Architecting a Production-Grade Anti-Phishing Defense System with the NVIDIA NeMo Agent Toolkit and NIM

By Konstantin (Kostya) Ostrovsky

August 26, 2025

11 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Konstantin (Kostya) Ostrovsky is the Chief Architect at Torq, where he leverages over 18 years of experience in software engineering and architecture. He specializes in cybersecurity, with a background that began with writing Windows Kernel Drivers. Konstantin is also a frequent speaker at software engineering conferences globally.

Phishing attacks have evolved significantly in recent years, rendering traditional, rule-based defenses ineffective against sophisticated threats. Organizations now require dynamic, context-aware defenses that understand and adapt to complex threats in real time.

Torq has delivered a production-grade anti-phishing solution leveraging a multi-agent system built on NVIDIA’s advanced AI infrastructure and the NVIDIA NeMo Agent Toolkit open source library. This initiative provides enterprises with adaptive, scalable security designed to handle evolving cyber threats.

Why Torq Built on NVIDIA AI

Today’s phishing threats are engineered to bypass even the most sophisticated rule-based detection systems. They exploit context, urgency, and behavioral nuance in ways that traditional security architectures were never designed to handle.

Torq set out to solve this problem not with another static filter, but with a dynamic, production-grade product built on a multi-agent system that works like a modern SOC: distributed, specialized, and collaborative. To do that, we needed a framework built for a modular, efficient AI platform that could scale, adapt, and be trusted in real-time enterprise environments.

That’s why we’re collaborating with NVIDIA and built this system using their NeMo Agent Toolkit and NVIDIA NIM microservices.

The NeMo Agent Toolkit enables rapid development of complex, multi-agent workflows using intuitive YAML-based configuration, plug-and-play tool integration, and support for custom large language models. Through built-in profiling and telemetry, developers gain complete visibility into agent performance, latency, and cost, making it ideal for both development and production deployments.

The NeMo Agent Toolkit works side-by-side and around existing agentic frameworks, customer enterprise frameworks, and simple Python agents. It complements any existing agentic framework or memory tool you already use, allowing you to easily integrate your existing code base into the framework.

With NVIDIA NIM, we get high-performance, containerized inference endpoints for the latest AI models from NVIDIA and the community. It’s what lets us serve different LLMs for different tasks, optimize for latency and throughput, and swap in newer models as threats evolve.

Together, these technologies let us build an autonomous decision-making engine that’s explainable and built for production from day one.

Inside the Torq Phishing Defense Architecture with NVIDIA

The multi-agent phishing defense architecture comprises specialized AI agents working collaboratively. Each agent addresses specific aspects of email analysis, mirroring the workflows used by human security operations teams for comprehensive threat assessment.

The Torq Phishing Defense architecture with NVIDIA includes:

SecurityAnalystAgent: Acts as the system’s first touchpoint, ingesting raw email data and parsing it into headers, body content, and attachments. Based on the email’s contents, each element is routed to the appropriate specialist agent for deeper analysis, effectively kicking off the investigation workflow.
HeaderAnalysisAgent: Focused on the metadata and dissects email headers to detect spoofing or forgery. It verifies SPF, DKIM, and DMARC records, tracks anomalies in the mail relay path, and identifies mismatches between sender fields and the authentication records.
ExternalResourcesAgent: Hunts for malicious links, cross-referencing URLs against both external threat intelligence sources (like VirusTotal) and internal threat databases. Each URL is scanned and ranked by risk score. File attachments, both unprotected and password-protected, are also scanned using 3rd party vendors to detect malware. Often, phishing emails contain password-protected files with the password casually embedded in the email’s body. This is easily detected by a human, but requires a lot of engineering effort to extract and detect. Nowadays, thanks to LLMs, we can easily identify passwords and perform proper scanning on password-protected assets.
ScreenshotAnalyzerAgent: The email is rendered in a sandboxed environment, and then a screenshot is taken. We then use VLMs with image analysis support to identify any potential signs of a phishing email, such as broken logos, mixed font colors, and other indicators that a trained expert could only identify in the past. Nowadays, we can achieve that using out-of-the-box foundational models or models fine-tuned for phishing email data.
ContentClassifierAgent: Uses a LLM to analyze the email’s tone, urgency, and intent. It flags psychological manipulation cues (like fake deadlines or impersonation), often hidden from traditional filters.

Example prompt snippet:

# Social Engineering Tactics:

– Urgency and time pressure (“Act now!”, “Limited time!”, “Expires today!”)

– Authority impersonation (pretending to be from banks, government, IT support, executives)

– Fear-based manipulation (account suspension, security breach, legal action threats)

– Emotional appeals (charity scams, personal emergencies, romantic deception)

– Curiosity exploitation (mysterious packages, secret information, exclusive offers)

– Trust exploitation (fake testimonials, false credentials, friendship pretense)

# Content Analysis:

– Requests for sensitive information (passwords, SSN, account details, verification codes)

– Suspicious links or attachments mentioned in the text

– Generic greetings vs. personalized communication

– Grammar, spelling, and language inconsistencies

– Mismatched branding or logos mentioned

– Unusual payment methods (gift cards, cryptocurrency, wire transfers)

# Behavioral Indicators:

– Instructions to bypass security measures

– Requests to keep communication secret

– Pressure to act without verification

– Unusual communication channels suggested

– Requests to download software or click links

– Inconsistent sender identity or story

# Technical Red Flags:

– Shortened URLs or suspicious domain names mentioned

– Requests to disable security software

– Instructions to enable macros or run executables

– Phishing kit indicators (template text, placeholder content)

– URL analysis for typosquatting or suspicious domains

# Language Pattern Analysis:

– Inconsistent tone or writing style

– Translation artifacts suggesting non-native speakers

– Copy-paste indicators from legitimate sources

– Formatting anomalies or HTML artifacts

– Mixed font styles or encoding issues

VerdictAgent (The SOC Lead): Compiles all findings, weighs conflicting signals, and delivers a contextual risk score with a clear explanation. Acting as the decision-making layer, it mimics a senior analyst’s judgment to determine whether the email poses a threat. In addition to a verdict, it also provides the reasoning behind the decision and the investigation.

