Insights Research

SANS Survey: 5 Security Challenges Keeping SOCs in the Dark

By Torq
March 20, 2025
6 Minute Read
SANS Detection and Response Survey shows that SecOps teams are facing existential security challenges.

Contents

The 2024 SANS Detection and Response Survey sheds new light on some all-too-familiar security challenges: security operations teams are overwhelmed with alerts, struggling to respond fast enough, and tracking the wrong KPIs. Sure, automation adoption is increasing (64% of organizations now leverage it in some capacity), but most SecOps teams are still operating in slow, reactive, and heavily manual environments.

Five Security Challenges Faced by SecOps Teams

1. Security teams are stuck in semi-automation mode.

Most security operations teams think they have automated response mechanisms, but they’re really just babysitting inefficient, semi-automated workflows. The SANS Survey data shows that while 64% of teams have automated response mechanisms in place, less than a quarter have fully automated their processes. That means the vast majority still rely on analysts to manually intervene and execute responses.

2. Slow response times are leaving organizations exposed.

Speed matters. Attackers are betting you’ll take a while to respond to threats. SANS found that a whopping 32.8% of teams take hours to respond to threats, and 41.4% say they respond within minutes. In today’s reality, even minutes can be too slow. Recent data shows that lateral movement breakout times dropped from 62 minutes to 48 minutes, with the fastest recorded breakout happening in just 51 seconds. If a response takes more than a minute, the damage may already be done. 

3. Alert fatigue and data overwhelm are killing security team productivity.

It’s loud in the SOC. More than half of security teams say false positives are a huge problem, and 62.5% are overwhelmed by sheer data volume. Every second spent triaging junk alerts is a second not spent investigating real threats — meaning SOCs are burning through their most precious and expensive resource: human focus. Analysts’ expertise is critical for threat investigation and response, yet most of their time is wasted manually sorting through thousands of low-value alerts that should’ve been filtered out in the first place. This wastes time, burns out analysts, and, worst of all, lets real threats slip through. 

4. Security teams are still tracking the wrong KPIs.

The most surprising part of the survey responses is that more than 50% of security teams aren’t even tracking KPIs like Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). ​​Instead, they’re tracking vanity metrics like the number of incidents detected  —  or, worse, they don’t have enough data to measure their own efficiency. Without the right data, SOC teams cannot optimize performance or reduce response times.

5. SOAR is holding teams back.

SOAR was supposed to be the answer to security automation… right? The majority of respondents use SOAR for threat response, but half still rely on manually running commands to respond to threats. This proves what we at Torq already know: SOAR hasn’t lived up to its promise. SOAR platforms were supposed to automate security workflows, but most teams still struggle with slow response times, rigid playbooks, and high maintenance overhead.

The Fix: An Autonomous SOC Powered by AI-Driven Hyperautomation

The answer to these existential security challenges isn’t manually tuning SOAR, tweaking detection rules hoping something works, or hiring more analysts (Be real: Where are you even finding them? The SANS Survey found the majority of security teams struggle with lack of skilled personnel). The real fix is an autonomous SOC powered by AI-driven Hyperautomation: a SOC that invests in AI and automation to eliminate inefficiencies, take action at machine speed, and, ultimately, shorten response times.

Comparison table showing how an autonomous SOC fixes 5 key security challenges.

1. Go autonomous. 

Ditch the scripts, stop the manual tuning, and let AI take over. An autonomous SOC removes the need for engineers to build, maintain, and tweak workflows with extensive coding. Instead, teams can simply describe a workflow, use case, or outcome using natural language to guide agentic AI as it implements workflows to secure the organization faster than ever before. An autonomous SOC can handle 95% of Tier-1 cases — allowing security teams to focus on critical, high-impact threats, rather than babysitting outdated playbooks or struggling with the limitations of rigid SOAR architectures.

“With Torq Agentic AI, the answer is yes to questions such as: Are analysts happier? Are they sticking around? Do they have time to focus on more interesting and complex investigations? Are MTTM and MTTR lower? Torq Agentic AI extends and enhances our team so it can make better decisions more quickly — resulting in stronger security all around.” 

– Mick Leach, Field CISO, Abnormal Security  

2. Slash response time.

With SOC automation, alerts don’t sit in a queue waiting for an analyst to take action. AI-driven Hyperautomation instantly takes action to investigate alerts, enrich cases, and contain threats  — isolating infected endpoints, disabling compromised accounts, and blocking malicious infrastructure before damage is done. Unlike SOAR’s static playbooks, an autonomous SOC leverages AI to tirelessly and intelligently analyze and remediate massive volumes of security incidents, shrinking response times from hours to seconds.

3. Eliminate alert fatigue.

AI Agents don’t just process alerts — they triage and prioritize them. AI-powered SOCs use sophisticated planning and contextual reasoning to filter out low-fidelity alerts, suppress false positives, and escalate only the alerts that matter. Analysts no longer have to sift through thousands of useless alerts  —  AI handles the noise so teams can focus on critical security risks.

4. Track the right KPIs.

An autonomous SOC should be able to measure security response and provide visibility into operations. Instead of requiring analysts to manually track and compile data, AI can capture and log detection times, response actions, and remediation speeds automatically. SOC leaders finally get a clear picture of what’s working, where bottlenecks exist, and what to optimize.

5. SOAR is dead. Ditch it.

SOAR is simply too slow, rigid, and high-maintenance to keep up with modern SOC demands. An autonomous SOC doesn’t rely on pre-scripted playbooks — it builds, executes, and adapts automation dynamically, all in natural language. With AI-driven Hyperautomation, security teams move faster than attackers, not the other way around. See the difference.

It’s time to move past the limitations of SOAR and slow, reactive security operations. Take your SOC autonomous — learn how easy it is to switch to AI-driven Hyperautomation from Torq.

Get the SOAR Migration Guide
Share

Related Articles

AI Hyperautomation

What is Hyperautomation?

By Torq
March 18, 2025
5 Minute Read
Diagram explaining what is Hyperautomation in cybersecurity

Contents

Hyperautomation is an efficiency-driven, strategic process that integrates across business technology stacks to rapidly automate and orchestrate as many business and IT operations as possible. It uses advanced technologies such as AI and low-code/no-code platforms for greater speed and ease of use.

Hyperautomation Definition

So, what is Hyperautomation? It’s a strategic business approach that unifies multiple automation technologies to streamline and speed up complex processes end to end. While traditional automation focuses on repetitive, rules-based tasks, Hyperautomation layers in intelligence, adaptability, and orchestration for machine-speed efficiency — transforming how teams work across IT, business, and cybersecurity.

Learn more about security Hyperautomation > 

Automation vs. Hyperautomation

At a glance, automation and Hyperautomation sound similar, but they solve very different problems in cybersecurity. Traditional automation handles simple, repetitive tasks. Hyperautomation spans systems, layers in AI-driven decision-making, and coordinates human-machine collaboration at scale. It’s about full lifecycle automation — detection, triage, enrichment, response, and resolution — across multiple domains.

In cybersecurity, this means moving beyond automating password resets or phishing reports. Hyperautomation empowers your security operations center (SOC) to autonomously detect threats, prioritize alerts, trigger tailored responses, and continuously optimize based on results.

