents

“If I take Torq out, I lose three people.”

This sentiment expressed by Fiverr’s VP of Business Technologies perfectly reflected the energy at the Fal.Con 2024 Torq booth and struck a chord with security teams using CrowdStrike’s powerful tools. Detection isn’t the problem — CrowdStrike excels at that. The challenge lies in automating what happens next.

A Problem-First Approach to Security Automation

Security teams quickly discovered how to reimagine CrowdStrike operations from manual to automated, from reactive to proactive. The challenge was universal — while CrowdStrike excels at detection, teams struggle to scale their response processes. 

Torq’s problem-first approach resonated deeply with the crowd at Fal.Con. By focusing on solving real security challenges through intelligent automation and AI rather than adding more tools to the stack, Torq is trusted by organizations across the globe to complete 5.2 million Torq-CrowdStrike automation actions annually.

CrowdStrike Automation Templates to Tailored Solutions

The Torq platform’s featured EDR workflow (NIST-800-535-PM-16) demonstrates this philosophy. It starts with a foundational five-step process that automatically:

  1. Receives CrowdStrike detection events
  2. Decodes detection IDs and pulls detailed information
  3. Loops through resources and behaviors found in the detection
  4. Checks SHA256 signatures with VirusTotal
  5. Updates block lists across connected security tools

With Torq, security teams can use pre-built CrowdStrike automation templates as a launch pad and modify them as needed or use natural language prompts in AI Workflow Builder for limitless possibilities. Need to add custom enrichment sources? Want to implement team-specific notification procedures? Looking to integrate additional threat intelligence platforms? Simply describe what you need in natural language, and let Torq’s AI help turn your requirements into sophisticated automation in seconds.

Cross-Platform Intelligence

For organizations using Splunk alongside CrowdStrike, we showcased how teams implement seamless correlation and then leverage Socrates, the AI SOC Analyst. When CrowdStrike detections appear in Splunk, the powerful combination of Hyperautomation, Socrates, and AI can automatically help create and enrich cases, take action, and maintain detailed documentation throughout the investigation lifecycle.

Furthermore, two foundational examples handled IOC management — one for individual detections and another for incidents. Each validates files with threat intelligence and updates global block lists, ensuring consistent response across your security infrastructure.

Optimized Security Operations

CrowdStrike integration capabilities extended further with Hyperautomated use cases include:

Beyond Basic Automation

What sets these integrations apart is Torq Socrates’ ability to maintain context across the entire investigation lifecycle. Every action by the AI SOC Analyst, from initial detection to final resolution, is documented with clear reasoning and next steps. This transforms shift handovers from potential security gaps into seamless transitions.

When teams customize automation in Torq, they don’t need to start from scratch or learn complex coding. AI Workflow Builder understands the context of security operations and can transform natural language instructions into sophisticated workflows. Want to add conditional logic based on threat severity? Need to implement custom enrichment procedures? Simply describe what you need in natural language.

The Power of Official Partnership

Technical discussions at Fal.Con confirmed what security teams already know — CrowdStrike provides industry-leading detection capabilities, but the real power comes from intelligent automation. Starting with CrowdStrike automation templates and expanding through AI-powered customization, teams will:

  • Revamp CrowdStrike alerts into automated actions
  • Ensure consistent response procedures across global teams
  • Maintain comprehensive documentation without manual effort
  • Scale CrowdStrike operations without adding headcount

Looking Forward

With 325+ million workflows executed annually, Torq’s integrations demonstrate how teams can maximize their CrowdStrike investments through intelligent automation. The possibilities are limitless, whether starting with pre-built templates, creating new workflows through custom builds, or leveraging natural language instructions.

Discover how quickly you can accelerate from reactive to proactive, manual to automated, and overwhelmed to efficient. Schedule a demo or if you’re already a Torq user, explore the CrowdStrike template library.

Share

Related Articles

AI

Planning with AI: Minimizing Uncertainty, Maximizing Trust

By Gal Peretz
November 21, 2024
6 Minute Read

Contents

Gal Peretz, Head of AI & Data at Torq

Gal Peretz is Head of AI & Data at Torq. Gal accelerates Torq’s AI and data initiatives, applying his deep learning and natural language processing expertise to advance AI-powered security automation. He also co-hosts the LangTalks podcast, which discusses the latest AI and LLM technologies.

To stay ahead of today’s threats, you must do more than keep pace — you need to equip your team with tools that enable smarter, faster responses. For SOC analysts, runbooks in case management systems are essential guides for handling security alerts step-by-step. The prospect of automating these runbooks with AI is enticing, promising to streamline daily operations and free up time for more critical tasks.

However, some are rightfully skeptical. They worry that AI automation could introduce unexpected issues without careful planning and collaboration, potentially hindering productivity and increasing risk. This blog explores how collaborating with AI during planning and setting AI guardrails can enhance predictability, transparency, and trust in AI automation.

The Importance of Runbooks in Security Operations

Runbooks are structured, step-by-step guides enabling SOC analysts to respond to security incidents consistently and accurately. They are particularly crucial for Tier 1 analysts, who often serve as the first line of defense against a high volume of alerts. 

These runbooks provide clear instructions for the following:

  • Triaging alerts
  • Investigating potential threats
  • Determining when to escalate issues

By standardizing responses, runbooks reduce human error and ensure efficient handling of all incidents, even in high-pressure situations. Automating runbooks with AI presents an appealing option for scaling operations, accelerating repetitive tasks, and allowing analysts to focus on more complex, high-stakes cases.

The Need for AI Guardrails in Runbook Automation

While automating runbooks with AI is a game-changer, granting AI too much freedom can quickly backfire. Most runbooks are designed with human readers in mind, presenting step-by-step guides that make sense to analysts but can be confusing for AI. 

