Torq is an Inaugural WIZ Integration (WIN) Launch Partner
By Torq
June 13, 2023
2 Minute Read
Torq has been hand selected as a Wiz Integration (WIN) launch partner, bringing the power of Torq Hyperautomation to WIN, so that our joint customers can continue to seamlessly integrate Wiz into their workflows, empowering them to automate their response.
“Torq and Wiz work seamlessly together to give us a major real-time advantage in mitigating the ever-evolving cloud-based threat landscape.”
Jemuel Dalino, Application and Engineering Security Manager, Agoda
WIN enables Torq to deliver actionable remediation and response to threats with a full audit trail of automated security actions. Torq and Wiz work seamlessly together to provide a real-time advantage in mitigating the ever-evolving cloud-based threat landscape with comprehensive contextual and accurate malicious activity identification. And Torq frees up security teams’ precious time, empowering them to focus on strategic business initiatives without being overwhelmed by cloud alerts.
“Over 50% of our customers are utilizing our Wiz integration in order to strengthen their hyperautomation workflows and I’m thrilled for us to have been selected as a WIN launch Partner. I look forward to strengthening our relationship for the benefit of our joint customers.”
Eldad Livni, Co-Founder and CINO, Torq.
The combined value of Wiz and Torq streamline security for organizations that are on a cloud journey.
“A best-in-class cloud operating model reduces risk, improves ROI, and drives efficiency,” said Oron Noah, Director of Product Management, Wiz. “That value proposition is what lies at the heart of WIN, and what Torq as a partner helps to make a reality. This collaborative philosophy brings real customer benefits, and we are so thankful to have Torq on board for this launch.”
Interested to learn more about the power of Torq and Wiz together, schedule a demo.
Fix Cybersecurity Tool Sprawl with Hyperautomation
By Luke Bentley, Torq EMEA Account Executive
June 1, 2023
5 Minute Read
The evolution of cybersecurity tools is nothing short of remarkable, but I suppose they had to be when it isn’t just the Morris Worm you’re worried about. There has been a wave of buzz around the latest technology in years gone by. EDR evolved into MDR, then SASE, and in recent times we’ve seen Immutable Backup take the front seat.
But hey, I’m sure you can’t go far wrong by investing in all these kinds of technologies. The more the merrier, right? Depending on what you read, the number of cybersecurity-related technologies that enterprises have integrated and deployed in their infrastructure is between 45-70*, which is absurd. So, when there are vendors that are working in unison and supporting the idea of a better integrated and more visible cyber picture, it sounds like a win-win. This idea of your EDR, SASE and Email Security vendor working in tandem is a dream come true, right?
Some things don’t change unfortunately, and cybersecurity teams and CISOs are still being asked to do the impossible. Those age-old problems don’t budge easily: shortage of cyber professionals and resources, and a plethora of cyber vendors offering too many tools and too many processes. “With great tools, come great alerts,” or something along those lines, is what we’re typically told.
Who’s expected to deal with these additional alerts created from all of these technologies? Just because they integrate well, doesn’t mean they’re contributing to what the main focus should be: improving your cybersecurity posture and reducing the risk to your organization’s workforce.
Some things do change, however. The new generation of CISOs don’t want to overload their teams with work to churn out results. They want to work smarter. They see business, people, and technology as one that can work together to get results.
CISOs are looking at the bigger picture. Empower the cyber teams, let them develop their skill sets, so they can return their knowledge and value back to the company. They’re not relying solely on the latest tech to churn through alerts and let the team on the ground deal with the processes.
The saying goes, “Train your people enough so they can leave, and treat them well enough so they don’t want to.” Nailed it.
Your infrastructure security engineer wants to develop into an AWS architect, but is too busy dealing with CSPM alerts. Your cyber analyst has aspirations of being a CISO themselves one day, but is bogged down by suspicious user activity, and misses all those opportunities to gain additional knowledge, learning how to present and communicate better, or simply lacks a development in strategic mindset to tackle problems. And that lack of development means they look elsewhere. Cybersecurity roles are notorious for job hopping, and I think that’s because the dreams of complex, technical and exciting projects are brushed away by daily firefighting.
Give the power back to the people, including the techies that are literally running the show, and retain them longer. But how? First, strip your mind of all pre-existing knowledge and thoughts on legacy SOAR. Those time consuming, low use case producing, pro-services heavy technologies are a thing of the past.
Hyperautomation is reforming how cyber teams, top to bottom, left to right, are approaching their CyberSecOps. The time to automate every task that comes from the latest and greatest cyber technologies you invest in, because it’s perfectly viable, is now. Torq’s enterprise-grade security hyperautomation has made that possible.
The barrier to entry is no longer a dedicated DevSecOps team of 5 who can code in every language A through Z. Cyber and dev teams have spent years trying to create use cases with legacy SOAR vendors, and might be lucky if they publish 4 or 5 workflows/playbooks in a year. With Torq, the entry need only be a laptop, mouse and keyboard. Maybe a slight oversimplification, but it’s not far wrong. The ability to imagine, create and publish a workflow is now astonishingly rapid with Torq.
So, yes, the latest tech tools are great to have, the integrations will no doubt provide you with additional advantages and help secure your workforce, and sure they’ll do what they say on the tin. But the real power in your CyberSecOps is their new found time, being in control of alerts and tasks, and effectively remediating all of those alerts with a hands-off approach where possible. Torq is the tool to augment everything you have, say (and show) how we give time back to your teams, as well as increase the efficacy and ROI of other tools. Here’s a sneak peek at what time you could be saving:
If you’ve miraculously found time between all your alerts to read this, don’t take my word for it; put our hyperautomation platform to the test. Any and all CyberSecOps or CloudOps processes you want automating – we’ve got you!
CSPM, IAM, alert remediation, email phishing response, threat hunting, and secure access to sensitive data – honestly the list is only limited to your imagination (or in my case, a word count).
Building Efficient SecOps Pipelines with AWS Security Lake and Torq
By Torq
May 31, 2023
8 Minute Read
Amazon Security Lake automatically centralizes an organization’s security data from cloud, on-premises, and custom sources it into a purpose-built data lake stored in a customer’s AWS account.