How Hyperautomation Tools Work

Hyperautomation isn’t one tool — it’s a coordinated ecosystem. It connects multiple Hyperautomation technologies into a single framework, typically combining:

  • GenAI and agentic AI for decision-making and contextual awareness
  • Low-code/no-code platforms for fast workflow building without extensive coding
  • Business process management for orchestrating complex workflows
  • Integration platforms for connecting apps, tools, and systems
  • Analytics and reporting tools for measuring performance and optimizing automations over time

Hyperautomation can adapt — systems can dynamically adjust workflows, update rules based on new data, and seamlessly coordinate human and machine collaboration.

The Hyperautomation Advantage

Hyperautomation technology transforms SecOps by delivering faster, smarter, and more scalable operations. Here’s a quick look at the biggest Hyperautomation benefits:

  • Ease of use: With drag-and-drop interfaces and no coding required, anyone on the security team can create powerful automations in minutes. Complex threat responses become easy to build, deploy, and scale across teams without relying on the complexity of legacy SOAR solutions or waiting for custom coding.
  • Lower costs: Dedicated expert support with no surprise consulting fees.
  • Secure on-prem connectivity: Zero-trust agents connect hybrid environments securely.
  • Flexible, full-stack automation: Integrate and automate anything across cloud, infrastructure, and on-prem systems.

From Automation to Hyperautomation 

Security automation started with promise — but hit its limits fast. Legacy SOAR tools were designed to orchestrate basic security actions but broke down under the weight of modern security demands. Static playbooks, brittle integrations, and clunky interfaces turned what was supposed to be “automation” into yet another bottleneck.

Security teams needed a new way forward as threats grew faster, more dynamic, and more complex. Unlike SOAR, Hyperautomation doesn’t just automate a few steps; it transforms the entire SOC workflow. 

It connects tools across your technology stack, enables context-aware decisions, and executes actions quickly. And because it’s built with low-code/no-code at its core, it empowers any analyst, not just engineers, to build, test, and deploy workflows in minutes.

Where SOAR failed to scale, Hyperautomation moves 10x faster with infinite extensibility, seamless integrations, and built-in case management to reduce noise and prioritize what matters. It enables SOCs to go from “human-in-the-loop” to “human-on-the-loop,” directing strategy while AI and automation handle the grind.

When paired with agentic AI, Hyperautomation becomes the foundation of the autonomous SOC, which is a SOC where alerts are triaged, threats are hunted, incidents are remediated, and analysts stay focused on the big picture.

Hyperautomation Use Cases in Cybersecurity

Hyperautomation doesn’t just make your SOC more efficient — it can transform how your team works. Here are some ways where Hyperautomation delivers major impact for cybersecurity teams.

1. Incident Response
Hyperautomation enables end-to-end incident response without human bottlenecks. From initial detection and triage to investigation, enrichment, and remediation, intelligent SOC automation accelerates every phase of the process — reducing mean time to respond (MTTR) from hours to minutes.

2. Phishing
Phishing is a top entry point for attackers. Hyperautomation instantly identifies suspicious messages, quarantines affected inboxes, revokes compromised credentials, and notifies users — all without requiring analyst intervention.

3. Just-in-Time (JIT) Access Provisioning
Managing administrative privileges across a hybrid infrastructure can be a nightmare. Hyperautomation grants and revokes access dynamically based on workflows and business rules, reducing privilege creep and improving security posture.

4. Threat Hunting
With Hyperautomation, SOCs can continuously search for threats using AI agents across SIEMs, EDRs, and identity platforms. It’s proactive defense — and it’s fast.

5. Identity and Access Management (IAM)
From self-service access validation to automatic account cleanup, Hyperautomation brings control and consistency to identity workflows, ensuring alignment without added complexity.

Hyperautomation with Torq

Torq Hyperautomation™ combines agentic AI, low-code/no-code workflow building, and multi-system security orchestration into one unified experience. Whether you’re deploying across cloud, on-prem, or hybrid environments, Torq makes it easy to automate your entire SOC — without needing a single line of code.

Key benefits of Hyperautomating your security operations with Torq include:

  • AI-native: Orchestrate AI agents that triage, investigate, and remediate alerts.
  • Low-code simplicity: Use drag-and-drop or natural language prompts to build advanced workflows in minutes.
  • Massive integration library: Connect with any tool in your security stack and beyond.
  • Built-in case management: Prioritize and enrich alerts automatically, route decisions to the right people, and track everything.

As threats grow faster, more complex, and more automated, your response strategy has to evolve just as quickly. Whether you’re replacing legacy SOAR, reducing alert fatigue, or scaling your SOC, Torq’s Hyperautomation platform gives you the speed, intelligence, and flexibility to stay ahead.

Feeling the pressure to get more done faster across your security operations? 

Get the SOC Efficiency Guide
Share

Related Articles

Hyperautomation Use Cases

Combating Ransomware, Phishing, and Zelle Fraud at Financial and Bank SOCs

By Bob Boyle
March 12, 2025
7 Minute Read
Learn how financial services and bank SOCs are using security Hyperautomation to replace spreadsheets, defend against phishing, and combat Zelle fraud.

Contents

Banking and financial services companies sit on a goldmine of sensitive customer data, making them a prime target for phishing and ransomware attackers hoping to strike a payout. 

Even with defenses like MFA and security training, human error continues to be a critical point of failure for financial institutions — a 2024 report found that 3 out of every 1000 individuals working in banking click on a phishing link each month. This stark reality of risk highlights the industry’s urgent need for more proactive, automated security processes.

Below, we break down the top financial and bank SOC use cases for security Hyperautomation and cover how a major regional bank successfully reinstated Zelle services by automating account lockdowns for fraud alerts.

The Automation Imperative in Finance and Bank Security Operations

Two of the most common — and critical — security operations priorities for CISOs we’ve talked to at banks and financial services companies are to:

  • Mitigate risk by quickly responding to, containing, and remediating attacks.
  • Maintain materiality by focusing on the most important security issues that could cause the biggest problems and by being able to accurately assess when a cybersecurity incident requires SEC reporting.

Achieving these requires reducing Mean Time to Respond (MTTR), ensuring swift and effective remediation, and gaining visibility across all identities and security assets. However, manual processes, a jungle of spreadsheets, and siloed data compound operational challenges at financial and banking organizations. 

To modernize their financial and bank SOCs, forward-thinking CISOs are embracing Hyperautomation as a way to unify their security stack and automate incident response. Integrating solutions like ServiceNow or Snowflake with Torq’s AI-driven Hyperautomation platform can provide a single source of truth and streamline security operations for a stronger security posture and greater visibility across the SOC. 

Top 5 Bank SOC Challenges Solved by Hyperautomation

Below are the top use cases being Hyperautomated by Torq’s financial services customer base, along with real-world examples of the workflows they have built.

1. Phishing Alert Analysis

Automate the extraction and aggregation of URLs, file hashes, and message headers from Outlook messages and attachments, providing a comprehensive data set for further security analysis. 

Workflow Steps:

  1. Receive potential phishing alert from Microsoft 365.
  2. Execute parallel tasks to extract URLs from the email body, retrieve message headers, and process attachments (if present).
  3. For the email body, extract all unique URLs and collect them.
  4. Retrieve message headers using Microsoft Graph API and store them.
  5. If the email has attachments, list them and filter out non-file attachments.
  6. For each file attachment, retrieve detailed information and extract URLs from the content if available.
  7. Collect and combine URLs from various sources (e.g. body and attachments). Set default values if no URLs are found.
  8. Link message headers from the email and attachments, setting default values if none are found.
  9. Generate a structured output containing URLs, file hashes, and message headers.
  10. Nested Workflow: Case Management

2. Ransomware Case Creation and Categorization

Automate the ingestion and processing of CrowdStrike threat data by creating a comprehensive case in Torq. Once the case is created, notify the security team via email while categorizing the threat and adding relevant observables for further analysis. 