When left to interpret these text-based instructions independently, AI might:

  • Misinterpret steps
  • Make unexpected decisions
  • Produce unintended results

AI can become unpredictable without a structured plan and human alignment, risking accuracy and eroding your team’s trust in automation. A collaborative planning phase to ensure AI guardrails is crucial as it provides SOC analysts visibility into how the AI “interprets” the runbook and plans to automate it. This transparency allows analysts to refine the AI’s approach, ensuring the plan aligns with real-world needs before execution begins.

Collaborative Planning: Aligning AI and Analysts

To understand the value of Torq’s approach to runbook automation, let’s consider a common SOC runbook for investigating phishing reports. Such runbooks guide analysts through tasks like checking attachments, analyzing email headers, and escalating incidents when certain conditions are met.

Example SOC investigation runbook for User Phishing Reports
Example SOC investigation runbook for User Phishing Reports

Automating these tasks with AI is more complex than simply running through the steps. Many runbooks are written for human understanding and involve actions that may be ambiguous or beyond direct AI capabilities. Torq’s plan-and-execute approach addresses this challenge by separating the process into distinct planning and execution phases, giving analysts more control and visibility over the AI’s actions.

1. Planning Phase

In this phase, the AI:

  1. Reads through the runbook
  2. Converts instructions into a structured, transparent plan
  3. Break down each instruction into clear, atomic steps
  4. Identifies steps it can automate and those requiring human intervention
  5. Highlights gaps where it lacks necessary tools or access

This transparency allows SOC analysts to modify the plan, choosing where the AI should pause for guidance or where additional human-defined workflows are needed. In scenarios where full automation isn’t feasible, such as in highly secure or restricted environments, this collaborative planning ensures that the AI aligns closely with human intent and avoids unnecessary errors.

2. Execution Phase

Once the analyst reviews and approves the plan, execution follows this carefully vetted blueprint. 

This approach:

  • Strips ambiguity and indeterminism from the execution
  • Provides transparency and reliability
  • Fosters trust in the automation process

Analysts can be confident that AI will follow the exact plan, making the automation more efficient and dependable without sacrificing control or accuracy.

To reinforce the concept further, let’s consider how Socrates, our AI SOC analyst, would function without the ability to add tags while focusing on his communication skills and resistance to AI hallucination.

Socrates, even without the capability to add tags, would still demonstrate its effectiveness in several ways:

Clear communication of limitations: When faced with a task it cannot perform, such as adding a tag, Socrates would explicitly state its limitations. For example, it might say, “I’m unable to add the tag ‘Malicious IOC’ as I don’t have that capability. This step requires human intervention.”

Requesting user input: Socrates pauses the process and asks for user input when the necessary tools or permissions are lacking. This demonstrates its ability to recognize boundaries and seek assistance when needed.

Proceeding with available tools: For steps where Socrates has the required capabilities, it would continue to execute them efficiently. These actions would be marked as completed or “green” in the process.

Detailed explanations: Throughout its analysis and decision-making process, Socrates provides clear, thorough explanations of his reasoning, helping analysts understand its thought process even when it couldn’t perform specific actions.

Suggesting alternatives: When unable to perform a specific action, Socrates might suggest alternative approaches or provide information that could help the human analyst complete the task manually.

Focusing on these aspects can highlight Socrates’ ability to communicate effectively, recognize its own limitations, and resist AI hallucination by not claiming capabilities it doesn’t have. This approach emphasizes AI’s role as a collaborative tool that enhances human decision-making in the SOC rather than attempting to replace human judgment entirely. See what this looks like below:

Example of an email analysis workflow generated by the Torq AI SOC Analyst that outlines 11 automated steps for security checks, with green checkmarks indicating executable actions except for two manual breaks serving as AI guardrails by requiring human intervention for tagging “Malicious IOC” and “VIP” cases.
Example of an email analysis workflow generated by the Torq AI SOC Analyst that outlines 11 automated steps for security checks, with two manual breaks that serve as AI guardrails.

Strengthening Security Through Transparent AI Collaboration

Trust and transparency are fundamental to building an effective security strategy in today’s rapidly evolving threat landscape. Torq’s AI capabilities prioritize collaboration and clarity, transforming how SOC teams handle automation. By structuring automation as a two-phase process — planning and execution — Torq ensures that AI usage is efficient, bounded by AI guardrails, and aligned with human oversight and intent.

This collaborative approach allows human SOC analysts to:

  • Maintain control over automated processes
  • Reduce uncertainty in AI actions
  • Trust in the predictability and reliability of AI-driven tasks

Fostering a security environment where AI and human expertise work together can strengthen organizations’ SOC capabilities and enhance overall security posture. See Torq’s AI in action — schedule a demo.

Learn more about building trust in AI and how structured, evidence-backed summaries generated by AI enable seamless SOC shift transfers.

Share

Related Articles

AI Product

Take Control with Torq’s AI Data Transformation

By Brian Higgins
November 15, 2024
3 Minute Read
c

Contents

Data interoperability is the backbone of building reliable and efficient hyperautomated workflows. However, manipulating and formatting massive amounts of data from various sources — especially in complex JSON files — can feel overwhelming and consume significant time and resources, particularly for those still gaining technical expertise. Teams often lack or have maxed out dedicated resources to wrangle this data.

Today, we’re introducing AI Data Transformation, a powerful AI-accelerated operator that simplifies complex data transformation. It provides the testability, flexibility, and control required to manage enterprise-level workflows without writing a single line of code.

Why Data Transformation is Crucial

In hyperautomated workflows, seamless data flow between steps is crucial for optimal performance. AI Data Transformation achieves this with maximum efficiency by intelligently manipulating data as it flows to downstream steps. This powerful capability enables smooth operations by efficiently handling critical tasks such as attribute mapping, filtering, conditional statements, and aggregation functions — proactively addressing data compatibility between steps. In short, Data Transformation keeps workflows running at peak efficiency.