Amazon Security Lake reduces the complexity and costs for customers to make their security solutions data accessible to address a variety of security use cases such as threat detection, investigation, and incident response. Amazon Security Lake is one of the many solutions that now supports the Open Cybersecurity Schema Framework (OCSF), an open industry standard, making it easier to normalize and combine security data from AWS and dozens of enterprise security data sources.
Operationalizing the above (and additional) scenarios on top of the security data lake requires a set of basic building blocks that can either be used directly by SecOps professionals, or combined into larger workflows driving specific outcomes.
Executing Automated Actions as a Response to Security Events
As an Amazon Security Lake subscriber, Torq consumes logs and events from Security Lake. In order to control costs and adhere to least privilege access best practices, Torq workflows can be automatically notified of new Amazon S3 objects for a source as the objects are written to the Amazon Security Lake by setting up one or more data access subscribers. Data access subscribers are notified of new Amazon S3 objects for a source as the objects are written to the Security Lake data lake.
In Torq, this notification is received in an Integration Webhook, so the first step of the configuration process is to create a new Webhook integration in Torq, as described in Torq’s documentation here. Take note of the resulting Webhook integration URL (endpoint), as it will be needed to set up a data access subscriber in Amazon Security Lake.
Completing the creation of the subscriber also requires setting up a new AWS Integration in Torq, as described in Torq’s documentation here. This integration will also be used afterwards to pull data from the Security Lake in Torq Workflows. As described in Torq’s documentation, setting up an AWS Integration requires creating a new Role in AWS Identity and Access Management. For that role to be able to pull data from the security lake, please sure to add the following permission policies to the role:
Create a new IAM Policy with the following contents:
Make sure to replace “{accountId}” in the JSON above with your own AWS Account ID.
Add this policy to the Permissions Policies for role you’re creating for Torq’s Integration
Add the following policy to the Permissions Policies of the role AmazonAthenaFullAccess (this is needed to enable querying, writing results, and data management through Amazon Athena, which is how Torq workflows will query data from the AWS Security Lake.
While setting up the AWS Integration in Torq, take note of the Torq Account ID and the AWS External ID, as you will need these in the process for creating a custom subscriber
Next, follow the following steps to set up a new Data Access Subscriber through your AWS Console:
For Subscriber details, enter the subscriber’s name and (optionally) a description.
For Log and event sources, choose from which sources you want to receive notifications in your previously created Torq webhook (you can choose whether you want to send notifications from all your Amazon Security Lake sources to Torq or select specific sources for each subscriber).
For Data access method, choose S3 to set up data access for the subscriber.
For Subscriber credentials, provide the Torq Account ID and the AWS External ID you got from AWS integration in Torq for AWS account ID and external ID, respectively.
For Notification details, select Subscription endpoint so that your Amazon Security Lake can send notifications through EventBridge to the HTTPS endpoint of the Torq Webhook created previously.
For Service Access, select the IAM role named AWSServiceRoleForAmazonEventBridgeApiDestinations, which is automatically created during the Amazon Security Lake set up process when run from the AWS Console, and which gives EventBridge permission to invoke API destinations and send object notifications to the correct endpoints.
Provide the Torq Webhook integration URL (endpoint) as the subscription endpoint.
Choose Create.
Check the configuration of Subscription associated with the Amazon SNS Topic which has been created as a result of the previous steps, and verify that Raw message delivery is enabled for the Subscription. Enable it by editing the Subscription if it wasn’t.
Schematic configuration of Amazon Security Lake subscribers triggering Torq workflows
Depending on the settings you defined in step #5 above (Log and event sources) it might be necessary to define trigger conditions in your Torq workflows triggered from Amazon Security Lake events. Here’s an example of a trigger condition meant to restrict a workflow to be triggered by Route53 events in Amazon Security Lake from a region us-east-1 only:
A Torq workflow trigger condition definition example to restrict a workflow to be triggered only by Amazon Security Lake events for a specific account id, region and data source (such as AWS Route53)
Querying Data from Security Data Lake
The Amazon Security Lake creation and set up process run from the AWS console, automatically registers each Security Lake region as a new Database in AWS Athena.
AWS Athena is a serverless service which allows querying Amazon Security Lake S3 data (with an S3 bucket per region for which the Security Lake has been enabled) using SQL.
Querying Amazon Security Lake from Torq Workflows using SQL through AWS Athena
Querying Amazon Security Lake data from Torq workflows, either automatically triggered from Security Lake events, scheduled to periodically pull notifications of new objects by polling an Amazon Simple Queue Service (SQS) queue or run on-demand to search for specific data in the Security Lake, can be easily implemented by using SQL in AWS CLI steps to query Athena’s API.
The following figures illustrates the process of querying Amazon Security Lake from Torq Workflows in 3 steps:
Creating a dynamic SQL query for AWS Athena:
Using AWS CLI to execute the query in AWS Athena:
The result of Athena SQL queries is stored as a csv document in S3 and can be easily pulled into a Torq workflow by using an AWS S3 Read File step, and then the Convert CSV to JSON step from Torq Utilities to simplify data extraction and transformation in later steps in the workflow:
Bringing It All Together
Operationalizing Security Operations with fully automated or human-in-the-loop pipelines using the above “building blocks” is a process consisting of the following phases:
Identifying the relevant security events:
Torq triggers can be configured with conditions, expected from the delivered event, in order to start performing automatic actions. In some cases, looking just at the event data might not be sufficient to decide whether it requires a certain security follow-up or not. For these scenarios, following up with additional automated enrichment and investigatory steps can be performed with Torq workflow steps.
Defining the required enrichment / hydration data:
Upon receiving a security event that has a potential for a follow-up, certain parts of it, such as (but not limited to) User Identifiers, Device Identifiers, Network Addresses, etc… should be retrieved for further enrichment with additional systems (IAM, CMDB, Threat Intelligence and more) by introducing initial steps in a workflow triggered by security lake events.