This sophisticated logic requires a powerful, reliable execution engine. The NVIDIA NeMo Agent Toolkit provides:

Framework-agnostic orchestration: Integrates existing Python libraries and agents seamlessly. Using it allows us to build multi-agent flows with ease.
YAML-driven workflows: Uses declarative YAML files for defining agent behaviors, workflows, and model configurations and prompts, simplifying deployments.
Built-in profiling and evaluation: Offers detailed telemetry to optimize latency, performance, and resource usage. This is extremely handy during the development phase. Using the profiling and evaluation data helps to select the right model for the job, either a cloud-hosted one provided by one of the vendors or a locally running one powered by the NVIDIA NIM containers.

Complementing the toolkit, NVIDIA NIM delivers high-performance, containerized inference endpoints for model flexibility. Using NIM containers allows easy, single-click model swaps without infrastructure complications.

Orchestration in Practice with config.yaml

At the center of this phishing defense system is a declarative NeMo Agent Toolkit configuration file that defines every component of the multi-agent architecture within a single YAML file. This makes the system highly extensible, developer-friendly, and production-ready.

The NVIDIA NeMo Agent Toolkit enables this orchestration by configuring each tool, model, prompt, and agent as composable, callable components. Here’s a conceptual breakdown of how it all comes together.

1. Tools and Agents Defined as Functions

The YAML configuration begins by defining individual tools: custom Python functions, API lookups, and Retrieval-Augmented Generation (RAG) pipelines. These are then mapped to specialized AI agents like HeaderAnalysisAgent and URLScannerAgent. Each agent uses a specific LLM and toolset to complete its role within the overall phishing analysis.

2. LLMs Powered by NVIDIA NIM

Two distinct LLMs are served via NVIDIA NIM containers: one for general reasoning and ReAct-style logic, and another fine-tuned for phishing content classification. With just a few lines of config, you can swap out or upgrade models.

3. VerdictAgent as the Final Judge

The workflow culminates in the VerdictAgent, implemented as an agent that reviews the results of the investigator agents to complete the analysis. It generates a verdict based on the assessment results generated by the investigative agents, summarizing their conclusions and calculating a risk score based on their findings.

Here’s what makes this approach powerful:

Modularity: Each agent is an independent component, making updates and testing seamless.
Flexibility: Swapping models, tuning prompts, and adding or removing tool logic are a matter of changing the agent’s configuration in the configuration YAML.
Explainability: The VerdictAgent aggregates signals from diverse sources, enabling human-readable reports and confidence scoring.

Spear-Phishing Detection in Action

By utilizing NVIDIA’s rich LLM ecosystem, Torq delivered a system uniquely capable of identifying high-risk spear-phishing campaigns targeting executives. These attacks typically include password-protected malware attachments with credentials shared in the email body. While traditional tools overlook this context, the AI agents in the system understand intent and behavior.

The results speak for themselves: LLM-based security systems dramatically outperform traditional rule-based engines, reducing incident response times from hours to under ten minutes for critical threats. These systems also demonstrate superior resilience against AI-generated phishing attacks, maintaining accuracy even when sophisticated rephrasing techniques are employed — showing only a 3-4 percentage point decline compared to 5-9 points for traditional models.

Perhaps most importantly, intelligent event correlation tackles alert fatigue head-on, reducing alert volume by up to 87% while ensuring security teams can focus on genuine threats rather than managing false positives.

Real-World Impact

Leveraging Python as a unifying language, the NeMo Agent Toolkit for rapid development, Torq was able to build an agentic AI-based phishing email detection feature quickly. This effectively addresses advanced phishing tactics, including password-protected malware attachments. It understands the nuanced context within phishing emails, resulting in:

Accelerated incident response: Agents collaboratively analyze threats, drastically reducing the mean time to respond (MTTR) up to 92% faster compared to manual investigation.
Fewer false positives: Context-aware agents ensure precise detection, minimizing alert fatigue.
Stronger threat correlation: Agents correlate seemingly unrelated phishing attempts, uncovering hidden threat patterns and bolstering overall security posture.
7-15x More Effective at Catching Missed Phishing Emails: Our initial testing shows that our product is able to detect a significant number of malicious emails that have already been scanned and deemed “safe” by traditional gateways like those in Microsoft 365 or Google Workspace.

Building AI Security That Learns and Scales

Phishing threats continue to evolve, demanding smarter, adaptive solutions. The collaboration between NVIDIA and Torq shows how multi-agent AI systems can redefine phishing defense.

Customers can plug our advanced phishing detection feature directly into their Torq workflows; it is available as a Step in their Builder’s Toolbox. This feature enables real-time analysis of emails, attachments, URLs, and headers using multiple specialized AI agents, delivering highly accurate threat detection without manual tuning. By embedding this capability into automated workflows, security teams can rapidly identify and mitigate phishing attempts while continuously adapting to new threat patterns.

See how AI-driven security operations transform detection, response, and scale across your entire environment.

Get the Manifesto

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Hyperautomation Research

AI SOC Market Landscape 2025: Torq Leads With Hyperautomation

By Dallas Young

August 25, 2025

5 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

The SACR 2025 AI SOC Market Landscape Repor t just dropped, and Torq was named one of the “most feature-rich platforms” on the market.