How AI Data Transformation Helps Security Teams

Torq’s AI translates natural language prompts into JQ commands, simplifying and democratizing JSON transformations. For those savvy in JQ, there’s full flexibility in modifying individual instructions and the generated code. Torq’s approach stands out for:

  • Customizability: Edit or rewrite any command to suit your needs.
  • Testability and Reproducibility: Test transformations and validate results for precise control.
  • Flexibility: Easily tweak transformations without disrupting your workflow.
  • Visibility: See prompts, code, and results at every step — zero guesswork.

While other solutions leave you in the dark, using monolithic parsing that makes it challenging to edit or troubleshoot, Torq keeps you in control through micro-transformations. Every transformation in Torq is testable, customizable, and modified with just a click, ensuring your automation runs precisely as intended.

Gif showing AI Data Transformation in action

Get Started

Transforming data is simple:

  1. Drag the transform operator into your workflow.
  2. Input the contextual JSON data you intend to transform, then click define transformation.
  3. Enter your prompt in natural language (e.g., “extract vulnerabilities”).
  4. Review the AI-generated JQ code and the output. Validate and edit if needed by fine-tuning with dynamic code generation or direct code editing.
  5. Transform your data with complete visibility and control.
  6. Save your work and reuse transformations as custom plans in the future.

Example Prompts

Need ideas? Here are a few natural language prompts and the associated JQ commands the Data Transformation operator could generate:

Natural Language PromptAI Translated JQ CommandSecurity Impact
“Extract all high severity vulnerabilities”.vulnerabilities[] | select(.severity == “high”)Quickly prioritize critical security threats
“Group alerts by source IP”group_by(.source_ip)Identify potential attack patterns or compromised assets
“Calculate the average CVSS score”[.[].cvss_score] | add / lengthAssess the overall vulnerability landscape

Read more about AI Data Transformation in Torq’s documentation or schedule a demo to see how it works.

Share

Related Articles

News Product

What’s New With Torq: November 2024

By Brian Higgins
November 7, 2024
3 Minute Read

Contents

As we close out 2024, Torq is rolling out powerful new updates to help security teams start the new year with even greater efficiency and impact. These recent enhancements are designed to streamline operations, boost productivity, and support seamless collaboration.

Here’s a look at the latest features set to transform your security operations.

AI Workflow Builder: Build Workflows in Seconds

Explore Torq AI Workflow Builder

AI Workflow Builder enables any security team to quickly create powerful, automated workflows, no coding required. Just describe your workflow in natural language, and AI will generate a fully functional, customizable workflow in seconds. Choose from over 4,000 pre-built actions and 300 integrations to tailor workflows to your security needs, freeing your team to focus on strategy, not setup.

AI Workflow Builder goes beyond the template library by offering fast, flexible automation that meets your organization’s unique security requirements without extensive manual configuration.

Learn More

Case Management: Accelerating Analysts and Team Leads

We’ve significantly upgraded Torq’s Case Management capabilities to provide more control and flexibility in handling security incidents.

You’ll find the following enhancements:

  • Create Cases from JSON Objects: This new step offers greater flexibility than the standard Create a Case step, allowing you to define additional attributes like custom fields, custom SLA timers, quick actions, and runbooks within a JSON object.
  • Configure Torq HyperSOC Case Settings: Adjust the auto-refresh interval for the Cases page and enable the option to mark notes and comments as public.
  • Granular Permission Controls: Create custom analyst roles without deletion permissions, ensuring only authorized team members can delete cases.
  • Case Note Improvements: For your subsequent work of art, we’ve increased the character limit to 65,000, added easy image resizing with aspect ratio preservation, and added an option to view full-size images. 
  • Bulk Update Cases’ Custom Fields: Use the Input mode dropdown to select whether to update a single field or multiple fields. For multiple fields, provide the key-value pairs in JSON format.

These new additions enable teams to handle incidents faster and more efficiently, from routine alerts to complex, large-scale security events. On to the next!

Interact: Bridge the Gap Between Security and Business

Torq Interact has become the central hub for cross-organizational security collaboration and automation. Now, you can create a portal interface for your internal organization’s end users. This seamless interface enables users to interact with and execute Torq Interact workflows, enhancing operational efficiency through cross-organizational process execution for streamlined, automated actions and real-time data access.

Learn More

Additional Enhancements

Watch this space for more updates as Torq continues to transform security automation.

Share

Related Articles

AI

GigaOm Declares Torq the Autonomous SOC Leader, Dramatically Outpacing Legacy Vendors

By Torq
October 29, 2024
5 Minute Read

Contents

GigaOm provides technical, operational, and business advice for IT’s strategic digital enterprise and business initiatives. GigaOm applies proven research and methodologies designed to avoid pitfalls and roadblocks while balancing risk and innovation, empowering enterprises to successfully compete in a changing business atmosphere.

GigaOm recognizes Torq as the only Hyperautomation vendor capable of delivering true autonomy to the SOC without vendor lock-in.

For years, security teams have grappled with relentless alert fatigue and burnout, exacerbated by disjointed security tools like SIEMs and SOARs. Legacy security vendors have tried to address this by cramming disconnected solutions into “all-encompassing” SecOps platforms, and many have now falsely tacked on “autonomous SOC” and “Hyperautomation” claims to their products. 

Security teams can’t afford to invest in another expensive, hard-to-maintain platform that doesn’t deliver on its promise of autonomy and automation — so where should they turn?

GigaOm’s newly-released Autonomous SOC Radar Report confirms: Torq Hyperautomation is the clear frontrunner in realizing the autonomous SOC vision and delivering the autonomy SOC teams have long been promised.