Building the pipelines – what happens when the event occurs:
Defining the response process can take place in an iterative manner. Main questions that need to be addressed are:
What additional information do we need to be able to better classify the event
Once classified, are there external notification / orchestration systems that need to be updated with this information
If building a human-in-the-loop pipeline, which role-players need to be provided an information about this event
If performing automatic remediation actions – what are they and which role-players can approve executing them
Summary
Amazon Security Lake provides a flexible and scalable repository for different kinds of security events. In order to build flexible and scalable security operations, your teams will require this data to be at their fingertips with the ability to efficiently use it and to trigger processes based on it.
Implementing Torq workflows, that can be triggered either
Manually by security professionals via Messaging / Chat or Web
By identifying specific events reaching the security lake
By using detections made by 3rd party security products
In these workflows, following capabilities can be delivered to security professionals:
Retrieve data from security lake and present it to security role-players in a convenient fashion
Enrich operational systems with context from the security lake
Process the security lake data to make decisions on severity and priority of different security events
Suggest and execute containment and remediation strategies based on processed contextual data
Examples of these and additional scenarios can be found at Torq Template Library.
Turning Intelligence Into Action with Cybersixgill and Torq
By Dallas Young, Sr. Technical Marketing Manager
May 24, 2023
4 Minute Read
No matter the industry, geography, or organizational size, cybersecurity teams are united by their many shared challenges: talent shortages, expanding attack surfaces driven by digitization and remote work, increasing velocity of software development, and the rapidly growing scope and sophistication of global cybercrime. In response, these teams have embraced and incorporated a range of specialized tools within their defensive arsenal in attempt to address and resolve these issues. Threat intelligence and security automation solutions form the front lines of their battle, yet these pillars of the cybersecurity ecosystem are often disconnected, creating a dangerous gap between intelligence and action.
This divide prevents security teams from deriving the full value from their solutions. Non-actionable threat intelligence increases analyst fatigue with yet another stream of feeds and alerts. While automated security playbooks without context-rich threat data lack the means to validate, prioritize and triage threats, resulting in inefficient processes and extending the MTTR.
By integrating actionable, relevant, context-rich threat intelligence within orchestration automation tools and processes, security teams can unlock the full potential of their existing security stacks – saving precious time and resources while streamlining response and remediation.
Turning Intelligence Into Action with Cybersixgill and Torq
Cybersixgill and Torq have partnered to bridge the divide between intelligence and action, operationalizing Cybersixgill’s market-leading threat intelligence through next gen security hyperautomation with Torq. With this strategic partnership, we have pioneered end-to-end, no-intervention threat protection, helping to dramatically reduce MTTR through customizable, automated workflows and playbooks, triggered by context-rich threat intelligence extracted in real-time from the cybercriminal underground.
Using Torq’s library of automation components, organizations can build an automation infrastructure to orchestrate immediate responses to Cybersixgill’s early warnings of potential threats, allowing teams to build automated, alert-triggered playbooks with any other tool in their environment – without writing a single line of code.
Alerts from Cybersixgill’s rich threat intelligence insights can be programmed to autonomously initiate incident response workflows in Torq to instantly remediate issues at the first indication of a potential threat. Alternatively, security teams can harness Cybersixgill’s rich threat context to create automated threat hunting workflows, triggering data enrichment upon the arrival of an event or signal discovered through any other security tool.
Torq and Cybersixgill make it easy for teams to turn manual security processes into automated, intelligence-driven workflows within minutes, eliminating reactive processes to build a resilient, proactive cybersecurity posture.
The Benefits of the Combined Solution
Cybersixgill gives users covert access to our complete body of context-rich threat intelligence from the deep, dark & clear web, including limited-access forums and markets, invite-only messaging groups, code repositories, paste sites and clear web platforms. We correlate our threat intelligence with each customers’ defined organizational assets, alerting teams to relevant threats at the earliest indication of risk, enabling preemptive action to be taken before they can materialize into an attack.
Torq’s enterprise-grade security hyperautomation platformunifies and automates the entire security infrastructure to deliver unparalleled protection and productivity. Torq drives maximum value and efficiency from existing security investments. It supercharges security teams with powerful, easy-to-use no-code, low-code, and full-code workflows that reduce manual tasks, freeing security professionals to focus on higher-value strategic activities.
Together, the combined solutions help users:
Reduce risk with automated end-to-end intelligence-driven security workflows- Identify, capture and block threats as they emerge with seamlessly deployed playbooks to accelerate Mean Time to Respond and better secure your environment.
Save time and maximize team productivity- Eliminate manual work with automated workflows triggered by actionable and relevant threat intelligence data – built and deployed in minutes with no need for developers, professional third party services or month-long implementation delays
Minimize cost and maximize resources- with a consolidated end-to-end no-intervention threat protection solution that allows you to make the most out of your existing security stack, with faster time to value.
Optimize operations- by automating repeatable security processes, allowing you to shift valuable resources to higher priority tasks.
Schedule a demo to learn more about Torq Hyperautomation.
As businesses continue to evolve, automation has become an essential aspect of modern operations. The benefits of automation are numerous, ranging from reducing operational costs to increasing security, efficiency, and accuracy. However, with so many automation solutions available on the market, selecting the right one for your business can be challenging.
As a product specialist at Torq with over a decade of experience in field roles, I have had the opportunity to witness countless businesses on their automation journey, and I want to share some insights with you. At the end of the article, you will have a better understanding of the critical factors to consider when choosing the right automation solution.
1. Business Requirements, Technology Stack, In-House Solutions
The first step towards selecting the right automation tool is understanding your business requirements. This involves identifying processes that need automation (e.g., repetitive tasks, high error rates) and mapping the technology stack.
It is crucial to evaluate the automation solution’s ability to integrate seamlessly with your stack and to provide out-of-the-box functions relevant to your technology stack, as this improves time-to-value and ROI by enabling simpler automation workflow creation.
It’s also equally important to map your in-house customizations to examine how the potential solution works with them, as without the sync between the two, you will most likely face “unplanned costs,” and it might lead to complete blockers.