Not because we bolted a chatbot onto triage. But because we’ve built an AI SOC platform modern security teams actually need: an AI-native, execution-first infrastructure that operationalizes intelligence at scale.

And that platform works.

Other Vendors Build Features. Torq Builds the Foundation.

According to Francis Odum and Rafal Kitab from Software Analyst Cyber Research’s survey of 300+ CISOs:

Enterprises are battling over 3,000 alerts per day, across 28+ tools
40% of alerts go uninvestigated
61% of teams have ignored alerts that turned out to be critical
The average investigation time is 70 minutes
Meanwhile, phishing breaches succeed in under 60 minutes

The takeaway is that you don’t need another AI assistant. You need a system that executes. The winners in the AI SOC space won’t be the ones with the flashiest chat UI — they’ll be the ones that reduce MTTR, scale across fragmented environments, and adapt faster than threats evolve.

That’s Torq.

AI is Only as Useful as Where It Lives

Francis Odum and his team break the AI SOC market into several architectural approaches: black-box overlays, workflow emulators, and Integrated AI SOC Platforms. Only a handful of vendors made that top-tier designation. Torq is one of them.

Here’s what that means in practice:

Agentic AI works inside your environment. It uses hundreds of APIs, headless modes, and Slack/Teams interactions to collect context and execute actions.
The platform is horizontally scalable, with active monitoring by engineering for peak load performance.
Time to full operation is measured in weeks.
- Day 1–3: Core setup and integrations
- Day 4–7: Early automation with templates
- Weeks 2–3: Advanced workflows and AI agent deployment
- Weeks 3–4: Full operational status

Why does that matter? Because AI on the outside can only suggest. AI on the inside can act. Agentic AI has massive potential, but it’s only as powerful as the system it operates in.

Most Vendors Promise Outcomes. Torq Delivers Infrastructure.

The AI SOC space is crowded. As the SACR report points out, most vendors are chasing the same three problems: alert triage, investigation acceleration, and co-pilot-style assistance. These are necessary, but not enough.

Unlike black-box platforms, Torq provides full visibility and control over every AI-driven decision.

1. AI decisions are explainable.

AI decisions are explained with the what, when, impact, key indicators, and next steps.

2. Human feedback is instantly integrated.

Human feedback or instructions written in natural language is instantly integrated.

3. Automation logic is entirely customizable via a visual no-code editor.

In the report, Francis Odum stated that Torq “exceeds expectations for features that AI SOC platforms typically bring.” That’s because we’re not just building features; we are the central nervous system of your security operations, designed to:

Consolidate fragmented workflows across identity, cloud, endpoint, and email
Trigger and scale real-time responses
Integrate agentic decision-making into every step
Operate in hybrid, cloud, and air-gapped environments

As Odum and Kitab note, integrated platforms like Torq are the only architecture that delivers both control and execution at scale.

Enterprise-Grade Infrastructure That Goes Beyond Detection and Response

The SACR report evaluated vendors across operational metrics that matter: investigation speed, alert validation, explainability, contextual enrichment, and performance at scale. Torq stood out because we’re operationally mature and built for enterprise SOCs and MSSPs.

Odum and Kitab’s deep dive surfaced more of Torq’s infrastructure-level advantages, including:

300+ out-of-the-box integrations
Hybrid, on-prem, and air-gapped deployment options
Support for BYOC (Bring Your Own Container)
Log storage, threat hunting, and artifact analysis baked in
Multi-tenancy, full governance, and deletion controls for MSSP and enterprise use
Support for all major compliance frameworks

Not Another Tool — A True Operating Layer

When the report highlighted Torq’s “broad capabilities” in the market, they weren’t just referring to feature count. They were pointing to depth — to a platform that can power CSPM, IAM, threat hunting, email security, incident response, and more, from a single, configurable foundation.

Modern SOCs aren’t one-size-fits-all. Whether you’re running an internal team or an MSSP serving 50 clients, you need a platform that:

Operates autonomously, not in isolation
Handles governance, not just generative reasoning
Executes decisions, not just recommends them

Torq’s Brittney Zec sits down with Francis Odum to get the low down on the SACR 2025 report.

Choose the Platform That Makes AI Work

There’s a lot of noise in this market. Most vendors are in the early innings — or worse, locked in pre-packaged black boxes that leave you with no customization, transparency, or control.

Torq’s take is simple: AI isn’t the product. AI is the engine. The product is the system that runs it. So if you’re still comparing AI SOC tools by which one has the slickest co-pilot or the prettiest chat interface, you’re playing the wrong game.

An autonomous SOC requires three key components: Hyperautomation, SOC-specific AI agents, and enterprise-grade security architecture.

You should be asking:

Does this platform give me executional control?
Can I modify logic and workflows without code?
Is the AI embedded — or sitting on the sidelines?
Can it handle my real-world scale, load, and compliance needs?
Can I trust what it does — and see how it got there?

If the answer isn’t “yes” across the board, it’s not built for where SOCs are headed.

Torq is. And now, thanks to SACR’s 2025 report, the industry knows it too.

Build the execution-first SOC the SACR report points to: transparent, scalable, and enterprise-ready. Read our Don’t Die, Get Torq Manifesto to learn more.

Get the Manifesto

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

Hyperautomation Integrations Security Automation 101 Use Cases

Top Vulnerability Management Tools and How Torq Automates Remediation

By Torq

August 22, 2025

8 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Vulnerability management is a cornerstone of modern cybersecurity — but for many organizations, it’s also a source of frustration. Most vulnerability management tools are excellent at finding weaknesses, yet they stop short of closing the loop.