What is an Autonomous Security Operations Center (SOC)?

While legacy vendors now claim to offer SOC autonomy, true autonomy isn’t achieved by locking users into rigid, all-in-one platforms. These legacy solutions contributed to the very burnout problem that led to a talent shortage of 4 million security professionals. Their proposed solution? Dump more cash into the same outdated platforms.

A genuinely autonomous SOC leverages advanced automation and AI to handle manual and routine security tasks, accelerating response times, enhancing threat management, and ultimately safeguarding the well-being of SOC analysts. The most efficient path to this goal involves breaking down silos between security tools, enabling seamless communication and streamlined security operations across a modern, best-of-breed tech stack.

Simply put, it isn’t possible to achieve an autonomous SOC without automation. Torq is the only vendor solely dedicated to empowering security teams to automate more, faster.

“Torq is the only vendor positioned in the Innovation/Feature Play quadrant, as it is the only non-SIEM solution featured in the report, which also explains its differentiated position.“

– Andrew Green, Research Analyst for Networking & Security, GigaOm

Torq is the Only Hyperautomation Vendor Listed in GigaOm’s Autonomous SOC Report

Hyperautomation is the next evolution in scalable autonomous security operations. By definition, Hyperautomation requires enterprise-grade scalability, availability, and connectivity — essentially solving the challenges caused by these large legacy vendors. While the idea of the autonomous SOC is centered around the ability to automate everything, similarly, Hyperautomation is built on a foundational ability to integrate with anything. 

Torq’s recognition as the only Hyperautomation vendor in GigaOm’s Autonomous SOC Radar report underscores that unique position in the security operations landscape. 

Frameworks coming into law, such as DORA in the EU and CCSPA in Canada, spotlight the need for vendor diversity to reduce single points of failure and enable redundancy. Torq is the only autonomous SOC vendor enabling organizations to seamlessly integrate best-of-breed solutions — free from vendor lock-in.

Torq combines this vendor-agnostic approach with advanced technologies like purpose-built AI and Hyperautomation, engineered to create intelligent end-to-end solutions for security processes.

And GigaOm isn’t alone in recognizing Torq as the leader of autonomous SOC — industry analysts across the board are taking note.

“Torq is the first solution we’ve seen that effectively enables SOC professionals to mitigate issues including alert fatigue, false positives, staff burnout, and attrition. We’re impressed by how its AI augmentation capabilities empower these staff members to be much more proactive about fortifying the security perimeter.”

– Chris Kissel, Vice President, Security & Trust Products, IDC Research

By choosing Torq, organizations are embracing the future of security operations, as recognized by industry experts — with an approach that’s creating a more agile, effective, and strategic security operation.

Leveraging AI to Drive SOC Autonomy 

Torq integrates purpose-built AI capabilities such as generative AI and large language models (LLMs) to evolve SOC operations fundamentally and deliver on the promise of an autonomous SOC. This enables security teams to focus their efforts on proactive security measures, resulting in greater efficiency and accuracy in decision-making processes.

“80% of our security alerts are assisted and accelerated by Torq workflows. To analyze, enrich, and also autonomously respond to alerts is a paradigm shift that brings unprecedented efficiencies.″

– Joshua Blackwater, Deputy CISO, SentinelOne

Socrates, Torq’s AI SOC Analyst, exemplifies this by automating 90% of Tier-1 tasks through AI-powered triage and investigation. Socrates accelerates analyst response times by summarizing case data and providing immediate insights. It also automates 95% of security cases from investigation to response, intelligently assigning critical cases to human analysts when necessary. This augmentation empowers analysts at all levels to achieve machine-speed response times while supporting ongoing learning and skills development. 

The Sole Winner: Torq’s Unique Position

GigaOm’s report highlights the critical importance of AI-powered autonomous SOCs. As the sole Hyperautomation solution free from platform constraints, Torq provides the agility and innovation necessary for modernizing security operations in an increasingly demanding environment. 

For organizations seeking to enhance their SOC capabilities without sacrificing flexibility or risking vendor lock-in, Torq offers the only comprehensive solution designed to meet these challenges head-on. Schedule a demo to see it in action.

Get the Report
Share

Related Articles

AI Use Cases

Augment SOC Analysts with AI: 3 Key Use Cases

By Brian Higgins
October 23, 2024
3 Minute Read

Contents

How AI in SOC operations frees your analysts from repetitive tasks 

Despite the rapid evolution of security technologies, many SOCs are still weighed down by manual processes and outdated tools. Analysts are burdened with repetitive tasks, inefficient workflows, and disjointed incident response mechanisms. This broken system is leaving SOCs reacting to incidents instead of preventing them.

There’s a better way forward. With Torq’s AI SOC analyst, Socrates, security teams are redefining how they operate — moving from reactive to proactive and supporting efficiency at every level. Socrates enables security teams to automate mundane, repetitive tasks and take contextual action faster, moving towards an autonomous SOC and freeing analysts to focus on higher-order work. 

Let’s explore how Socrates revolutionizes SOCs by addressing three key use cases. 

1. Assigning Cases to Socrates

The average SOC is inundated with alerts, making it challenging to identify and prioritize critical cases. Manual case assignments consume valuable time and often result in misassignments that delay threat response. 

With Socrates, manual case assignment bottlenecks become a thing of the past. Socrates automatically triages incoming alerts, determines their priority level, and assigns them to the appropriate team or individual in real time. This lets analysts immediately focus on resolving high-priority cases without sifting through data or deciding who should handle what. The result is improved speed and accuracy in incident response, reducing time-to-remediation and easing the burden on your SOC team.

2. Augmenting Human-in-the-Loop Remediation

Despite advancements in automated workflows, there are times when human input is essential for nuanced decision-making. Many SOCs struggle to balance automation with human expertise effectively. Legacy models often fail to integrate humans seamlessly into the process, leading to efficiency gaps. 