2. Out-of-the-Box vs Generic
Flexibility is another important factor to consider when selecting an automation solution. Wait a minute! What do we mean by flexibility? Referring to the balance between out-of-the-box capabilities and generic/customization capabilities. It is essential to ensure that the “out-of-the-box” capabilities can be fully customized; based on my experience, missing even one piece of the puzzle can prevent successful workflow automation, so you better be able to customize it or you might hit the same wall that is killing the legacy SOARs (content and integration creation; “Sorry, we don’t support it”).
However, beware of generic solutions that may satisfy use cases but hinder time-to-value and solution maintenance (for example, vendor API updates). So at the end of the day, having both out-of-the-box and generic capabilities is desirable.
3. POC Time + Success Criteria
After understanding your business requirements and technology stack, the next step is to evaluate potential automation solutions through a Proof of Concept (POC). The focus is on time-to-value and ROI. Choosing your important use cases and evaluating how quickly and easily they can be fully operational is essential. It is equally important to determine how easy it is for you to accomplish this. It’s time to ask your team to complete a use case from scratch using the potential automation solution.
Here is the specific success criteria for the POC as I see it (I promise it will save you money in the long):
New content creation
New integration creation: Out-of-the-box and generic capabilities
Bring your own code: Relevant when you have legacy code, such as a big in-house solution that you can’t replace right away, or even empowering someone who wants to use code for specific use cases
Connectivity capabilities: More than APIs (SSH, Bash, SQL, etc)
Life cycle management: Vendor API updates, production vs testing separation, testing and CI/CD solutions, etc.
Templates: Out-of-the-box workflows that reflect different use cases
Content sharing: Workflows and steps, relevant for a super user who helps others
Now that we have a candidate that answers all of that (hint: Torq), it’s time to validate what the future looks like. It’s time to focus on scalability, maintenance, and the vendor’s vision. As your business grows, the solution should scale with it. It is essential to choose an automation system that can handle increased data volumes and adapt to changing business needs over time. Selecting a solution from a vendor with a clear vision for the future can be critical to ensuring the long-term success of your automation efforts.
Choosing the right automation tool is a critical aspect of a modern security team. It’s crucial to examine the standout aspects of the solution as it can have a significant impact on your organization, particularly in terms of efficiency, improved security posture, and lowering costs.
While there are many factors to consider when selecting a security automation tool, these essential elements should guide your decision-making process, increasing the likelihood of success. As a product specialist at Torq, we understand the importance of selecting the right automation tool (so we have created a Hyperautomation one), and I hope that this article has provided you with valuable insights to make an informed decision.
Why These Criteria Matter: Real-World Results
Seamless integration, immediate value: Many security teams waste months trying to connect automation tools to their existing stack — or hit dead ends when vendors say “we don’t support it.” Torq’s 300+ pre-built integrations and AI-powered custom integration builder eliminate these blockers entirely. Fiverr’s VP of Business Technologies puts it simply: “The only limit Torq has is people’s imaginations.”
Flexibility without fragility: Legacy SOAR platforms force teams to choose between rigid out-of-the-box playbooks or complex custom code that breaks with every API update. Torq delivers both: pre-built templates for fast deployment plus no-code, low-code, and full-code customization for any edge case. Riskified transformed efficiency across all five security teams by tailoring workflows to their specific needs.
Rapid time-to-value: Long POCs drain resources and delay ROI. Torq deploys in minutes with agentless architecture and intuitive workflow building that doesn’t require dedicated engineering. Carvana automated 41 different runbooks within just one month of deployment, proving that fast POCs translate to fast production value.
Scalability without compromise: Legacy platforms buckle under enterprise-scale alert volumes, forcing teams back to manual workarounds. Torq’s cloud-native architecture scales elastically, handling millions of events without degradation. Carvana’s agentic AI now handles 100% of their Tier-1 alerts, while Compuquip saves hundreds of hours monthly on analysis.
Future-Proof Investment: Choosing a vendor without a clear roadmap means inheriting technical debt. Torq’s vision (AI-native, agentic automation) is already delivering what legacy SOAR promised but never achieved. Valvoline cut analyst workload by 7 hours per day, with Torq continuously evolving to handle emerging threats and use cases.
Making the Right Choice
Selecting a security automation solution isn’t just a technology decision — it’s a strategic investment that will shape your SOC’s effectiveness for years to come. The right platform integrates seamlessly with your stack, balances flexibility with out-of-the-box value, proves itself quickly in a POC, and scales alongside your business.
The wrong choice means months of integration headaches, rigid playbooks that can’t adapt, and a solution you’ll be replacing in two years.
Torq Hyperautomation was built to meet all four criteria: with 300+ integrations, no-code customization, rapid deployment, and enterprise-scale architecture that’s already powering SOCs at Carvana, Fiverr, Riskified, Valvoline, and more.
Hype vs. Reality: Are Generative AI and Large Language Models the Next Cyberthreat?
By Torq
May 17, 2023
5 Minute Read
Generative AI and large language models (LLMs) have the potential to be used as tools for cybersecurity attacks, but they are not necessarily a new cybersecurity threat in themselves. Let’s have a look at the hype vs. the reality.
The use of generative AI and LLMs in cybersecurity attacks is not new. Malicious actors have long used technology to create convincing scams and attacks. The increasing sophistication of AI and machine learning algorithms only adds another layer of scale and complexity to the threat landscape, which should be met with both common and innovative protection measures to maintain organizations’ security posture.
Generative AI and LLMs can have a significant impact on the scale of cybersecurity threats, both in terms of the number of attacks and their complexity. On one hand, these technologies can make it easier and faster for attackers to create convincing fake content. This could lead to an increase in the overall volume of attacks, as attackers are able to generate larger quantities of fraudulent content more quickly and easily.
Additionally, LLMs can be used to generate highly-targeted and personalized messages, which could make it more difficult for people to recognize them as fraudulent. For example, an attacker could use an LLM to generate a phishing email that appears to come from a friend or colleague, using their writing style and language to make the email seem more authentic. They could also be used to generate realistic-looking password guesses, in order to bypass authentication systems. Generative AI and LLMs can give attackers an advantage in certain situations. These tools can automate the process of creating convincing fake content, making it easier and faster for attackers to generate large quantities of phishing emails and other types of misleading content.