That leaves security and IT teams with an ever-growing backlog of findings, manual triage, and slow remediation cycles. Meanwhile, attackers aren’t waiting for your next patch window.

Close the loop with Torq Hyperautomation^TM. Use Torq to prioritize the highest-risk findings with real business context, remediate across patching and configuration tools automatically, and verify fixes in real time — reducing MTTR, shrinking exposure, and ending the backlog for good.

What Are Vulnerability Management Tools?

Vulnerability Management Tools

Vulnerability management tools are software solutions designed to identify, assess, and report security weaknesses in networks, systems, applications, and cloud environments.

The vulnerability management lifecycle generally includes:

Discovery: Finding assets and identifying vulnerabilities.
Assessment: Scoring and analyzing the risk of those vulnerabilities.
Prioritization: Determining which issues to fix first based on severity and business impact.
Remediation: Applying patches, configuration changes, or mitigations.
Verification: Confirming the vulnerability is resolved.
Reporting: Measuring performance to refine processes and increase efficiency.

The challenge? Even with great tools, scale, speed, and complexity make it hard to move from vulnerability identification to closure — especially without automation.

How Torq Automates Vulnerability Management

Most vulnerability management platforms excel at finding problems — but not at fixing them quickly. The result is a growing backlog of unresolved issues, missed SLAs, and heightened risk exposure. Torq delivers end-to-end, autonomous vulnerability remediation that not only identifies and prioritizes vulnerabilities but also orchestrates their resolution and verification at scale.

Built on Torq’s Hyperautomation platform, this approach connects every tool in your remediation chain — scanners, patching platforms, configuration managers, ITSM systems, and communications channels — into one coordinated, closed-loop workflow.

Automating Vulnerability Prioritization & Alert Enrichment

Raw scan results are noisy, and without context, it’s impossible to know which vulnerabilities truly matter. Torq automates this step by ingesting alerts from your vulnerability scanners (Qualys, Tenable, Rapid7, etc.) and enriching them in real time with:

Asset criticality from configuration management databases (CMDBs) and asset inventories to understand business impact.
Threat intelligence to flag vulnerabilities under active exploitation in the wild.
Business context such as asset owner, operating environment, and compliance relevance (e.g., PCI, HIPAA, SOC 2).

The outcome is dynamic, risk-based prioritization, ensuring that vulnerabilities with the highest likelihood and impact of exploitation automatically rise to the top of the remediation queue.

Orchestrating Remediation Workflows Across Teams

Finding vulnerabilities is one thing; getting them to the right people for remediation is another. Torq removes this bottleneck by:

Automatically routing tasks to the correct team: IT for endpoint patches, DevOps for container images, SecOps for misconfigurations.
Opening and tracking tickets in IT service management (ITSM) tools like ServiceNow, Jira, or Freshservice with full vulnerability details already included.
Triggering patch or config changes via SCCM, Ansible, Tanium, AWS Systems Manager, or other patching/configuration tools.
Notifying stakeholders in real time through Slack, Microsoft Teams, or email to keep everyone aligned.

This means no more manual handoffs, missed assignments, or confusion over ownership; remediation is assigned instantly and tracked from start to finish.

Continuous Verification & Closed-Loop Remediation

Vulnerability remediation doesn’t end when a patch is pushed — it ends when the fix is verified. Torq ensures that no remediation task is left incomplete by automatically:

Initiating a targeted rescan of the affected asset after remediation is applied.
Validating resolution against the original finding, ensuring that the vulnerability no longer exists.
Updating records across systems — closing tickets in ITSM, marking the issue resolved in your SIEM/XDR, and updating compliance dashboards.

With this closed-loop process, there are no lingering “open” vulnerabilities that have been patched but not verified, dramatically improving SLA adherence and compliance posture.

Building a Proactive, Scalable Vulnerability Management Program with Torq

Traditional vulnerability management is reactive — scan, report, repeat — leaving organizations chasing an ever-growing backlog of issues. Torq transforms this approach into a proactive, continuous, and scalable program that not only finds vulnerabilities faster but also remediates and verifies them without manual intervention.

Accelerating MTTR and Reducing Risk at Scale

Speed matters when it comes to vulnerabilities. Every hour a critical common vulnerability or exposure (CVE) remains unpatched increases the window of opportunity for attackers. Torq compresses mean time to remediation (MTTR) from weeks or days to hours or even minutes by:

Automating triage so the highest-risk vulnerabilities are prioritized instantly.
Orchestrating remediation directly across patch management, configuration tools, and ITSM systems.
Initiating real-time verification scans to confirm that vulnerabilities are truly fixed before closing them out.

The result is shorter exposure windows and a stronger overall security posture, all without adding headcount or burdening existing teams.

Empowering Security Teams with Autonomous Vulnerability Management

Vulnerability Management teams often spend the bulk of their time on repetitive, manual processes — parsing scan results, creating tickets, and chasing owners for fixes. Torq’s autonomous vulnerability management workflows eliminate these bottlenecks, allowing:

Analysts to focus on threat hunting, incident investigation, and security architecture improvements.
Engineers to spend more time on proactive hardening and less on reactive firefighting.
Leaders to gain real-time visibility into remediation progress and SLA compliance without chasing updates.

Why Hyperautomation is the Future of Vulnerability Management

Torq’s approach combines flexibility, scale, and intelligence into one unified platform:

No-code Security Hyperautomation for rapid deployment, allowing you to quickly build and adapt workflows without relying on development teams.
Frictionless architecture for integration with your existing scanners, patching systems, ITSM platforms, and security tools.
Cross-tool orchestration that unifies every stage of the vulnerability lifecycle — from detection to -remediation to verification — across all environments.
Real-time enforcement that triggers auto-remediation the moment a vulnerability is detected, not days later.
Enterprise-grade scalability capable of handling millions of assets and findings across global, hybrid, and cloud-native infrastructures.