Workflow Steps:

  1. Extract specific fields from the incoming CrowdStrike event data into a sparse JSON object.
  2. Flatten the JSON object for easier processing and format it for a markdown table.
  3. Convert the event’s creation date to a specified format.
  4. Create a markdown table from the formatted data.
  5. Use a switch-case structure to categorize the threat as malware or ransomware, setting a variable accordingly.
  6. Create a case in Torq using the extracted and formatted data, including custom fields and tags.
  7. Add observables to the case, such as file hashes, with specified reputation scores.
  8. Query historical cases and link any closed cases with matching observables. 
  9. Generate an access token for Microsoft 365 and send an email notification about the new case to the specified recipient list.

3. Automated Threat Analysis and Enrichment 

Automate the process of extracting and analyzing threat intelligence data based on specific commands submitted by the security team — e.g. “Check IP”, “Check Hash”, or “Check Host”. Facilitate communications through Microsoft Teams to trigger the workflow and receive the enriched threat analysis. 

Workflow Steps:

  1. Evaluate incoming event text to determine the command type (!checkip, !checkhash, !checkhost).
    • For !checkip: Extract IP address using regex and retrieve information for each IP from AbuseIPDC
    • For !checkhash: Extract patterns using regex, retrieve analysis reports from AnyRun and get threats from SentinelOne
    • For !checkhost: Extract patterns using regex and initiate a scan on SentinelOne agents, wait for a specified duration, then retrieve threats from SentinelOne.
  2. Reply with the information gathered to the thread in the originating Microsoft Teams channel. 

4. Case Management

Automate the process of checking for existing cases and creating new cases if necessary, ensuring efficient case management and reducing duplicate cases. This workflow is a valuable and repeatable tool for any case management program. Consider using a “nested workflow” attached to other Hyperautomated use cases (for example, see Phishing Alert Analysis above).

Workflow Steps:

  1. Query existing cases to check if a case already exists with the specified name, event data, or observable submitted.
  2. If a case exists, attach the new observable to the case and exit the workflow with the existing case ID.
  3. If no case exists, create a new case with the provided details such as title, SLA, severity, and state.
  4. After attempting to create a case, check the creation status.
  5. If the case creation is successful, exit with the new case ID.

5. Fraud Detection

Automate the process of locking or unlocking a user account based on suspected fraud event data. Update your CRM with relevant fraud activity and notify the appropriate stakeholders with contextual information about the actions taken.

Workflow Steps:

  1. Set workflow parameters to include user ID and notification email addresses.
  2. Check if required fields are present in the event data.
  3. Verify the user’s status via an API call and determine if the user should be locked or unlocked.
    1. If lock: Execute an API call to lock the user and set a variable indicating the action taken.
    2. If unlock: Execute an API call to unlock the user and set a variable indicating the action taken.
  4. If the lock/unlock action is successful, query Salesforce to retrieve the user’s account information.
  5. Add a “fraud task” to the user’s account in Salesforce and notify the specified email addresses of the action taken.
  6. If adding the activity to Salesforce fails, send a failure notification to the specified email addresses.

Case Study: Automating Zelle Fraud Detection and Lockdown from End to End

A major regional U.S. bank with billions in assets faced an urgent, compliance-driven requirement to automate their detection and response to fraud alerts in Zelle, a customer-facing payment service that had been suspended by the SEC due to a surge in fraudulent activity.  

With Torq’s Hyperautomation platform, the bank’s SOC quickly automated the end-to-end process of locking down accounts triggered by fraud alerts, enabling them to reinstate Zelle services. Torq also automates CRM updates, giving customer service immediate context when talking to customers about account lockdowns.

And that’s not all they achieved with Torq — read the case study for the full story of how they published over 100 workflows in just 3 months and reduced their Mean Time to Investigate (MTTI) from hours to minutes.

Get the Case Study

Share

Related Articles

AI Hyperautomation

The SOC Automation Pyramid of Pain

By Patrick “PO” Orzechowski
March 4, 2025
7 Minute Read
Explore each level of the SOC Automation Pyramid of Pain.

Contents

Patrick Orzechowski (also known as “PO”) is Torq’s Field CISO, bringing his years of experience and expertise as a SOC leader to our customers. PO is a seasoned security veteran with a deep understanding of the modern security landscape. You can find him talking to SOC leaders and CISOs from major brands at cybersecurity events around the world.

Why AI-driven Hyperautomation is the answer to your SOC pain.

About 10 years ago, Alex Pinto came up with the idea of the threat intelligence “Pyramid of Pain” in the talk Measuring the IQ of Your Threat Intelligence Data at at DEF CON ‘22. I love this idea and I think it applies to a lot of aspects of cybersecurity, especially as we move towards a more autonomous, less human-involved security operations center (SOC).

Looking to automate your SOC? Below, I walk through each level of the Pyramid of Pain applied to the security automation journey as a framework for reducing business risk and accelerating incident mean time to respond (MTTR). 

The SOC Automation Pyramid of Pain: From Bottom to Top

Get a Copy

Level 1: The Basics — Integrations, Enrichment, and Context

The promise of legacy SOAR was to automate the core functions of a SOC, especially from a Tier-1 and Tier-2 perspective. These are the most basic aspects of automating security operations and have been around forever, dating back to Perl scripts! Whether you use Python, Go, or any other automation capabilities including PowerShell, these capabilities have existed since security operations centers have been a thing.

Any automation platform that you implement should have these enrichment capabilities inherently built into them to enhance and contextualize indicators of compromise (IOCs), identities, and assets. They’re the foundation of automation and the core of security operations. Crucially, they should also enable the humans who work in your SOC to be as efficient and effective as possible when it comes to responding to threats, new vulnerabilities, and systems that exist in your environment. 

Difficulty: Low
Business risk impact: Low

Time savings: 80-90% reduction in manual data enrichment, saving 1-2 hours per SOC analyst daily.Cost efficiency: Up to 730 hours saved per analyst annually (based on 2-3 hours of manual tasks per day). At an average hourly rate of $50, this equals $36,500 saved per analyst per year, or $365,000 for a 10-analyst team.Productivity gains: 30-50% faster triage due to immediate access to enriched data.Overall risk reduction: Fewer missed IOCs due to consistent enrichment (priceless!).

Level 2: Moving Up — Collaborative Case Management

Case management is an essential piece of any security operations automation platform. Legacy SOAR and traditional case management systems do not take into account all of the other teams and functions that are involved in a typical incident response scenario. 

In contrast, Torq’s case management system in HyperSOC™ allows collaboration between teams’ workflows and workspaces that enable different organizations to enrich and contribute to an incident response scenario.

Difficulty: Low
Business risk impact: Low

Time savings: 25-50% reduction in time spent managing cases due to automated workflows.Cost efficiency: Avoiding the need to hire one additional analyst saves $100K-$150K annually (varies by location), including salary and benefits.Productivity gains: SOC analysts can consistently handle 2-3x more cases at the same time without additional headcount.Reduced Mean Time to Respond (MTTR): Automation reduces MTTR by up to 50-70%, allowing faster incident containment and remediation.Risk reduction: Faster response minimizes the potential financial impact of a breach. The average cost of a data breach was $4.88M in 2024.

Level 3: Automated Reporting — KPIs and SOC Metrics

SOC metrics have consistently posed a challenge for enterprises. Metrics such as Mean Time to Respond (MTTR), Mean Time to Detect (MTTD), Mean Time to X, and other similar measurements often fail to capture the true scope of business risk. 