Socrates streamlines human-in-the-loop workflows by notifying analysts when their input is needed. Analysts can quickly step in to guide the remediation process — whether it’s approving a firewall block, escalating an alert, or providing context for an investigation. This real-time collaboration between automation and human expertise reduces the mental load on analysts while ensuring critical incidents receive timely attention.

3. Automating Case Documentation and Admin Work

SOC analysts often dread documentation — as it takes time away from real security work. Case notes, incident logs, and reports are necessary for compliance and auditing, but they can be time consuming. 

Socrates alleviates the burden by automatically documenting cases as they evolve. From initial assignment to final remediation, Socrates records each step and updates relevant fields in real-time. This reduces the need for manual input, prevents human error, and ensures consistent documentation across the board. By handling admin work in the background, Socrates frees analysts to focus more on proactive security efforts.

The Future of SOC Workflows

The pain of relying on legacy SOAR tools and manual processes is over. By integrating Hyperautomation with AI through Socrates, SOC teams unlock new levels of efficiency, accuracy, and strategic value. Socrates modernizes your SOC from automatic case assignment and streamlined human-in-the-loop workflows to hands-free documentation.

Experience the power of Socrates — the AI SOC analyst who keeps pace with today’s most intense challenges. See Socrates in action — schedule a demo.

Share

Related Articles

AI

AI-Powered SOCs, Explained

By Torq
October 16, 2024
7 Minute Read
What is an AI SOC? Get the definition, components, use cases, and benefits of an AI-powered security operations center.

Contents

Security Operations Centers (SOCs) are the command center of an organization’s frontline cybersecurity defenses — responsible for monitoring threats, prioritizing alerts, and orchestrating remediation. However, today’s SOCs are facing an existential crisis: an overwhelming volume of increasingly complex and sophisticated threats combined with a shortage of skilled analysts. This perfect storm is pushing SOCs to their breaking point, burning out their teams and leaving their organizations vulnerable.

Legacy security solutions struggled to keep up with the evolving threat landscape, especially at scale. The rise of artificial intelligence (AI) has been hailed as a game-changer for SOCs, offering the potential for unprecedented efficiency gains.

But what does effective use of AI in the SOC look like? Below, we show top use cases for leveraging AI in the SOC and explore how AI is transforming security operations.

What is an AI SOC?

An AI-powered SOC is a security operations center that leverages artificial intelligence to automate processes, enhance threat detection, accelerate incident response, provide contextual insights, and optimize resource allocation —  resulting in greater efficiency and accuracy, improved decision-making, faster time to remediation, and a more proactive security posture.

The technical foundations of an AI-powered SOC

Security automation has evolved way past SOAR — with Hyperautomation and AI integration forming the new cornerstones of the modern autonomous SOC. Core components of AI used in SOC operations include:

  • Generative AI (GenAI) and Large Language Models (LLMs): These technologies can process vast amounts of security data to intelligently generate deeper threat insights, remediation recommendations, contextual case summaries, and new security workflows.
  • AI-driven Hyperautomation: By seamlessly integrating your security stack and instantly automating any security process using thousands of pre-built integration steps and AI-generated workflows, Hyperautomation offloads routine tasks, reduces analyst burnout, and accelerates threat response.
  • Natural Language Agents: AI SOC analysts can automate incident response by interpreting natural language instructions in security playbooks to execute tasks such as alert triage, containment, and remediation actions. Human analysts remain in charge of the processes and outcomes and can interface with AI agents using natural language for additional enrichment, investigation, and recommended next steps.

Top use cases for AI in the SOC

By analyzing vast amounts of data from across your security stack and executing intelligent automations, AI unlocks efficiency gains across SOC functionalities such as:

  • Incident investigation: Analyze massive volumes of alerts to identify patterns, suppress low-fidelity alerts, and automate triage and validation, accelerating the investigation process from start to resolution. 
  • Case management: Streamline the process of prioritizing, tracking, and managing security incidents by intelligently enriching and automating cases.
  • Workflow generation: Prompt AI with a natural language description of your use case to instantly build security automation workflows — no code required.
  • Case summarization: Analyze all relevant data points associated with a security alert to provide easy-to-digest, evidence-backed summaries of complex security cases, improving SOC analysts’ efficiency and collaboration.
  • Documentation: Automatically generate documentation for complex automated processes.
  • Executive reporting: Prompt the system to generate case info in the right tone and level of information for a specific persona, such as for a non-technical executive or board member. 
  • Team collaboration: Automatically alert Slack channels when a case is resolved.
  • Resource optimization: Use AI to assign cases to an available analyst based on workload and shift schedules. 
  • Data correlation: Combine and correlate data from all of the tools in your security stack, providing a holistic view of your security environment.
  • Threat response: Automate tasks like threat detection and containment for faster incident resolution.

How do AI-powered SOCs transform traditional security operations? 

Scaling SOC operations: AI can handle an influx of security events: triaging, investigating, and remediating the majority of Tier-1 and Tier-2 alerts. This frees up analyst bandwidth to focus on urgent incidents and strategic projects, enabling SOCs to efficiently scale their operations without increasing headcount (which is vital amidst today’s shortage of skilled cybersecurity talent).

Shifting to a proactive security posture: AI goes beyond just detecting and counteracting attacks by applying real-time intelligence to identify patterns and detect emerging threats. This allows SOCs to adopt a less reactive, more preemptive approach to address vulnerabilities before they can be exploited or breached. 

Reducing alert fatigue and analyst burnout: By autonomously triaging alerts and reducing false positives, AI reduces the number of irrelevant alerts that analysts must wade through. And, by automating tedious, repetitive tasks and auto-remediating most low-level alerts, AI helps senior analysts gain back the time and capacity to focus on more rewarding work like strategic projects. 