With Torq, vulnerability management shifts from a reactive, report-driven process to a continuous, autonomous security function — one that reduces risk, enforces compliance, and scales effortlessly with your environment.

Vulnerability Management Tool Categories

Vulnerability Scanning and Assessment Tools

Function: These tools are the foundation of any vulnerability management program. They scan systems, networks, applications, and cloud environments to identify known vulnerabilities, misconfigurations, and outdated software. Many also integrate with compliance frameworks to flag violations against standards like PCI-DSS, HIPAA, or CIS benchmarks.

Examples: Tenable Nessus, Qualys, Rapid7 InsightVM, OpenVAS

Strength: Provide broad and deep coverage, identifying vulnerabilities across thousands of assets at scale. They can run scheduled scans, agent-based assessments, and on-demand checks, ensuring visibility into the evolving attack surface.

Weakness: While they excel at discovery, most scanners simply export reports or feed results into dashboards. Without automated triage, these findings often overwhelm security teams, creating large backlogs and slow MTTR.

Software Composition Analysis (SCA) and Application Security Testing (AST) Tools

Function: Focused on the application layer, these tools identify vulnerabilities in source code, open-source libraries, third-party components, and APIs. They help developers and DevSecOps teams catch issues early in the software development lifecycle (SDLC) before they reach production.

Examples: Snyk, Checkmarx, Veracode, SonarQube

Strength: Critical for securing the software supply chain. They integrate into CI/CD pipelines, IDEs, and code repositories to ensure vulnerabilities are addressed during build time, not after deployment.

Weakness: The outputs from SCA and AST tools often remain isolated from broader security operations. If findings aren’t funneled into unified remediation workflows, they can be lost in ticket queues or delayed until the next release cycle.

Vulnerability Intelligence and Prioritization Platforms

Function: These platforms sit on top of scanner outputs, enriching raw vulnerability data with threat intelligence, exploitability context, and asset value. The goal is to move beyond “fix everything” lists and instead direct remediation efforts toward vulnerabilities most likely to be exploited in your environment.

Examples: Kenna Security (Cisco), VulnCheck, ThreatConnect

Strength: Prioritization platforms help teams make smart trade-offs, especially in large organizations with limited patching resources. They can correlate vulnerabilities with known exploits in the wild and align remediation with business-critical assets.

Weakness: While prioritization is a huge time-saver, it doesn’t actually close the loop. Many organizations still need separate workflows and manual coordination to assign, track, and validate fixes — leading to delays in actual remediation.

Patch and Configuration Management Tools

Function: These tools take action on vulnerabilities by deploying operating system and software patches, updating firmware, or enforcing secure configuration baselines. They’re essential for ensuring that identified weaknesses are quickly and consistently addressed.

Examples: Microsoft SCCM, Tanium, Ansible, Puppet

Strength: Directly resolves vulnerabilities by updating systems or locking down insecure settings. Many also support automation, allowing patches to be deployed across thousands of endpoints with minimal downtime.

Weakness: Without direct integration into vulnerability scanning and prioritization tools, patching efforts can become reactive or incomplete. IT teams may focus on routine updates instead of targeting the most critical vulnerabilities first, leaving high-risk exposures unpatched for weeks or months.

From Findings to Fixes — Automatically

The best vulnerability management tools surface what’s wrong; Torq makes it right. By orchestrating scanners, ITSM, patching/configuration platforms, and verification in a single, no-code workflow, Torq turns noisy findings into prioritized, automated remediation with audit-ready proof. The result is shorter MTTR, smaller attack surface, and fewer backlogs, all without adding headcount.

Ready to close the loop on vulnerability management? Get our Don’t Die, Get Torq manifesto to see how to turn vulnerability intelligence into instant resolution.

Get the Manifesto

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Hyperautomation

You’re Just 90 Days Away From a Modern SOC

By Torq

August 21, 2025

6 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Forget drawn-out SOAR integrations, endless proof-of-concepts, and prolonged vendor lock-ins. Most cybersecurity teams have the tools — what’s missing is an integration platform and reliable guidance that can rapidly tie it all together and deliver tangible results.

Torq is designed precisely for that: we blend AI-native capabilities, no-code Hyperautomation, and unparalleled success enablement to transform your security operations into a fully autonomous, modern SOC within just three months.

Here’s a step-by-step timeline on exactly how Torq makes it happen.

What is a Modern SOC?

A modern SOC or next-gen SOC (Security Operations Center) is fast, flexible, and autonomous. It doesn’t rely on analysts manually chasing every alert or stitching together siloed tools. Instead, it blends:

AI-powered decision making
Real-time, automated triage and response
Integrated, end-to-end case management
No-code workflows anyone on the team can build

A modern SOC is scalable, sustainable, and proactive. And with Torq, it’s only 90 days away.

30 Days: Build the Foundation

During the first month, your primary focus will be laying the groundwork for SOC transformation. A dedicated Torq team, including a Customer Success Manager (CSM), Solutions Architect (SA), and Professional Services (PS) specialist, will collaborate closely with your team to establish the technical foundation.

You’ll begin by defining success criteria, aligning key stakeholders, configuring SSO, provisioning access, and prioritizing critical workflows such as phishing triage, endpoint detection and response (EDR), and cloud security alerts.

By the end of this initial phase, you’ll have launched your first production-ready automations, significantly reducing analyst workloads. Your team will also learn to navigate the Torq platform, interpret errors, and debug workflows. Integration with essential tools, including Slack, Jira, AWS, and Okta, will ensure a streamlined experience, enabling immediate operational efficiency and stakeholder alignment.