To mitigate the potential threats posed by generative AI and LLMs, organizations can take immediate steps, such as:
Multi-factor authentication-Implementing multi-factor authentication systems can help to prevent attacks that use AI technology to guess or crack passwords. By requiring additional verification steps, such as a biometric scan or a one-time password, organizations can make it more difficult for attackers to gain access to sensitive data or systems.
Employee training-Providing training to employees on the increasing threat of highly targeted and personalized phishing attacks as a result of generative AI. This can include training on how to identify and respond to phishing emails or suspicious behavior on the network.
Email filtering-Email filtering systems can provide an effective defense against phishing attacks that leverage AI technology. These systems can analyze large volumes of email traffic and quickly identify and block suspicious emails, helping to prevent users from falling victim to these types of attacks.
Hyperautomation-This new security automation approach is effective for countering the scale of attacks generated by AI, by providing organizations with comprehensively-integrated capabilities needed to quickly detect and respond to threats. In addition, it can help to reduce the workload on security teams by hyperautomating routine tasks such as incident triage and response. This can help to free up time and resources to handle more complex threats, such as those involving generative AI and LLMs.
The use of generative AI and LLMs is not limited to attackers. These tools can also be used by defenders to develop more effective security measures and detect potential threats. For example, security researchers can use LLMs to analyze large volumes of data and identify patterns that could indicate the presence of a cybersecurity threat. Some possible future applications of LLMs in cybersecurity protection can be developed to augment the existing tech stack, and help protect against a wide range of new and more sophisticated cyber threats:
Phishing Detection-LLMs can be trained to recognize and flag suspicious emails that may be part of a phishing attack. By analyzing the text of an email, an LLM can identify patterns or keywords that are commonly used in phishing attempts and alert users or security teams to the potential threat.
Malware Detection-LLMs can be used to analyze large volumes of code and identify patterns that are associated with malware or other types of cyber attacks. An LLM can identify keywords or phrases that are commonly used in malicious code and help to flag potential threats.
Threat Intelligence Analysis-LLMs can be used to analyze and categorize large volumes of threat intelligence data, such as security logs or incident reports, to identify patterns and trends in the data and help that indicate potential threats or vulnerabilities in the system.
Hyperautomation-By integrating AI-based threat detection capabilities into a hyperautomation platform, organizations can enhance their ability to quickly respond to attacks. For example, machine learning algorithms could analyze network traffic and identify patterns that indicate the presence of a threat. This would automatically trigger a response, such as blocking the malicious traffic or quarantining an infected device.
If you want to learn more about how hyperautomation can help your organization connect your entire tech stack, use no-code to full-code, and bring your own container, and deploy in a matter days, visit Torq.
Security case management is the process of turning alerts and signals into prioritized, investigated, and tracked cases, and it sits at the center of incident response.
The Torq AI SOC Platform uses AI agents to enrich context, order cases by severity, priority, and ownership, and carry cases through to remediation.
Agentic case management reduces noise and manual investigations by up to 70%, so analysts handle judgment calls instead of ticket upkeep.
Unified cases let SOC analysts hand off work cleanly and let IT, legal, and other teams collaborate in their own tools, such as Jira, ServiceNow, and GitHub.
AI-generated summaries, like a two-sentence VirusTotal verdict, turn verbose tool output into decisions in seconds.
What Is Security Case Management and Why Does It Matter?
Security case management is the process of collecting security alerts and signals into cases, prioritizing them by risk, investigating them, and tracking every decision through resolution. It sits at the center of incident response, because it connects alert triage, threat prioritization, and remediation across the tools and teams in a SOC. When SOC automation handles case management, analysts spend their time on judgment calls instead of ticket upkeep.
For years, efficient case management has been one of the most challenging tasks for security operations professionals. It means ensuring all threats are proactively identified and prioritized by risk criticality, then rapidly investigated and appropriately escalated across all organizational cybersecurity platforms and tools. Done well, it builds a near-bulletproof incident response posture that makes the most of an organization’s cybersecurity ecosystem.
Legacy security automation gave teams a starting point for case management, and the pace, volume, and variety of evolving threats now call for more. SecOps teams need the flexibility to pivot quickly through records and accurately assess whether they face a targeted campaign, a new and novel threat, or an ongoing, pervasive threat that could stop business in its tracks.
The Torq AI SOC Platform was purpose-built to deliver the comprehensive case management capabilities SecOps teams have demanded for years. AI agents drive efficiency even further, assisting analysts with cutting-edge technology so they make the right choices and catch every detail.
How Does the Torq AI SOC Platform Contextualize and Resolve Security Cases?
The Torq AI SOC Platform rapidly and accurately collects large numbers of unprocessed events and signals and organizes them into contextually enriched cases, ordered by severity, priority, and ownership. Torq Socrates™, Torq’s agentic SOC orchestrator, coordinates specialized AI agents that analyze and remediate cases across multiple organizational functions, and every security decision lands in a single, auditable record.
The benefits of this approach to case management are significant. By using agentic automation for signal detection, the platform reduces noise and manual investigations by up to 70%. Its flexible framework also streamlines decision-making and enriches data automatically, which cuts through the noise and separates minor, easily remedied incidents from significant, existential organizational threats.
What Is Agentic Security Case Management and How Does It Work?
Agentic security case management uses AI agents to create, update, and manage cases in response to security alerts, so teams prioritize and respond quickly. Torq runs common use cases as repeatable, customizable processes that launch every necessary step, with decision points that bring in human intervention for scenarios such as escalation or case handoff.
Torq Hyperautomation™, the engine behind the Torq AI SOC Platform, executes those repeatable steps, and Torq HyperAgents® add agentic reasoning that adapts to each case. SOC analysts can analyze and build the processes that handle a case or issue, and AI agents take on the routine work.
Security teams streamline their processes and focus on high-priority threats, because Torq creates, updates, and manages cases in response to alerts without manual effort. Analysts move past mundane tasks and concentrate on higher-level security activities.