To address this, an automation system should facilitate collecting metrics across all security tools and the entirety of an enterprise’s security stack. This provides a comprehensive view of the SOC’s activities, processes, and resulting business outcomes — ensuring that the impact of security operations is clearly understood.

Difficulty: Low
Business risk impact: Medium

Time savings: Up to 90% reduction in time spent generating compliance and audit reports.Reporting accuracy: Minimal to no errors in reporting, ensuring compliance with regulatory frameworks like GDPR and PCI-DSS.Fine avoidance: By ensuring reporting accuracy and compliance, companies could avoid, for example, $50K-$100K per month for PCI-DSS violations (depending on the transaction volume and duration), or up to €10 million or 2% of global annual revenue, (whichever is greater) for GDPR non-compliance.

Level 4: Basic Automated Response — Point Solution Capabilities

Every security vendor, whether endpoint, firewall, email, or any other point solution, should prioritize robust API capabilities to enable automated response and remediation. 

At this point in the security automation journey, enterprises should be able to automate responses to critical incidents, such as host isolation, malicious processes, stolen or compromised identities, and assets that have been identified as vulnerable to critical Internet-exposed vulnerabilities.

Difficulty: Medium
Business risk impact: High

Response time improvement: 80%+ faster containment for malware infections, phishing attacks, and account compromises.Overall risk reduction: Significantly decreased threat exposure window through automated response actions within seconds to minutes.Increased employee satisfaction: Reduced analyst burnout as analysts focus on complex threats instead of repetitive tasks. 89% of employees report higher job satisfaction after adopting automation solutions.Savings through talent retention: With a global shortage of 2.3M+ SOC analysts, retaining talent is paramount. More satisfied analysts leads them to stay around longer — and not needing to hire an additional single SOC analyst saves between $50-$100K (varies by region), including recruitment, training, and lost productivity.  Companies using Hyperautomation report retention as a key ROI metric for 43% of leaders.

Level 5: The Point of the Spear — Fully Automated Remediation Across the SOC

At the highest level of security automation maturity, organizations should be bringing together all of the capabilities of their security stack. This integration should extend to IT security operations, DevOps, cloud communications, and cloud capabilities, as well as any on-premise or custom applications, enabling a comprehensive automated response to threats and vulnerabilities. 

The aim is to streamline and automate all processes that are identified to reduce business risk and improve MTTR, integrating the entire IT and security stack to achieve autonomous remediation. This paves the way for an autonomous SOC that handles routine security responses, with human intervention reserved for critical decisions.

Difficulty: High
Business risk impact: High

MTTR reduction: Up to 70% decrease in MTTR, minimizing business disruption during high-severity incidents.Risk elimination and consistency: Near-zero human error ensures consistent, immediate investigation and remediation of critical incidents.Operational scalability: SOCs can handle a 200-300% spike in incident volume without adding headcount.Labor cost savings: Near-zero human intervention required for routine remediation actions saves thousands of hours annually, equivalent to $300K-$500K in labor costs (region dependent).

Level Up: Security Automation Value Across the Pyramid of Pain

Pyramid of Pain LevelTangible Value and Metrics
1. Enrichment and API Integration80-90% time savings on data enrichment
$50K-$100K cost savings
30%-50% faster triage
2. Collaborative Case Management25-50% time savings on case management
3x case handling capacity
$100K+ annual savings
50-70% MTTR reduction
3. Metrics/KPIs and Automated Reporting90% time savings on generating reports
Regulatory non-compliance fine avoidance
4. Basic Automated Response80%+ faster response
Higher employee retainment and satisfaction
Improved threat containment 
5. Fully Automated RemediationNear-zero manual effort
Scalable security operation
$300K-$500K in labor cost savings

More Autonomy, Less Pain

By harnessing the power of agentic AI on a Hyperautomation engine, Torq’s platform combats SOC killers like alert fatigue, manual workflow building, inefficient case workloads, and wading through pages of logs to write case summaries and reports. Autonomous triage, investigation, and response reduces MTTR and frees up analysts to focus on the fun stuff like strategic projects and complex, critical incidents. 

This is the promise of the autonomous SOC — and it’s the pitch that won Torq the Innovation Sandbox competition at CPX 2025. 

Want to chat about how to reach the top of the SOC Automation Pyramid of Pain?

Let’s Talk
Share

Related Articles

News

Torq Named One of America’s Best Startup Employers By Forbes and Business Insider

By Ofer Smadari, CEO & Co-Founder
February 28, 2025
3 Minute Read
Looking for the best startups to work for? Torq is named one of Forbes' America’s Best Startup Employers.

Contents

I couldn’t be more proud of our employees and the unique corporate culture we’ve established at Torq since we began this journey in 2020. In 2024, we hit 200% in employee growth along with 300% revenue growth as our Agentic AI and autonomous SOC solutions gained dramatic Fortune 500 adoption. 

And the world has taken notice with Forbes naming us to its America’s “Best Startup Employers 2025” list and Business Insider calling us one of the “43 startups to bet your career on in 2025.”

High Octane Culture & Careers 

Having these top-tier publications validate and reflect what every Torq employee feels when they start work every day is truly gratifying. We established this company as one where employees could achieve their career goals, significantly enhance their skills and knowledge, and have a whole lot of fun in the process.

This culture was prominently on display at our Sales Kickoff a few weeks ago in Madrid, where employees from across the globe gathered to plan how the year unfolds and celebrate our incredible momentum and accomplishments to date. The enthusiasm at the event was electric and contagious as we drove our “All Gas, No Brakes” theme across every element of the organization.

Photo of Torq CEO Ofer Smadari at Torq's 2025 Sales Kickoff in Madrid — one of the best startup employers to work for.
“All gas, no brakes”: Torq CEO Ofer Smadari and team at the company’s 2025 Sales Kickoff in Madrid.

One of America’s Best Startup Employers 

Forbes chose Torq for its list by analyzing a set of KPIs that correspond to company growth and workplace satisfaction. After gathering more that 7 million data points from over 20,000 eligible companies, 3,000 employers qualified for in-depth analysis. In the end, only 500 employers were included in the ranking, including Torq. Each employer’s final evaluation was based on three key criteria: employer reputation, employee satisfaction, and company growth.

A Startup to Bet Your Career On

Business Insider researched startups that have strong founding teams and investor dollars, with a focus on AI. It determined Torq was among a handful of companies advancing by leaps and bounds across sales and employee growth, along with technological prowess.

These accolades belong to every single Torq employee that’s contributed to this amazing journey to date. This is a place where people come to do their best work, push the technological envelope as far as it can go, and where every idea is given an open forum for consideration. 

Thanks again to Forbes and Business Insider. And thanks to Torqers worldwide. We’re just getting started!

We’re Hiring
Share

Related Articles

AI News

Torq’s AI-Native Autonomous SOC Wins Check Point’s CPX 2025 Innovation Sandbox Competition

By Torq
February 27, 2025
4 Minute Read
Torq took home the top prize at Checkpoint’s CPX 2025 Innovation Sandbox competition. Get highlights from the winning pitch.

Contents

Torq took home the top prize at Check Point’s 2025 Innovation Sandbox Competition during their annual CPX conference in Las Vegas. Chris Coburn, Torq’s Sr. Director of Tech Alliances, faced off against 13 other companies to pitch Torq’s AI-native autonomous SOC to a panel of judges and voting audience.