Key Outcomes:

Tier-1 analyst workload begins to decline
First automations deployed and delivering value
Platform familiarity achieved across the builder team
Stakeholder alignment on 90-day roadmap

60 Days: Optimize Processes and Introduce Socrates

In the second month, your automation initiatives will expand to cover advanced cybersecurity use cases, including identity and access management (IAM), threat intelligence enrichment, and monitoring suspicious user behaviors.

You’ll be introduced to Socrates, Torq’s AI-driven SOC Analyst, which orchestrates our team of AI Agents to manage Tier-1 alert triage and case enrichment autonomously. Socrates will help your team reduce noise and false positives by intelligently prioritizing alerts based on severity and context.

Throughout this period, your team will receive targeted training on modular workflow design, advanced automation logic, and effective case management practices. This training empowers your analysts to build, refine, and optimize automation workflows independently. By the end of the month, your SOC will experience faster response times, improved analyst productivity, and significantly reduced alert fatigue.

Key Outcomes:

Builder teams creating and optimizing workflows independently
Alert fatigue reduced through smarter case thresholds
Performance benchmarks established per use case
Socrates contributes measurable value in daily operations

90 Days: Achieve Full SOC Autonomy

By the third month, your SOC will transition fully into a proactive, autonomous model powered by Socrates, which will manage incident lifecycles from initial detection and triage through resolution and documentation. Analysts will shift away from manual, repetitive tasks to strategic oversight, focusing exclusively on high-priority incidents and deeper threat investigations. Performance metrics like MTTD and MTTR will be clearly defined and measurable.

As this transformative phase concludes, your team will finalize Standard Operating Procedures (SOPs), ensuring scalability, sustainability, and continuous improvement within your SOC. We’ll work with you to present a detailed QBR that highlights your measurable achievements and clear ROI to executive stakeholders.

Ultimately, you’ll reach an operational state where 100% of Tier-1 alerts are autonomously handled, significantly enhancing your SOC’s agility, efficiency, and overall security posture.

Key Outcomes:

Up to 100% of Tier-1 alerts fully automated from triage to resolution
Strategic shift in analyst focus — from reaction to oversight
Clear ROI and automation impact communicated to exec stakeholders
Platform maturity with roadmap alignment

With Torq’s AI-powered Hyperautomated workflows, end-to-end case management, and real-time triage and response — any organization can achieve the promise of full SOC autonomy. This 90 day roadmap serves as a baseline, while Torq’s dedicated team of engineers, architects, and customer success managers work with you to build out a customized deployment strategy that fit your goals, environment and needs.

And if 90 days is too long, that’s fine too — just ask Carvana: “Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts and has automated 41 different runbooks within just one month of deployment.”

See how more of Torq customers hit full autonomy in 90 days — or less.

Why Torq is Built for the Modern SOC

Multi-agent system: Torq’s multi-agent system performs autonomous triage, in-depth data enrichment, and automated logging and documentation, accelerating your security operations.

Low-code/no-code Hyperautomation: Torq’s intuitive, drag-and-drop and AI-powered automation builder with visual debugging enables quick, error-free workflow creation accessible to all skill levels.

Immediate integrations: Access 300+ pre-built integrations with security solutions (including SIEM, EDR, threat intelligence feeds, and IAM) that seamlessly connect your existing tech stack, ensuring instant operational value.

Comprehensive customer enablement: Dedicated, hands-on support teams provide guided enablement, weekly sessions, and strategic quarterly reviews tailored to your organization’s specific needs.

7 Core Capabilities of a Modern SOC — Solved by Torq

1. Threat Intelligence

A modern SOC is predictive, identifying threats before they strike by leveraging threat hunting, IOC correlation, and TTP analysis.

Torq automates threat hunting and threat intelligence enrichment across your SIEM, EDR, and threat intelligence platforms, surfacing actionable indicators and accelerating response across every workflow.

2. Continuous Monitoring

A true modern SOC operates 24/7/365, monitoring everything from cloud infrastructure to user behavior.

Torq seamlessly ingests signals across your entire attack surface and ensures nonstop alert intake, correlation, and escalation — without analyst burnout.

3. Proactive Cyber Threat Detection

Modern adversaries hide in plain sight, which is why your SOC must correlate signals across every tool.

Torq’s agentic AI and multi-tool integration capabilities enable proactive detection and response across SIEM, EDR, cloud, IAM, and beyond.

4. Incident Response Automation

Speed is everything in security operations — the longer an incident lingers, the more it costs.

Torq automates every phase of incident response — from alert triage to remediation — with AI Agents like Socrates executing workflows in seconds.

5. Post-Incident Review

Recovery from a breach isn’t enough — your SOC needs to learn, improve, and harden.

Torq automatically documents the full case lifecycle and feeds metrics into structured post-incident reviews, so your SOC evolves with every alert.

6. Reporting and Compliance

Today’s security operations center must deliver visibility and meet compliance requirements without manual effort.

Torq captures real-time data across all workflows and playbooks, outputs audit-ready logs, and maps metrics to standards like NIST, GDPR, and HIPAA.

7. Automation and Orchestration

Automation isn’t optional anymore — it’s how modern SOCs scale.

Torq’s drag-and-drop builder, 250+ integrations, and modular design let your team orchestrate workflows and auto-remediation without writing a single line of code.

Ready to Start Your SOC Autonomy Journey?

Torq is the only platform that can deliver a modern, fully autonomous SOC in just 90 days — and back it with expert support every step of the way.