How Does Torq Automatically Enrich Security Case Context?
Torq’s Case Management transforms large numbers of events and signals into contextually enriched cases. It orders every case by severity, priority, and ownership, and it uses intelligent correlation of signals to open, update, enrich, or close cases, with human interaction optional.
Contextual enrichment adds threat intelligence, asset details, ownership, and history to a case so analysts see the full picture at a glance. Torq Auto Triage prioritizes alerts first, so the enriched cases that reach analysts reflect real risk.
How Does AI Accelerate Threat Discovery and Remediation in Security Operations?
AI agents in the Torq AI SOC Platform enrich the context of security alerts automatically, so analysts get involved only when a judgment call is required. When an alert fires, the platform evaluates severity, correlates it with historical signals, and determines the next action through event-driven agentic automation connected to your existing security tools. That cuts mean time to detect (MTTD) and mean time to respond (MTTR) and lets teams contain threats before they escalate.
Example: A VirusTotal MD5 Hash Lookup
In this example, a suspicious file is detected on an endpoint, and the IT analyst wants to know whether VirusTotal already lists the threat as suspicious or malicious. The analyst runs an MD5 hash lookup that kicks off an AI agent without leaving the case ticketing system.
A security analyst runs an MD5 hash lookup that kicks off an AI agent without leaving the case ticketing system.
ChatGPT condenses the findings into two sentences stating that 56 of 71 AV engines detected the threat as malicious, in place of the verbose output VirusTotal typically returns. That saves significant time and summarizes the incident in a human-readable format.
A summary of the AI agent’s output, logged automatically to the open ticket.
Torq can then run automatic remediation to scan the environment for persistence anywhere on the network, clean the endpoint, or quarantine it for further analysis by a SOC analyst.
Utilizing the power of ChatGPT, the findings are condensed to two sentences that state that 56 of 71 AV engines detected the threat as malicious. Contrast that with the overly-verbose output that you would typically receive on VirusTotal. This saves tremendous time and summarizes the incident in a readily consumable human-readable format.
Torq can then execute automatic remediation workflows to run a scan of the environment for persistence anywhere on the network, automatically clean the endpoint, or quarantine it for further analysis by a SOC Analyst.
What Does Unified Security Case Management Look Like in Practice?
Unified security case management gives SOC analysts one view of each case, with the essential processes for handling and resolving it. Handoffs between analysts happen seamlessly with all relevant case details at hand, and external teams collaborate inside the platform using the tools they already know.
Intelligent case management lets analysts take action confidently and reduces the risk of human error. AI-generated case summaries capture every step of an investigation, which keeps handoffs clean. Collaboration outside the SOC is easy to do within the platform, and it helps most with complex incidents that need multiple subject matter experts. Each external team resolves security issues efficiently with its tools of choice, including Atlassian Jira, ServiceNow, GitHub, and more.
Cross-team collaboration with various subject matter experts engaged in a high-priority investigation.
How Does Case Management Deliver Accurate, Actionable Outcomes?
Torq Case Management curates accurate, actionable data to identify service and security issues as they develop. Real-time analytics and long-term analysis reveal service trends and show where SOC analysts or other teams could gain efficiency through agentic investigation and containment. Reporting helps teams monitor progress and track performance, which helps analysts resolve cases more efficiently and reach better outcomes.
Want to see how the Torq AI SOC Platform can dramatically enhance your security operations so you can stay ahead of emerging threats?
How Does Automated Case Management Improve Incident Response Time?
Automated case management shortens MTTD and MTTR by enriching alerts on arrival, routing cases to the right owner instantly, and removing escalation delays and handoff gaps. Torq customers commonly achieve a 90%+ reduction in MTTR. Because every action and decision lands in the case, analysts pick up where the last person stopped. See how SOC incident response works with AI agents.
What Integrations Are Needed for Automated Security Case Management?
Effective case management connects to the tools where alerts originate and where work gets done: SIEM platforms, endpoint detection tools, threat intelligence sources such as VirusTotal, and ticketing and collaboration tools such as Jira, ServiceNow, and GitHub. Each integration removes a manual handoff, because data and actions flow between tools without copy-and-paste. The Torq AI SOC Platform offers 300+ native integrations that cover these categories.
How Does AI Help With Security Alert Triage?
AI ranks alerts by severity, correlates them with historical signals, summarizes findings, and recommends next steps. In the VirusTotal example above, ChatGPT condensed verbose output into a two-sentence verdict that 56 of 71 AV engines flagged the file as malicious. Torq Auto Triage applies the same approach at scale and averages 42 seconds per triage with 94% accuracy out of the box (as of May 2026). Analysts then review only the cases that need judgment.
What Is the Difference Between Legacy Security Automation and an AI SOC for Case Management?
Legacy security automation runs predefined playbooks that engineers configure and maintain, which works well for known scenarios and takes ongoing effort as tools and threats change. An AI SOC adds AI-assisted triage, flexible event-driven automation, and real-time contextual enrichment that adapts to new threat types. That shortens the time to deploy new processes and scales with the volume and variety of modern threats. Many teams keep their existing automations and add AI agents on top. Compare options with the AI SOC Buyer’s Guide.
What Is Security Case Management Automation?
Security case management automation is the use of AI agents and software platforms to collect, correlate, prioritize, and resolve security alerts and incidents without requiring manual analyst intervention at every step. It replaces manual triage, spreadsheet tracking, and rigid playbook-based security automation with AI-driven processes that enrich alert context, assign severity scores, and trigger remediation. The result is faster incident response, less analyst burnout, and fewer threats that go undetected because of alert fatigue. Learn more in What Is an Agentic SOC?
How Does Automated Case Management Reduce Analyst Workload?
Automated case management reduces analyst workload by correlating related signals into single cases, filtering out noise, and enriching each case before an analyst opens it. Torq reduces noise and manual investigations by up to 70%. Auto-enrichment means analysts no longer pivot across tools to gather context, and routine cases close or remediate without human touch. Read how to measure AI SOC ROI beyond hours saved for a framework to quantify the savings.