As the Sandbox Innovation winner, Chris earned the opportunity to deliver a main-stage keynote to thousands of security professionals and leaders, sharing how Torq’s game-changing agentic AI and Hyperautomation capabilities are saving SOC analysts from burn out while strengthening overall security posture.

“We are witnessing a new era in cybersecurity, and we are thrilled with the innovation throughout the ecosystem. It’s clear that AI and machine learning will play a critical role in shaping the future,” said Brian Linder, Head of Cyber Evangelists in the Office of the CTO at Check Point. “We congratulate Torq on winning first place in the competitive Innovation Sandbox at CPX 2025 Americas and look forward to following their journey as they continue to innovate as an emerging player in cybersecurity.”

The Pitch: AI or Die — Saving the SOC with Agentic AI and Hyperautomation

“It’s time to adopt AI  or die. Everybody’s saying it — AI’s here now and it’s going to be a massive part of cybersecurity going forward. Torq is using AI to help solve everything that is killing our SOC teams every day.” 

– Chris Coburn, Sr. Director of Tech Alliances, Torq

SOCs are in crisis. Security teams are getting buried by alerts and they spend way too much of their time trying to make different tools communicate with each other and trying to get different data formats to make sense with each other. Even when analysts find a true positive alert, the investigation, communication, and remediation steps can be disjointed and painful. This overwhelm causes alerts to be missed, leaving organizations vulnerable to attacks and breaches.

To combat these SOC killers, Torq is offloading all of the mundane, highly repetitive tasks to Hyperautomation and AI — turning down the volume so human analysts can focus in on critical threats, with enriched insights to accelerate their decision-making. 

Torq’s AI-native autonomous SOC is made up of three components:

  1. A foundation of enterprise security-grade architecture built completely on zero trust, cloud-native, extensible software. 
  2. A Hyperautomation engine which makes building automations as easy and powerful as possible, integrated across your entire security stack.
  3. AI agents that act as accelerators for SOC operations. These include an AI Workflow Builder that rapidly generates custom automation workflows using natural language prompts, AI Case Summaries that deliver concise, structured summaries so your team can get up to speed faster, and Socrates, Torq’s agentic AI SOC Analyst that can autonomously triage, investigate, and remediate 95% of Tier-1 cases. 

AI-driven Hyperautomation changes the picture for SOCs today. With Torq, 95% of Tier-1 incidents can be autoremediated, allowing human security analysts to focus on the strategic and engaging work that they actually care about. 

This is the promise of the autonomous SOC — and Torq is making it happen.

Explore Torq's winning autonomous SOC pitch for Check Point CPX 2025's Sandbox Innovation competition.

Want more where this came from? Get the AI or Die Manifesto > 

Check Point Speeds Up Their SOC with Torq HyperSOC™ 

“With Torq HyperSOC, we can react automatically to problems before they become security incidents.” 

– Jonathan Fischbein, CISO at Check Point

Check Point was facing a challenge that many security teams can relate to: too many alerts and too few analysts. When Check Point’s CISO Jonathan Fischbein went on the hunt for a security automation solution, feedback from fellow CISOs and CIOs led him to bypass legacy SOAR products in favor of Torq’s HyperSOC solution.

Key ‘wow factors’ for Check Point included:

  • Easy-to-use UI centered around the SOC analyst experience to make their jobs easier
  • Days-fast deployment of dozens of AI-driven playbooks, automating responses to some of the organization’s most repetitive security alerts
  • Integrations that “fit like a glove” with Check Point’s existing security stack 

Today, Torq’s AI-driven HyperSOC investigates, triages and remediates many of Check Point’s internal security alerts without any human intervention. If an alert meets certain parameters based on security policies, the platform autonomously takes action, such as initiating an MFA challenge or locking out a suspicious user. High-priority incidents are routed for human intervention, with intelligent case insights and recommendations that help analysts make better decisions, faster.

The end result? Dramatic efficiency gains and reduced alert fatigue.

Read Check Point’s Story
Share

Related Articles

AI

The Dawn of Agentic AI in the SOC

By Torq
February 25, 2025
7 Minute Read
What is agentic AI in the SOC? Get an overview of agentic AI for cybersecurity, how it can benefit security operations, and strategic considerations.

Contents

Now that six in ten security leaders view AI as a “game changer” across all security functions and 85% of security professionals report increased AI investment and usage in the past year, it’s clear that AI is no longer a fringe technology in security operations.

But the AI conversation has evolved recently as a new buzzword has taken over: agentic AI. Underlying the hype are real advancements that have the potential to transform security operations by adding autonomous, goal-oriented decision making to AI-powered SOCs. Gartner even named agentic AI one of the Top Strategic Technology Trends for 2025.  

Agentic AI is especially promising for security operations as a way to tackle persistent challenges such as alert fatigue, analyst burnout, and an ongoing talent shortage. Additionally, as increasingly automated attacks intensify the stakes for SOC teams, agentic AI will be a pivotal technology to counteract evolving threats through improved proactiveness and scalability. 

What is Agentic AI in the SOC? 

Agentic AI refers to artificial intelligence systems that operate with enhanced autonomy to execute tasks and make decisions. Agentic AI can pursue complex goals and execute workflow tasks with limited direct human supervision. It uses sophisticated reasoning and iterative planning to solve complex, multi-step problems on its own, adapting to real-time data and learning from its environment.

Agentic AI can transform SOCs through the ability to independently triage, investigate and remediate threats —  accelerating incident response and enhancing overall security posture. 

When combined with Hyperautomation, agentic AI can help achieve the autonomous SOC, in which AI handles the vast majority of Tier-1 and Tier-2 alerts, freeing up human analysts to focus on complex, high-priority incidents and strategic projects (aka the rewarding, engaging, and impactful work that analysts actually want to spend their days doing, rather than wading through false positives and writing reports).

2 Key Use Cases for Agentic AI in the SOC 

1. Agentic AI in Phishing Response

Phishing continues to plague SOCs as one of the most common attack vectors for data breaches and ransomware. Agentic AI can elevate phishing response capabilities by streamlining triage, investigation, and containment once detections are flagged by external systems. 

Through seamless integrations with email security, identity management, threat intelligence, EDR, CMDB, and SIEM solutions, Torq’s Agentic AI can autonomously:

  • Examine recipients, email content, links, attachments, IOC reputations, and related case and threat information to determine scope and impact, identifying users who received, opened, or interacted with an email. 
  • Execute environment-wide sweeps for malicious payloads and correlate data to reveal compromised accounts or systems.
  • Initiate containment steps such as quarantining emails, resetting credentials, terminating sessions with enforced MFA, and blocking malicious domains or IPs.  

2. Agentic AI in EDR Response

Experts predict that 20% of new malware strains will be AI-assisted by 2025. Agentic AI can bolster malware detection and response by orchestrating rapid analysis, scoping, containment, and eradication once suspicious activity is flagged by external platforms. 

Torq’s Agentic AI integrates with EDR, CMDB, SIEM, and threat intelligence tools to autonomously:

  • Analyze file behavior (including hashes, signatures, and sandbox results), monitor endpoint resource usage, and detect suspicious persistence mechanisms or privilege escalations.
  • Correlate anomalies across multiple endpoints to identify the scope of compromise, pinpointing infected hosts, associated IOCs, and potentially affected privileged accounts.
  • Swiftly isolate infected endpoints, disable compromised accounts, and kill malicious processes. Malicious file hashes and IP addresses are then added to deny lists for continuous monitoring. Eradication actions can include removing malicious files, cleaning up affected systems, or re-imaging endpoints, ensuring a thorough remediation. 