Get the 90-Day Roadmap

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

Security Automation 101

The Top Benefits of Security Automation for Modern SOCs

By Torq

August 20, 2025

8 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Security operations aren’t failing due to a lack of effort; they’re breaking under pressure. As hybrid cloud environments, SaaS tools, and identity-first architectures scale, they produce more telemetry and alerts than manual workflows can realistically handle. That’s why the benefits of security automation are more than convenience.

Security automation — and increasingly Hyperautomation — is transforming modern SOC operations. By converting repetitive, manual processes into intelligent, orchestrated workflows, teams can scale incident response, reduce alert fatigue, and dramatically cut mean time to respond (MTTR).

Here’s your guide to the benefits of security automation, how top-performing teams implement it, and how Torq Hyperautomation™ enables more resilient full-lifecycle security operations.

Benefits of Security Automation

Security automation uses technology to streamline and execute repetitive security tasks — alert triage, threat enrichment, and response — without manual intervention. This leads to faster detection and response times, reduced alert fatigue, and improved analyst productivity. Automation also strengthens an organization’s overall security posture and compliance readiness by standardizing actions and ensuring full audit trails.

But the real value of security automation emerges when you look at how it transforms the everyday challenges SOC teams face. Modern SOCs aren’t breaking down because analysts lack skill or effort — they’re overwhelmed by the volume, speed, and fragmentation of today’s threat landscape. That’s where automation steps in: not as a convenience, but as the only scalable path forward.

Faster MTTD/MTTR, Reduced Alert Fatigue

Every SOC leader knows the grind of manual triage: Open an alert, pivot to logs, enrich with asset/identity context, check threat intelligence, decide next steps, document. Repeat hundreds of times per day.

Security automation tools allows for:

Parallel enrichment: Automatically attaches ownership, geolocation, recent activity, and risk context the moment an alert is generated.
Deduplication and correlation: Related alerts are collapsed into a single case with ranked observables, reducing noise and saving time.
Automated decision routing: Events are triaged based on policy and risk — either fully automated, escalated to human-in-the-loop, or closed with evidence.

In Torq, this is modeled with workflows, triggers, and steps that enrich, correlate, and act, then persist everything to cases. Features like the Query Cases step help deduplicate or bulk-operate on related cases, cutting repetitive review to near zero.

Autonomous Case Management

Ticket-based systems fragment incident response. Automated security replaces this with a case-centric approach — a single narrative that unifies alert data, context, actions, and documentation.

Torq’s case model supports:

Auto-generated cases triggered by any tool
Attached indicators of compromise (IOCs), logs, verdicts, screenshots, and analyst notes
Dynamic updates to status and assignees (via Slack or Teams)
Case querying for deduplication and threat hunting

Analysts start with a coherent, enriched narrative, not a blank page — shortening MTTI and MTTR.

Full-Lifecycle Response

Many tools advertise “automation” that ends with a ping or a basic API call. True automated security must handle the entire detection-to-resolution lifecycle:

Detect/Ingest: Collect and correlate from SIEM, EDR, cloud, identity, or email
Enrich/Correlate: Layer in asset, identity, threat intelligence, drift, and activity context
Decide: Apply policy and risk posture
Respond: Block, quarantine, reset, rollback
Verify: Recheck controls, confirm success
Document: Auto-generate case timelines with all actions and evidence

Torq orchestrates that end-to-end flow with workflows and integrations, writing outcomes back to the case and ITSM, and generating an audit-ready trail by default.

Scalable, No-Code Deployment Across Cloud/Hybrid Environments

Even the best automation strategy fails if only a handful of developers can maintain it. Security automation has to be accessible. That’s why Torq makes orchestration no-code and low-code, enabling analysts, threat hunters, and responders to build and adapt workflows without specialized programming skills.

Torq’s workflow builder includes:

Drag-and-drop steps for branching logic, loops, retries, and error handling
Integration steps and webhook triggers for event-driven execution
Workspace and SSO controls for governed access, with credentials centrally managed
Reusable subflows and templates for fast rollout across teams/tenants

With Torq, teams kick off SSO, add integrations, and start building in hours — then reuse those patterns across use cases and environments.

Continuous Compliance and Audit Readiness

Instead of scrambling at the end of a quarter or audit cycle, Torq automatically documents every action taken — from detection through remediation — in real time. This ensures a defensible, evidence-backed trail that satisfies cybersecurity frameworks like SOC 2, ISO 27001, NIST, HIPAA, and SEC requirements.

By embedding compliance into daily workflows, teams reduce audit prep time from weeks to hours while proving consistent security effectiveness to executives, customers, and regulators.

All of these benefits lay the foundation for something bigger: the evolution from basic automation to full Hyperautomation and the rise of the autonomous SOC.

The Future of Security Automation: Torq Hyperautomation and the Autonomous SOC

The future of cybersecurity automation is being written in real time, and the direction is unmistakable. Macro trends are converging: data volumes double every few years, hybrid work pushes identity management to its limits, SaaS adoption fragments IT environments, and adversaries are turning to cloud-native tactics that move at machine speed. Traditional tools and linear workflows simply can’t keep up.

What’s next isn’t just automating individual tasks — it’s security Hyperautomation: Chaining automations together across the entire security lifecycle, guided by context, risk scoring, and organizational policy. Instead of responding to one alert at a time, Hyperautomation lets SOCs orchestrate enrichment, triage, containment, and compliance in a seamless, end-to-end flow.

Layered on top is the rise of agentic AI, which doesn’t just execute instructions but actively helps coordinate, summarize, and adapt workflows. AI agents will triage thousands of events simultaneously, escalate only what truly matters, and produce instant, audit-ready case narratives. The analyst’s role shifts from being “in the loop” for every click to being “on the loop,” supervising and validating higher-risk or novel incidents.