Speeding up MTTR: All of the efficiency gains from leveraging AI in the SOC translates to more alerts resolved, faster. 

Will AI replace humans in the SOC?

Adopting AI in the SOC is not about replacing human SOC analysts — it’s about augmenting and empowering them. With a looming 4 million+ cybersecurity talent shortage, organizations must not only retain their existing analysts, but also help them work more efficiently. On top of that, organizations are recognizing that human-only defenses are inadequate to counter the evasive and persistent threats posed by AI-driven attacks.

AI reduces analyst burnout: AI can reduce the strain on SOC teams by offloading rote tasks, auto-remediating the majority of Tier 1 tickets, and upleveling the skills of junior analysts. This frees up senior analysts to focus their expertise on critical threats and strategic projects to help their organization achieve a stronger security posture overall.

Human expertise must remain the final line of defense: Done the right way, AI-powered SOCs keep humans “in the loop” as the ultimate decision-makers for high-stakes threats following rigorous, multi-tiered AI evaluation and case enrichment that helps human analysts take informed, decisive action.

“By 2028, AI in threat detection and incident response will rise from 5% to 70%, to primarily augment, not replace staff.” 

Source: Gartner Inc.

How Torq’s AI capabilities supercharge SecOps

Torq has been very deliberate in how we’ve extended the capabilities of the Torq platform using AI to solve real problems for SOCs with products and features like:

  • AI Workflow Builder: Simply describe your desired security automation workflow in natural language, and Torq’s AI Workflow Builder will generate a tailored solution in seconds. Rather than spending hours manually building workflows from scratch, your team is freed up to focus on more strategic security initiatives.
  • AI Case Summaries: Help your team make the right decisions quickly by presenting them with a concise, insightful, and verifiable AI-generated summary of each case. No more wading through pages of logs and incident details! The easy-to-read summaries empower SOC teams to work faster, make informed decisions with confidence, and seamlessly transition between shifts by giving the incoming team clear case context backed by citations.
  • Socrates, the AI SOC Analyst: Socrates intelligently automates alert triage, incident investigation, and response, extending your SOC teams’ capabilities and improving response times across the board. Socrates can autonomously execute runbooks written in natural language, auto-remediating 95% of cases within minutes. For critical cases that require human intervention, your analysts can collaborate with Socrates using natural language to summarize case details, enrich cases with additional investigation and threat intelligence, and trigger remediation workflows.
  • AI Data Transformation: Simplify complex data manipulation for security operations by easily transforming complex JSON data using natural language — no coding required. Each transformation is broken down into precise, testable micro-transformations that users can edit, validate, and modify individually.

The future of the SOC: Better, faster human decision making through AI automation and insights

When deployed effectively, AI in the SOC extends and enhances the capabilities of your existing staff so they can make better decisions, faster. 

So, what does the future of SOC automation look like? Sophisticated AI technology continuously learning from historical data and real-time incidents to generate insights and recommendations, automate routine security tasks, and auto-remediate the majority of alerts, with a top layer of human analysts providing strategic oversight for critical cases. This means faster, more proactive responses to threats and vulnerabilities — and a more secure future for organizations everywhere.

Want to learn how Torq transforms SOC operations with AI-driven Hyperautomation? Explore HyperSOC.

Share

Related Articles

AI Insights

Building Trust in AI: Structured, Evidence-Backed Summaries for Seamless SOC Shift Transfers

By Gal Peretz
October 4, 2024
6 Minute Read
A key area for building trust in AI in the SOC? Ensuring that AI-generated summaries have the right structure and evidence to ensure seamless SOC shift transfers.

Contents

Gal Peretz, Head of AI & Data at Torq

Gal Peretz is Head of AI & Data at Torq. Gal accelerates Torq’s AI & Data initiatives, applying his vast expertise in deep learning and natural language processing to advance AI-powered security automation. He also co-hosts the LangTalks podcast, where he discusses the latest in AI and LLM technologies. 

Staying ahead of evolving cyber threats means more than just keeping up — it means outsmarting the adversary with intelligent, proactive solutions that supercharge your team. This blog kicks off our latest series focused on building trust in AI in Security Operations Centers (SOCs).

As we navigate this new era of AI, Torq recognizes that integrating intelligent systems into existing security workflows is both new and essential. And it can’t be just deploying advanced technology, it’s about building solutions that seamlessly collaborate with your team and earn their trust. Our mission is to create AI systems that enhance efficiency while embedding naturally into daily operations like SOC shift handoffs, ensuring that technology and human expertise work hand in hand.

The Challenge of Relying on Naive Summarizations in SOC Shift Handovers

Consider a scenario where an outgoing SOC team provides an AI-generated summary during a shift handover. The summary reads:

“A phishing alert was reported by an employee regarding an email from [email protected] with the subject ‘Your package is ready, needs to be released from customs.’ The email passed DMARC and SPF checks but contained several red flags indicating a phishing attempt.” [figure 1]

At first glance, this summary appears concise and informative, but the trained eye will notice it lacks more critical structure and detail. It doesn’t specify what exactly happened beyond a general phishing alert, when the events took place, or how the conclusion of a phishing attempt was reached. Moreover, it fails to cite any original evidence or analyses that support its findings. 

This absence of structured information and verifiable evidence leaves the incoming team with unanswered questions like: 

  • Which systems were affected?
  • What specific red flags were identified? 
  • Were there malicious attachments or links that need immediate attention?

Without this crucial information, the incoming team may misinterpret the severity of the threat or overlook essential steps needed for mitigation. The lack of evidence-backed details also opens the door for AI hallucinations — incorrect or fabricated information generated by AI — which can mislead the team into focusing on the wrong areas. 