Torq’s Multi-Agent System: Agentic AI in Action 

When you peel them back, many “AI SOC Agents” on the market are simply ChatGPT-style natural language chatbots. They may be capable of running steps and workflows but lack deep integrations and autonomous capabilities. 

In contrast, Torq’s Multi-Agent System is deeply integrated across the full security stack and able to take complex action and tackle multi-step tasks. At the helm is Socrates, Torq’s agentic AI SOC Analyst which can conduct fully autonomous case investigation, enrichment, and remediation from start to finish, as well as generating contextual recommendations. Alongside Socrates, Torq’s other AI agents provide AI-generated workflows, code, data transformations, case summaries, and more — helping SOC teams get more done, faster.

The Agentic AI ‘Wow Factor’ for Security Operations

“I believe the successful use of agentic AI in SOC operations shows up in practical outcomes. With Torq Agentic AI, the answer is ‘yes’ to questions such as: Are analysts happier? Are they sticking around? Do they have time to focus on more interesting and complex investigations? Are MTTM and MTTR lower? Torq Agentic AI extends and enhances our team so it can make better decisions more quickly — resulting in stronger security all around.”

– Mick Leach, Field CISO, Abnormal Security

  • Boosting analyst engagement and retention: Rather than replacing human analysts, agentic AI can actually help make their day-to-day work in the SOC more rewarding and engaging by eliminating many of the “SOC analyst killers” that bog them down, such as alert fatigue, summarizing cases, and writing reports. This is crucial in a cybersecurity field that continues to deal with an ongoing talent shortage.
  • Augmenting human expertise: For complex and high stakes cases that require human intervention, analysts can collaborate with agentic AI to make faster and better-informed decisions. This is thanks to agentic AI’s ability to correlate information from multiple tools, signals, and third-party threat intelligence to contextually enrich cases and provide deeper insights.
  • Improving security posture: Through its ability to identify patterns and anomalies that may indicate malicious activity, agentic AI improves threat detection and response, enabling SOCs to proactively mitigate threats. Automated incident response and alert triage can reduce mean time to detect (MTTD), mean time to respond (MTTR), and mean time to containment (MTTC), minimizing the impact of security incidents.
  • Enhancing operational efficiency and scalability: By handling Tier-1 and Tier-2 alerts and automating routine tasks, agentic AI frees up human analysts to focus on more strategic initiatives, such as threat hunting and vulnerability management. Agentic AI also enables SOCs to scale more efficiently, managing a higher workload without adding headcount.

Considerations for Building Trust in AI in the SOC

SOCs planning to deploy AI capabilities, including agentic AI, should take steps now to document and audit current processes, as it will be important to ensure that AI and automation is used to scale effective processes, rather than to compensate for ineffective ones. Security teams should also establish a method to quantify operational gains from an AI deployment. 

As with any new technology, AI in the SOC will require new skills and training for security teams, such as learning how to effectively collaborate with agentic AI. Any agentic AI solution deployed should be able to raise a flag when it is missing information or requires human validation. For example, if the AI’s threat analysis leads it to recommend quarantining a laptop but the user’s title is “CEO”, the system should have the intelligence and boundaries to flag that the decision is “above its pay grade” and then escalate the decision for human review and approval.

To combat the risk of AI hallucinations and build trust in AI, the system must be able to transparently explain why it made the decisions it made and how it came to the conclusions it did. This requires the AI to bolster its insights and recommendations with citations to original, forensic evidence.

AI or Die: Get the Manifesto

While agentic AI is still a relatively nascent technology, its potential to revolutionize security operations is undeniable. But the crowded AI SOC market makes careful selection essential. 

Get the AI or Die Manifesto to learn red flags that separate AI-washed vaporware from truly impactful AI for the SOC, as well as strategic considerations for effective adoption.

Get the Manifesto
Share

Related Articles

AI Hyperautomation

Why Financial Institutions Need No Code Security Automation

By Torq
February 22, 2025
5 Minute Read
Financial no code workflow automation security platform for financial institutions

Contents

For financial institutions, the pressure to outpace fraudsters, stay ahead of regulators, and defend sprawling infrastructures is endless. Yet inside too many SOCs, it’s still the same story: manual processes, brittle legacy tools, and security workflows held together by spreadsheets and custom coding.

That’s changing fast.

Modern financial institutions are turning to no code workflow automation to eliminate inefficiencies, reduce risk, and scale operations. They’re moving away from legacy SOAR platforms that require months of scripting just to get basic use cases up and running. With Torq, teams are deploying powerful, cross-functional automations in days.

From regional banks to asset giants like Blackstone, the shift is clear: No code isn’t just easier. It’s better. Faster. More secure. And it’s how the smartest financial orgs are staying ahead of the threats, and the competition.

Why Financial SOCs Are Turning to No Code Workflow Automation

Financial and bank SOCs face a perfect storm:

  • Rising attack volumes and sophistication
  • Burdensome regulatory oversight 
  • Analyst shortages and burnout
  • Pressure to do more with less

What Financial SOCs Are Automating First

Most financial customers come to Torq after hitting a wall with legacy SOAR. They’re tired of vendor sprawl, compliance nightmares, and tools that require a full engineering and professional services team just to run. 

Finance orgs prioritize use cases that deliver fast wins in compliance-heavy, high-risk environments. The most common starting points are:

They choose Torq because it’s secure by design: zero-trust architecture, native SOC 2 compliance, and a platform built to scale. They stay because it just works.

Blackstone: From SOAR to 80+ No Code Automated Workflows

Legacy SOAR platforms require custom scripting and complex coding to implement basic use cases. This dependence on coding creates massive bottlenecks in financial organizations that juggle dozens of tools and deal with an evolving threat landscape. It slows everything down, requires specialized talent, and makes scaling automation nearly impossible.

That’s why financial leaders are ditching SOAR for no-code security automation solutions. With intuitive, drag-and-drop tools, analysts — not just engineers — can build powerful, scalable automations across fraud detection, IAM, phishing response, and more.

Blackstone, the world’s largest alternative asset manager, spent years keeping just a handful of workflows alive in their legacy SOAR. After switching to Torq, they launched 30+ automations in six months. Today, they’ve scaled to over 80 workflows across incident response, fraud, threat hunting, and IAM.

What changed?

  • A no code workflow automation platform built for security teams that actually works
  • A scalable Hyperautomation solution that meets the rigor of financial controls
  • A true partnership — not just another vendor with a steep learning curve

How a Leading U.S. Bank Beat Zelle Fraud with No-Code Workflow Automation

Preventing fraud is a top challenge for financial institutions. As attacks become more sophisticated and digital-first payment methods become increasingly more common, the scale of financial fraud is escalating beyond the reach of legacy defenses. 

With the Torq platform’s no-code workflow automation, security teams can connect SIEMs, fraud detection systems, case management tools, and identity services with real-time, orchestrated workflows. Financial institutions can spot fraud faster, reduce false positives, and take immediate, coordinated action. 

Case in point: After a surge in Zelle fraud forced a top 30 U.S. bank to suspend Zelle services under SEC pressure, they turned to Torq. In just 90 days, they built over 100 automated workflows, including a no-code system that autonomously locks down compromised accounts.  

They were quickly able to reinstate Zelle services, and the fraud response time decreased from hours to seconds while automation expanded beyond the SOC into fraud, GRC, and IT. This is the power of no-code security workflow automation in action — fast, scalable, and built for high-stakes financial environments.