What Is Contextual Enrichment in Security Case Management?
Contextual enrichment is the process of transforming raw signals into enriched cases with threat context, ownership, severity scores, and remediation history. AI agents query threat intelligence, asset inventories, identity data, and past cases, then attach the results so analysts see the full picture. Enriched cases support faster, more confident decisions and cut the time spent gathering context. Explore threat intelligence enrichment for a closer look.
Can Security Case Management Automation Support Cross-Team Collaboration?
Yes, security case management automation supports cross-team collaboration. External teams such as IT, legal, and compliance can engage through familiar tools like Jira, ServiceNow, and GitHub, while the SOC maintains a unified view of the case. Everyone works from the same enriched record, which reduces back-and-forth and speeds resolution of complex incidents. See how SOC teams work in the Torq AI SOC Platform.
How Does AI Reduce Alert Fatigue for Security Analysts?
AI reduces alert fatigue by filtering false positives, grouping related alerts into single cases, and resolving routine cases autonomously, so analysts see far fewer low-value notifications. Case summaries and enrichment remove the repetitive context gathering that wears teams down. Analysts then spend their time on investigations that need human judgment. Learn more about cybersecurity alert fatigue.
Torq Hyperautomation: The Most Talked About Product at RSAC
By Don Jeter, Torq CMO
May 5, 2023
4 Minute Read
When you say, “SOAR is Dead,” you’ll get some attention, and that’s exactly what happened at RSAC 2023.
But it wasn’t just a statement that created the buzz.
It was the solution that we unveiled that got people talking. The debut of Torq Hyperautomation™ created an enormous buzz across RSAC 2023 – on the show floor, in the media, and even on the street. Why? Because cybersecurity professionals are tired of the complexity associated with legacy SOAR platforms. They want something easier to use that doesn’t take up all their time or require costly professional services. We get it. That’s why our booth was packed with attendees wanting to demo the world’s first no-code, low-code, and full-code security automation platform with true enterprise scalability. It’s the same reason why CRN called Torq Hyperautomation “one of the coolest products at RSAC” and “the most important product announcement” by CSO Online.
Torq Hyperautomation addresses the challenges that SOAR platforms have only made worse.
According to the customers and partners we spoke with at RSAC, these are the most common problems facing cybersecurity professionals:
Trouble Retaining Security Talent
One of the most common themes we heard echoed was the trouble retaining security talent. Specifically sourcing and hiring security professionals. We sat down with our partner, Recorded Future, who posed the question, “What if we took intelligence that’s not only human readable, but machine-readable, and then a powerful automation engine, so that instead of having your analysts waste time and look up indicators, and wasting time researching the simple, being things, what if we help them automate that?” By automating mundane tasks, cybersecurity professionals can focus on the aspects they are most passionate about in their careers.
Too Many Tools
Another concern we heard from customers was the overwhelming amount of tools they are being forced to manage. Consolidation was a word we kept hearing as cybersecurity professionals are challenged to keep up with the overwhelming amount of tools and applications they interact with daily. Our partner SentinelOne noted, “The threat landscape hasn’t changed, but budgets definitely have. CISOs and CFOs will be more deliberate on the tools they choose. I think what’s so special about Torq is it not only speaks to something that makes you secure, but also helps you save money as well, and that’s going to speak to the heart of the CFO who is more and more influential in terms of that security buying decision.” That’s why it’s mission-critical for organizations to simplify and integrate tools to prevent coverage gaps.
Multi-Cloud Complexity
Did you know that 76% of organizations operate in multi-cloud environments? We heard lots of discussion about the challenge of the complexity of multi-cloud environments. Our partner Dig, said, “I think Torq and Dig have both identified that the scale of the cloud requires a different level of automation.” With the adoption of multiple cloud services from different providers, it is challenging for cybersecurity teams to manage and monitor security risks effectively. Hyperautomation can help to streamline the process by automating the detection, analysis, and response to potential security threats.
Torq Hyperautomation is here to change the game. Here’s what the media had to say about Torq Hyperautomation:
“One of the most interesting products to see at RSAC 2023.” CSO
“Top-10 cool new cybersecurity tool announced at RSAC 2023.” CRN
“One of the most important new product announcements at RSAC 2023.” SecurityWeek
“Automates whole workflows and processes for all security initiatives within an organization.” Analytics Insight
“Torq empowers people to take greater responsibility for security while enabling them to participate in threat remediation.” SiliconAngle
“Capable of automating the most complex security infrastructures.” Betanews
“Torq Hyperautomation is distinguished from legacy SOAR, making it simpler to use a range of tools to create new processes.” Security Boulevard
“A quantum leap forward for security automation.” SecuritySenses
Want to learn more about how to streamline your security workflows and stay ahead of emerging threats? Test drive Torq Hyperautomation, here: https://torq.io/demo/
Today, Torq transformed security automation forever with the debut of the world’s first enterprise-grade security hyperautomation platform.
Why does that matter? I’ll let Gartner explain. It says “Hyperautomation is a business-driven, disciplined approach that organizations use to rapidly identify, vet, and automate as many business and IT processes as possible.” Simply put, it’s the future of security automation, and we’re delivering on its promise, today.
So Long, SOAR
The Torq Hyperautomation Platform is the first to automate all workflows and processes across the entirety of modern enterprise security organizations to deliver best-in-class, end-to-end cybersecurity protection. It also offers the world’s first GPT AI-based analytics capability for auto-analyzing cybersecurity incidents, making strategic responses, and informing immediate and long-term defensive measures.
Torq Hyperautomation enables security professionals to create and deploy complex, sophisticated workflows in minutes, more than 10X faster than legacy SOAR and conventional security automation solutions that also involve costly professional services commitments. In fact, our customers now rely on our platform for more than 3m daily security automations. In other words, when we say SOAR is dead, we mean it.
Integrates with Anything and Automates Everything
With Torq Hyperautomation, customers are experiencing the deepest integrations imaginable, that enable them to:
Connect to Everything–Every app, every stack, vendor agnostic across cloud, on-premise, and hybrid environments, including Microsoft Teams, Slack, Discord, and Zoom.