Instead of facilitating a smooth transition, the unstructured and unsupported summary creates confusion, delays response times, and potentially allows the threat to persist or escalate.

Example of how a naive AI-generated case summary doesn't have enough information for reliable SOC shift transfers
Figure 1: Naive Case Summary Doesn’t Cut It for Reliable SOC Shift Transfers

The Torq Standard: Structured, Evidence-Backed Summaries

Now, imagine the same scenario we just discussed, this time the outgoing SOC team provides an AI-generated, structured, and evidence-backed summary. The summary is organized into clear sections — What happened, When it happened, and How it happened — each supported by direct citations to original forensic evidence.

“What happened: A phishing alert was reported by an employee regarding an email purportedly from [email protected] with the subject “Your package is ready, needs to be released from customs” [1]. The email contained malicious attachments (invoice.doc and QRCode.png) and included a suspicious link (hXXps://wood82c2[.]jayden1077[.]workers[.]io/c64ed9ed-b68b-4f61-b26e-20d32f0f13ab) [1]. The ‘Reply-To’ address differed from the ‘From’ address, indicating a potential phishing attempt [2].

When it happened: The phishing email was reported on August 5, 2024 [1]. Subsequent analyses and confirmations occurred between August 24 and September 2, 2024 [3][4][5][6].

How it happened: The email passed DMARC and SPF checks, but the discrepancy in the ‘Reply-To’ field raised suspicion [2]. Email body analysis flagged several phishing indicators: a non-legitimate link, a demand for information via a link, a false sense of urgency, and a lack of sender details [3][4]. Sandbox analysis of the attachments confirmed them as malicious, detecting unauthorized network activity and potential application crashes [5][6].” [Figure 2]

Citations:

  1. Phishing Alert Email received by an employee, dated August 5, 2024.
  2. Email Header Analysis Report, conducted on August 24, 2024.
  3. Email Body Content Analysis Summary, dated August 25, 2024.
  4. Suspicious Email Indicators Checklist, referenced on August 26, 2024.
  5. Attachment Scan Results from Antivirus Software, dated August 30, 2024.
  6. Sandbox Analysis Report of Email Attachments, completed on September 2, 2024.

With this structured summary and direct citations, the incoming team can quickly grasp the situation’s full context. They have immediate access to the supporting evidence, allowing them to validate the AI’s conclusions and understand the threat’s specifics without delay. This reduces the risk of misinterpretation and ensures that critical details aren’t overlooked.

The inclusion of citations linking back to original forensic evidence not only mitigates the risk of AI hallucinations but also builds trust in AI-generated insights. Team members can verify each point, ensuring that their actions are based on accurate and reliable information. This structured, evidence-based approach transforms the shift handover into a seamless transition, empowering the incoming team to act swiftly and effectively against the cybersecurity threat.

By adopting this method, Torq has developed AI-based security automation solutions that reflect the analytical thought processes of SOC professionals. The structured summaries not only enhance clarity but also empower team members to validate AI findings, thereby building trust in AI and facilitating more effective collaboration between humans and AI systems.

Example of how a a structured, evidence-based AI-generated case summary can help with building trust in AI in your SOC operations
Figure 2: Structured Summary with Forensic Evidence-Based Citations

Strengthening Your SOC with Trustworthy AI

Innovation and trust go hand in hand, especially in the critical field of cybersecurity. The challenges we’ve discussed highlight the necessity for AI solutions that do more than automate — they need to enhance trust, collaboration, and efficiency within your team. 

This is where Torq’s AI capabilities become your trusted partner in navigating the complexities of security operations. By providing structured, evidence-backed summaries, AI Case Summaries ensure that every piece of information is transparent and verifiable. It empowers your SOC by enabling team members to work faster, make informed decisions with confidence, and seamlessly transition between shifts. By reducing uncertainty and mitigating the risks of AI errors, it streamlines operations and strengthens your entire security posture. 

Together, we’re fostering a collaborative environment where AI and human expertise unite to safeguard your organization more effectively than ever before.

Share

Related Articles

Insights MSSP

4 MSSP Trends: Differentiate Your Business with CTEM, AI SOC, and More

By Torq
October 1, 2024
7 Minute Read
Explore 4 key MSSP trends to help differentiate your business — from continuous threat exposure management (CTEM) to AI-powered SOCs.

Contents

MSSPs have huge potential for growth as more and more companies turn to experts to outsource their cybersecurity. Tailwinds such as escalating cyber threats, the need to protect more customer data than ever before, and growing compliance requirements are driving the managed security services market’s growth at a compound annual growth rate of 15.4% from 2023 to 2030. 

But competition is fierce in a market crowded with thousands of MSSPs — and the landscape is constantly evolving in response to seismic shifts like the rise of AI. 

How do you stand out from the MSSP crowd while adapting to major changes? Below we break down four key trends forward-thinking MSSPs are capitalizing on to differentiate their business and win.

MSSP Trend #1: Budgets are Shifting to More Proactive Security Solutions

In 2024, over 70% of businesses increased spending on proactive security solutions, outstripping spending in preventative and reactive measures.[1] It’s pretty easy to see why: a proactive approach helps organizations get ahead of threats before vulnerabilities can be exploited — rather than constantly dealing with the fallout from attacks that have already happened.  

Proactively identifying and remediating exposures can lower the overall security workload over time while decreasing the likelihood of downtime, data breaches, lost productivity, and lost revenue from attacks. To win business amidst this spending shift, MSSPs need to evolve their approach, services, and messaging towards a proactive stance.

Why this is great for MSSPs: Not only are clients increasingly looking for proactive security solutions, adopting a proactive posture also makes a better business case for MSSPs. 