​​Why Torq Wins in High-Stakes Financial Environments

Financial institutions are highly regulated, highly targeted — and often highly siloed. That’s why they need automation that works, scales, and earns trust. Torq delivers:

  • No code architecture: Secure, scalable, built for both on-prem and cloud
  • Multi-tenant capabilities: Support for global SOC structures with centralized oversight
  • Fast, responsible AI: With Socrates and our multi-agent system, Torq lets humans direct strategy while AI handles Tier-1 remediation.
  • Audit-ready evidence: Every action is logged with full context and metadata.

Financial customers want to get it right the first time. With Torq, they can.

The Future of Financial SecOps Is Automated 

Banks, insurers, and fintechs are under pressure to modernize fast without compromising security or compliance. Legacy security automation and orchestration won’t cut it. No code workflow automation built for financial security teams is the only path forward.

Torq Hyperautomation gives you:

  • Faster outcomes
  • Fewer manual handoffs
  • Stronger compliance posture
  • Real ROI from day one

And we integrate with the tools you already use. Here’s just a few of our integrations:

  • IT: ServiceNow, JIRA
  • Cloud: Wiz, Microsoft 365, Azure/Entra, AWS
  • SIEM & Logs: Splunk, Elastic, Chronicle, Stellar Cyber, Microsoft Sentinel
  • Identity: Microsoft Entra, Okta, SailPoint
  • Endpoint & Threat Detection: CrowdStrike, Defender, SentinelOne, Tenable
  • Phishing: Proofpoint, Abnormal Security
  • Threat Intelligence: VirusTotal, Recorded Future, AlienVault
  • Third-Party Risk: SecurityScorecard

Whether you’re replacing SOAR, launching security automation for the first time, or scaling into new business units — Torq is the partner to get you there. 

Get a Demo
Share

Related Articles

News Product

Torq Signed the CISA Secure by Design Pledge

By Aner Izraeli
February 5, 2025
7 Minute Read

Contents

At Torq, our commitment to security has always been at the forefront of our mission to empower businesses through our SaaS platform.

Today, we’re proud to announce a significant step forward in our security journey: Torq has signed the CISA Secure by Design Pledge.

This pledge underscores our dedication to ensuring that our customers can trust our platform to uphold the highest security standards, enabling customers to focus on their goals without concerns about their security posture.

Advancing Security by Design

The CISA Secure by Design Pledge perfectly aligns with our approach to security. This initiative emphasizes the importance of building security into the foundation of all products and services.

For Torq, this means integrating robust security measures throughout our development lifecycle, from initial concept to deployment and beyond.

By signing this pledge, we are reinforcing our commitment to:

  • Proactive security measures: Embedding security into every layer of our platform, ensuring our customers’ data is protected at all times.
  • Transparency: Providing clear, actionable information about managing and securing data, empowering our customers to make informed decisions.
  • Continuous improvement: Regularly evaluate and enhance our security practices to stay ahead of evolving threats.

What This Means for Our Customers

When you choose Torq, you’re not just selecting a SaaS solution but partnering with a company that prioritizes your security. Our adherence to Secure by Design principles means:

  • Minimal configuration risks: Our platform is designed to work securely out of the box, reducing the burden on your team to configure complex security settings.
  • Enhanced resilience: With built-in safeguards and automated protections, your organization’s security posture remains robust despite emerging threats.
  • Ongoing support: We’re committed to providing tools, resources, and guidance to help you confidently navigate security challenges.

This blog post outlines our commitment, investments, and transparency in those Secure by Design principles and our plans for the upcoming security year 2025.

Multi-factor authentication (MFA)

“Within one year of signing the pledge, demonstrate actions taken to measurably increase the use of multi-factor authentication across the manufacturer’s products.”

Torq’s customer’s default application authentication is SSO-based via federation through external identity providers, ensuring uncompromised authentication standards for our customers.

This approach ensures consistent MFA configuration and enforcement with their identity provider’s MFA settings.

Torq supports SAML 2.0 and OpenID Connect with code flow and implicit grant type. It’s compatible with many enterprise IDPs, including:

  • Google
  • Microsoft Entra ID
  • Okta
  • OneLogin

Supported SSO Methods and Protocols

  • Open ID connect
  • SAML 2.0

Default passwords

“Within one year of signing the pledge, demonstrate measurable progress towards reducing default passwords across the manufacturers’ products.”

Torq’s customers are invited to their new workspace by an invite email directly sent to their corporate mailbox.

The invite email contains a unique invite link, and clicking it invokes the authentication process.

When a customer’s admin user logs in to their Torq account using the invite link, they use their email and self-generated password; hence, no default passwords are involved.

Per policy, customers are informed that 2FA is necessary to continue.

The user must scan the QR code presented or enter the activation code into a recognized authenticator application on their cellular device.

Upon completion, the customer can set up the organization’s SSO, which neglects password usage thereafter.

Torq’s application password policy enforces the following criteria:

  • Between 8 to 20 characters
  • At least one capital letter
  • At least one lowercase letter
  • At least one number
  • At least one special character

Reducing entire classes of vulnerability

“Within one year of signing the pledge, demonstrate actions taken towards enabling a significant measurable reduction in the prevalence of one or more vulnerability classes across the manufacturer’s products.”

Torq adopts a “security by design” approach to effectively minimize attack surfaces that are vulnerable to potential threats.

That said, to effectively deal with zero-day attacks and reduce vulnerabilities, Torq has a few key components aiming at that goal, such as:

  • Penetration testing
  • Scanning Torq’s supply-chain pipeline, including code dependencies (open source), containers (dockerfiles), code (SAST), Secrets, and IaC as part of SDLC and CICD
  • Utilizing the world’s best-of-breed CNAPP
  • Utilizing Distroless cloud workloads
  • Utilizing an EDR vulnerability scanning module on Torq’s laptop devices fleet and addressing findings through automation

Looking ahead:

Over the course of the following year, we intend to focus on improving runtime visibility, gaining better and higher vulnerability verdict.

Security patches

“Within one year of signing the pledge, demonstrate actions taken to measurably increase the installation of security patches by customers.”

As a SaaS offering, Torq’s application is updated continuously through a process where Torq manages the deployment of new features, bug fixes, and security patches. Customers benefit from automatic updates without needing to install new versions manually. Torq’s Continuous integration and deployment (CI/CD) pipelines enable rapid, frequent updates, allowing it to deliver improvements and patches quickly while ensuring stability and performance.

No action is necessary on the customer’s part to have these patches automatically applied to their workspaces.

Customers are notified through Torq’s “what’s new” segment and through https://kb.torq.io/en/

Vulnerability disclosure policy

“Within one year of signing the pledge, publish a vulnerability disclosure policy (VDP).”

In addition to Trust Center, where customers can obtain up-to-date reports, policies, and the status of Torq’s security posture, Torq also maintains a Security and Compliance public page within its torq.io commercial website – https://torq.io/security-compliance/

At the bottom of this page, visitors are introduced to Torq’s privacy and security mail accounts for any security-related matter, including vulnerability disclosure.

Torq addresses and responds to any approach made.

https://torq.io/security-compliance/

As a continuous improvement, the process could be enhanced by having a dedicated online form for a better vulnerability disclosure experience within Torq’s security-compliance page.

CVEs

“Within one year of signing the pledge, demonstrate transparency in vulnerability reporting.”

At Torq, we take security seriously and continuously monitor our platform for vulnerabilities. Unlike traditional software that requires customers to manage their own patches, SaaS platforms like ours are centrally managed, allowing us to rapidly mitigate security issues without requiring customer intervention.