Use No-Code, Low-Code, and Full-Code–Go beyond APIs, with support for any CLI, on any platform, and any programming, or scripting languages, including Python, GraphQL, C#, and gRPC.
Bring Your Own Container–Torq orchestrates containerized actions that can connect internal and external platforms seamlessly, including support for Docker, Kubernetes, Amazon Web Services, and Azure.
Making AI-Based Automation a Reality
We’re liberating overworked security and IT operations professionals by innovatively deploying the power of AI. Torq Hyperautomation integrates GPT to dramatically enhance SecOps using Natural Language Processing (NLP) to accurately answer user requests in real-time, which elevates the speed, quality, and accuracy of investigating and resolving security issues.
With GPT integration, Torq uniquely delivers a chatbot interface integrated into Slack, MS Teams, Discord, and Zoom to communicate with security tools and systems. Now, SOC analysts or any authorized operators can use natural language to intuitively search for specific information and insights across multiple security tools and data sources. It simplifies interactions with complex security tools and makes analysts more efficient in threat hunting, investigations, and response. It also auto-escalates self-service requests, notifying SecOps teams when a critical incident requires human intervention.
Your Security Product’s Favorite Security Product
With Torq Hyperautomation, our customers, spanning the Fortune 500 and the world’s leading cybersecurity vendors, including Wiz, Abnormal Security, Armis, and SentinelOne, are consolidating, managing, and orchestrating the entirety of their cybersecurity stacks.
We’re proud to also have many of the world’s biggest financial, technology, consumer packaged goods, fashion, hospitality, and sports apparel companies experiencing extraordinary outcomes with Torq Hyperautomation. Here’s what a few of them are telling us:
“We now query 2,000+ assets in under 7 minutes with Torq, which previously took over an hour to run, one at a time. This reflects an 800% improvement in execution time.” – Taylor Harwerth, Cloud Security Architect, Abnormal Security
“It’s amazing to see that Torq is handling 80,000+ runs a week for Compuquip without a single hiccup. Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.” – Phillip Tarrant, SOC Technical Manager, Compuquip
“The only limit Torq has is people’s imaginations. And if I take Torq out, I lose three people.” – Gai Hanochi, VP Business Technologies, Fiverr
“Torq has transformed how our team manages security. Using Torq to manage web application firewall blocking rules reduced time-to-block malicious traffic by 70x, and increased coverage to over 90% — a significant improvement.” – Jonathan Jaffe, CISO, Lemonade
“Torq’s pre-built workflows enable us to easily deploy cybersecurity defenses at scale throughout our organization, mapping to countless different use cases, and protecting us across multiple conceivable incursion points.” – Yaron Slutzky, Chief Security Officer of Agoda
A Bold New Brand Refresh
The eagle-eyed among you will notice we’ve also unveiled a new look and feel for the Torq brand. It’s dynamic, infused with energy, and projects the excitement and innovation Torq Hyperautomation delivers. It’s also about capturing lightning in a bottle, illustrating the incredible drive and commitment each and every Torq employee has towards our customers. There’s lots of light, color, and electricity and we can’t wait to further deploy it in the coming weeks and months across every Torq touchpoint.
The Best of Growth Worlds: Natasha Fulbright Joins Torq as VP of Growth
By Torq
April 12, 2023
4 Minute Read
We’re thrilled to announce the appointment of Natasha Fulbright as our VP of Growth. Natasha’s served as Corporate VP of Marketing at Pax8, and will be responsible for driving growth marketing and building our go-to-market engine. Get to know Natasha, below:
Tell us about how you plan to elevate growth at Torq in 2023?
Prior to my joining, the team had built a really strong sales and marketing teck stack foundation, and my objective is to put fuel on those tools enabling them to work together creating striking integrated campaigns to generate demand and also build customer community programs. Our product is incredibly powerful, and now it’s all about elevating and getting the message out there to the right people to accelerate our growth. We really are taking away mundane and repetitive tasks from IT and Security teams, so that they can concentrate on strategic initiatives, what’s not to love about that. I think we have so much untapped potential and I’m joining at a time where I feel I can make an impact to the business.
Tell us a little bit about your career path before Torq
My career has always been in B2B Marketing and the environment has ever-changed. In my previous role I served as the Corporate VP of Marketing at Pax8, where the company saw 60% revenue growth, yearly during my 5-year tenure. When I left Pax8, we had achieved a $1B run-rate. Over the course of my tenure we went from being a startup to a mid-sized company. I loved being an integral part of their growth, which is now what I want to do here for Torq. I thrive on being given the opportunity to build and grow teams.
What makes you excited about working at Torq?
The limitless possibilities for Torq’s success. The whole team carries this energy and enthusiasm which is addictive. We’ve even had customers tell us that Torq is addictive, and I think it resonates through everything the team does. The possibilities are endless, we see that in how our customers react when they see a demo, and our high adoption rate. We’re excited to be pioneering a new way forward for enterprise-grade security automation. Don Jeter (Torq CMO) and I have worked closely together for five years – we’re a marketing duo. I’m excited to support him and the entire Torq team in building the go-to-market strategy here. I feel honored to work and learn alongside the experienced sales leadership that also recently joined.
What’s the best piece of advice you were ever given?
Eleven years ago I had a mentor that I told I was very interested in moving overseas from the EMEA office in London to the Global HQ of the company in Denver, and he replied, “Have you told anyone you want to work at the Global HQ?” I sheepishly replied, “no,” and he replied, “do you think you should?” and I sheepishly replied, “yes.” So, I made a phone call, and my colleague declared I’d made their day. Within three months I was on a plane moving from London to Denver, Colorado. Lesson learned, ask for what you want. It was simple advice, but it changed my life.
What are your hobbies outside of work?
I ski (a lot) in the winter, and road bike (a little) in the summer. I also love to travel. My favorite place I’ve ever been to is Vietnam, it’s beautiful and the culture is enchanting. I’ve been twice, and I really want to go back again.