It’s difficult to attach clear ROI to a reactive, defensive stance because lack of failure is hard to quantify. Flipping the script to an offense-oriented, proactive posture enables  more tangible measurement of harm mitigation and risk reduction. This helps MSSPs make a stronger business case to clients, and in turn, helps their clients demonstrate effective results to their own leadership when justifying budget allocation for security investments. 

MSSP Trend #2: CTEM Brings Opportunity to MSSPs Through Prioritized Threat Remediation

A proactive approach to security must be implemented programmatically in order to succeed. Gartner, Inc. introduced the concept of Continuous Threat Exposure Management (CTEM) as a new methodology for security teams to reduce future exposure amidst a dynamically shifting threat landscape. 

Not every vulnerability is created equal — a key component of CTEM is to prioritize vulnerabilities based on urgency, exploitability, and potential impact on the business.

According to Gartner, Inc., by 2026, organizations that prioritize their security investments based on a continuous exposure management program will be 3x less likely to suffer a breach.

Why this helps MSSPs differentiate: A prioritized approach to threat remediation recommendations enables clients to focus their resources where they will have the most impact: critical vulnerabilities. This efficiently maximizes risk reduction — and helps MSSPs redefine their role as strategic partners, rather than just service providers.

Strategic recommendations also help MSSPs improve collaboration with clients’ internal teams when remediation actions are needed. Rather than lobbing an unmanageable barrage of issues that need fixing over the fence to a client’s overwhelmed IT teams, providing high-priority recommendations alongside justification for why the remediation matters to the business will enable client teams to more effectively address their most urgent vulnerabilities.

MSSP Trend #3: SOAR is Out — and Hyperautomation is Maximizing MSSP Margins

A proactive, programmatic security strategy requires a robust tech stack that streamlines processes and empowers human experts. For MSSPs, Security Orchestration Automation and Response (SOAR) was supposed to be the silver bullet to help them automate operations at scale. However, SOAR’s monolithic architecture and reliance on proprietary connectors failed to deliver even the most basic functionality required to effectively automate security operations — and it’s left MSSPs locked-in to a rigid vendor stack, unable to scale, and bleeding margins.

Enter Hyperautomation. Cloud-native, built for multi-tenancy, and with limitless security integrations and automations, the Torq Hyperautomation platform is changing the game for MSSPs. Hyperautomation:

  • Offloads repetitive tasks by instantly automating any security process using thousands of pre-built integration steps and AI-generated workflows.
  • Frees up MSSP teams to focus on high-value work by proactively identifying threats, prioritizing investigations, and only elevating cases to the appropriate analyst when human-in-the-loop intervention is needed.
  • Onboards new clients in minutes and reduces onboarding costs by securely sharing workflows across environments.
  • Seamlessly integrates with every tool in your clients’ existing security stack.

Why this matters to MSSPs: The supercharged efficiency gains from Hyperautomation means your MSSP can do more, faster — without increasing headcount. This translates to reduce customer acquisition costs, boosted margins, faster-time-to-value, and improved SLAs. Sounds like a win-win-win-win.

The latest MSSP trend? Ditching SOAR for Hyperautomation. Get the Managed Services Manifesto to learn why SOAR is dead.

MSSP Trend #4: AI-Powered SOCs are Rapidly Becoming the Future of Security Operations

MSSP SOCs are under siege from a tsunami of threats growing in severity and complexity, exacerbated by an ongoing talent shortage. Security analysts can only address half of the alerts they’re assigned each day, and nearly half say average detection and response time has increased within the past two years,[2] impacting MSSPs’ ability to meet SLAs. This can lead to penalties, customer churn, and reputational damage. 

AI has radically changed the security world — and it’s key to helping MSSP SOCs beat burnout and stay ahead of evolving threats. Leveraging AI in security operations is not about replacing analyst jobs, but rather augmenting and upleveling existing staff so they can make informed decisions faster without being bogged down by low-level alerts. 

With Torq, MSSPs harness the power of AI through:

  • Socrates, the AI SOC Analyst: Socrates can autonomously execute SOC-defined runbooks written in natural language, auto-remediating 95% of cases within minutes. For critical cases, your human analysts can collaborate with Socrates using natural language to summarize case details, request additional information, and trigger complex remediation workflows — upleveling the capabilities of your team and speeding up response times across the board.
  • AI Workflow Builder: Create custom security automation in seconds by describing your needs in simple, natural language, then previewing and customizing the results — no code required. 
  • AI Case Summaries: Rather than manually slogging through pages of logs and incident details, Torq automatically presents your team with a concise, insightful summary of each case, surfacing critical insights and recommendations so your team can make the right decisions quickly.

Why this helps MSSPs: By automating workflows, speeding up processes, enriching and summarizing cases, and augmenting human expertise, Torq helps MSSP SOC teams achieve machine speed response and start building an autonomous SOC. This results in a faster MTTR to better serve customers — improving their satisfaction and retention. 

Not only that, an AI-powered SOC helps eliminate alert fatigue and analyst burnout so your team has the bandwidth to focus on the bigger picture: strategically securing your clients’ organizations. 

“We are impressed by how [Torq’s] AI augmentation capabilities empower [SOC] staff members to be much more proactive about fortifying the security perimeter.”

IDC HyperSOC™ Spotlight Report

Unlock Growth and Differentiation: The Power of Proactive, AI-Enhanced Security

Proactiveness, prioritization, Hyperautomation, and AI are the future of security operations — and the keys to MSSP evolution and success. Adopting these now will help you stand out, better serve customers, hold on to your best talent, and boost your margins. 

Explore how Torq is helping MSSPs get ahead of the curve and win.

Sources:

  1. Security Magazine, More than 70% of companies increased spending on proactive security, June 2024
  2. Morning Consult and IBM, Global Security Operations Center Study Results, March 2023

Share

Related Articles