CVE (Common Vulnerabilities and Exposures) program focuses on publicly disclosed security vulnerabilities in software products, hardware, and firmware.

Torq is a SaaS offering that, by its operational fashion, is non-distributable and installed on its customers’ end. Hence, it does not directly fit and is obligated to issue CVEs disclosure.

We believe in transparency and proactive security measures.

Our approach to vulnerability management includes:

✅ Continuous monitoring and rapid patching – We detect and remediate security issues before they impact customers.

✅ Customer notification – We will notify impacted customers if a vulnerability affects data security or compliance.

✅ Third-party component reporting – If an issue involves open-source or third-party software, we may issue a CVE when appropriate.

✅ Security bulletins – We publish important security updates via our Trust Center.

✅ Regulatory compliance – We align with industry standards (e.g., SOC 2, ISO 27001, FedRAMP) to ensure best-in-class security.

Evidence of intrusions

“Within one year of signing the pledge, demonstrate a measurable increase in the ability for customers to gather evidence of cybersecurity intrusions affecting the manufacturer’s products.”

Torq generates audit logs. These logs provide a comprehensive record of events within a workspace, capturing various actions and changes. They record events such as user activities, workflow changes, and resource modifications. Typically, log entries are created immediately after an action is taken. The audit logs include the event occurrence, timestamp, the user or service that initiated the action, and the affected entity.

To enhance the security and oversight of your workspace, audit logs could be streamlined to a SIEM or bucket using Torq workflows, steps, or API.

Looking Ahead

As cyber threats evolve, Torq’s security journey doesn’t stop here. Signing the CISA Secure by Design Pledge is just one of many steps we’re taking to ensure our platform remains a trusted partner for businesses worldwide. Our team will continue to innovate, collaborate, and advocate for security practices that benefit not only our customers but the broader digital ecosystem.

We’re excited about this new chapter and its meaning for our customers. By seamlessly integrating security into our solutions, we’re not just mitigating risks — we’re enabling your success.

Stay tuned for more updates on how we’re driving security excellence at Torq, and feel free to reach out if you have any questions about our Secure by Design journey.

Share

Related Articles

Integrations

Cloud Security Automation with Torq + Sweet Security

By Torq
February 4, 2025
5 Minute Read
Learn how Torq and Sweet Security empower SOCs to detect threats in real-time with cloud security automation, neutralizing threats in minutes, not days.

Contents

For security teams, resolving a cloud incident takes an average of 10 days — time attackers can exploit to cause further damage. The problem? SOCs often lack the context and cloud security automation they need to respond faster. That’s where the partnership between Torq and Sweet Security changes the game.

Why SOCs Need Torq and Sweet Security

Sweet Security delivers the real-time, cloud visibility SOCs need to identify threats quickly and accurately. Torq takes it further by automating the response process, bridging the gap between detection and action. Together, they empower SOC teams to neutralize threats in minutes — not days — reclaiming control over their cloud environments and staying ahead of attackers.

Sweet Security: Raising the Bar for Cloud Detection and Response

Sweet Security approaches cloud protection with precision and expertise that stands apart. Their platform combines unified cloud visibility across the cloud infrastructure, workloads, and applications with deep runtime context, enabling SOCs to detect and neutralize real-time threats as they unfold. By integrating cutting-edge, cloud-native technologies, Sweet equips security teams to handle even the most sophisticated attacks with confidence and resilience. 

Sweet’s Detection & Response capabilities reduce MTTR by enriching incident insights with detailed information on human and non-human identities, including roles, users, and service accounts. By correlating siloed cloud events into a comprehensive attack story and leveraging an advanced threshold mechanism to minimize false positives, Sweet ensures deeper context and alerts only on high-probability malicious incidents. Seamless orchestration with Torq further amplifies these capabilities.

Torq Hyperautomation: Transforming SOC Operations

Torq has redefined what’s possible for SOCs by enabling Hyperautomation across workflows. With Torq, SOC teams can design, deploy, and scale automated incident responses — reducing manual work and freeing analysts to focus on critical decision-making. Whether it’s accelerating the triage process, auto-remediating threats, or optimizing collaboration between tools and teams, Torq’s platform brings unmatched speed and precision to security operations.

Together, Torq and Sweet Security’s integration achieves what was once thought impossible: full-spectrum cloud protection, automated at scale.

What the Integration Delivers to SOC Teams

Torq and Sweet’s integration creates a seamless threat detection and resolution pipeline. Here’s how:

  1. Unified cloud visibility meets real-time automation: Sweet Security provides SOCs unparalleled insight into cloud environments, while Torq transforms these insights into automated actions. When Sweet’s platform identifies an anomaly, Torq can immediately trigger a workflow to respond to the threat.
  2. Proactive incident response: Cloud attacks often unfold in seconds, leaving SOC teams little time to react. With this integration, Sweet’s real-time detection feeds directly into Torq’s cloud security automation workflows, enabling SOCs to mitigate threats faster. For example, Sweet’s advanced capabilities allow for the detection of the human identity responsible for an incident and the ability to directly question the user about their activity — without requiring SOC intervention.
  3. Customizable workflows for every cloud environment: No two organizations operate the same cloud stack. Torq’s no-code platform allows security teams to tailor response workflows that align perfectly with their unique cloud setups, ensuring that Sweet Security’s detections are met with tailored, effective responses.
  4. Enhanced SOC efficiency and morale: Automation doesn’t just eliminate repetitive tasks — it empowers SOC teams to operate at their best. By integrating Sweet’s intelligence with Torq’s workflows, analysts are no longer bogged down by manual processes, allowing them to focus on strategic initiatives that strengthen overall security posture.

A Use Case: From Detection to Mitigation in Minutes

Imagine this scenario: Sweet Security identifies unusual activity in a cloud environment, flagging a misconfigured container with potential malware. The alert triggers a prebuilt Torq workflow that:

  • Enhances alerts with additional context from threat intelligence sources, as well as data from cloud provider APIs and log services, such as AWS CloudTrail and CloudWatch.
  • Automatically reaches out to asset owners through Slack or Microsoft Teams, enabling them to remediate minor issues without involving the SOC.
  • Isolates the container while verifying the presence of malware.
  • Deploys a remediation script to correct the misconfiguration.
  • Directly engages the suspected user to verify their activity — eliminating the need for SOC intervention.

All of this occurs in minutes — not hours or days — significantly reducing the attack’s impact.

Example cloud security automation workflow with Torq and Sweet Security.

Looking Ahead: Strengthening the Future of Cloud Security

The Torq and Sweet Security partnership isn’t just about solving today’s cloud security challenges — it’s about preparing SOCs for the future. With the increasing sophistication of cloud-native attacks, the ability to integrate real-time detection with scalable automation will be a non-negotiable for every security team.

At its core, this collaboration underscores a simple but powerful truth: when detection meets automation, SOCs can achieve extraordinary outcomes. By combining Sweet Security’s advanced cloud-native detection with Torq’s Hyperautomation platform, security teams are no longer playing catch-up. They’re setting the pace.

Ready to See Cloud Security Automation in Action?

For a detailed walk-through on integrating Torq and Sweet, check out the Knowledge Base article. 

To learn more about how Torq and Sweet Security are transforming cloud security, schedule a demo today and experience the future of SOC operations firsthand. 

Share

Related Articles

See Torq in Action

Get a demo to see how Torq helps you harness AI in the SOC to detect, prioritize, and respond to threats faster.

Is your security team ready to automate more, faster?