This is the foundation of the autonomous SOC, a model in which Tier-1 is handled end-to-end by automation, Tier-2 is pre-enriched and guided by AI, and Tier-3 analysts focus on strategic hunts, detection engineering, and adversary simulation. The SOC becomes not just reactive but proactive, anticipating risks, learning from every case, and continuously improving.

Torq Hyperautomation is built for this future. Torq bridges today’s security challenges with tomorrow’s fully autonomous operations with our event-driven, multi-tenant architecture, no-/low-code and AI-generated workflow builder, and Socrates, the AI SOC Analyst. It ensures teams don’t just keep pace with cloud-speed adversaries — they set the tempo.

So how do teams put this vision into practice today? The best place to start is with repeatable, high-volume use cases that deliver fast ROI.

Hyperautomation Use Cases that Deliver Fast ROI

From phishing response to impossible travel detection to cloud drift remediation, these Hyperautomation use cases show exactly how automation translates into measurable impact.

Phishing Investigation and Remediation

Ingest user-reported emails and email-security alerts.
Extract URLs/files/headers; run threat intelligence + sandbox + domain WHOIS.
If the risk is high, quarantine messages, reset the password/session, notify in chat, and open a case with a full timeline.
Verify success: Rescan mailbox, confirm blocks, and close with evidence.

Impossible Travel Detection

Trigger on successful login events from your identity provider.
Geolocate IP, compare to the user’s last location, compute distance/speed, and apply thresholds.
If suspicious: step-up MFA or force reset, notify user and SOC, and create an incident response case.
If the user confirms legitimacy, update baselines and close.

Cloud Drift Response

Watch for configuration changes (storage policies, public exposure, encryption).
Check against policy.
Auto-remediate or open a fix ticket depending on risk level.
Verify with a targeted recheck before closing.

All three share the same winning pattern: ingest → enrich → correlate → gated action → verify → document — and all are easily implemented in Torq. These examples highlight the “what.” Now let’s talk about the “why” — why SOC teams choose Torq as their security automation platform.

Why SOC Teams Choose Torq

If you’re evaluating security automation tools, use this checklist to differentiate true systems from demo-ware:

Event-driven: Can it respond in real time across tools like SIEM, EDR, cloud, identity, email, and chat?
Case-centric: Can it group observables, context, actions, and notes into one object?
Integration-first: Does it offer both prebuilt connectors and full API flexibility?
Governed AI: Can analysts ship flows safely and at scale with retries, approvals, and error handling?
Audit-ready: Does every run persist with full execution details and outcomes for compliance?

With Torq, the answer is yes — to all of it.

Torq replaces brittle, one-off automations with platform-level resilience thanks to:

Purpose-built security and IT workflows
Case-first operations for faster triage and resolution
300+ prebuilt integrations and universal API connectivity
RBAC, SSO, and secure workspace governance
Reusable templates and subflows that scale across teams and environments

It’s not just automation; it’s scalable, secure, and enterprise-ready Hyperautomation. These benefits show that security automation is no longer just about efficiency, but rather fundamentally rethinking how SOCs operate.

From Automation to SOC Autonomy

The future of the SOC is outcome-driven, not task-driven. An autonomous SOC doesn’t just execute; it thinks, verifies, and improves. Torq makes this future real by combining secure AI, case-based reasoning, and flexible orchestration into one platform that adapts to your environment.

You don’t need to rip and replace what works. You just need to connect it.

See how Torq Hyperautomation can cut MTTR and alert fatigue in under 90 days.

Get the Roadmap

FAQs

What is security automation?

Security automation is the automatic execution of previously manual SOC processes — triage, enrichment, response, and documentation — so humans focus on decisions and edge cases, not tedious, repetitive work.

What are the benefits of security automation with Torq?

Torq security Hyperautomation delivers faster detection and response by automating triage, enrichment, remediation, and documentation, reducing MTTR from hours to minutes. With 300+ integrations and no-/low-code and AI-generated workflows, Torq unifies siloed tools and enables SOCs and MSSPs to scale without adding headcount. By reducing alert fatigue, automating case management, and ensuring audit-ready reporting, Torq improves both security outcomes and operational ROI.

How does Torq handle complex incident scenarios?

Torq enables security teams to manage complex incident scenarios through customizable no-code/low-code, and AI-generated workflows. Torq ensures streamlined handling of vulnerability management cases by allowing teams to define multi-step processes that incorporate different tools and contexts. Analysts can create tailored workflows that adapt to specific incident types, ensuring a thorough and efficient response every time.

How does Torq help with compliance and regulatory requirements?

Torq is designed to simplify compliance by automating documentation and reporting processes. Every action taken during an incident response is logged, creating a full audit trail. This automated documentation ensures you’re always prepared for audits while significantly reducing the manual workload of compiling compliance reports.

How does Torq future-proof security operations?

Torq’s architecture is event-driven, API-first, and designed to adapt to new tools and threats. As organizations evolve cloud, SaaS, and identity-first strategies, Torq ensures workflows scale without rewrites. Combined with Hyperautomation and AI, Torq positions SOCs to shift to autonomous security operations — where Tier-1 is handled entirely by automation.

What role does AI play in Torq’s platform?

Torq embeds agentic AI in the SOC to summarize cases, triage events at scale, and guide analysts through complex investigations. Instead of just automating clicks, AI adds context and decision support — turning thousands of raw alerts into prioritized, narrative-driven cases ready for human review.

Can Torq replace legacy SOAR platforms?

Yes. Torq is built as a modern alternative to traditional SOAR platforms. Torq’s no-/low-code orchestration, 300+ integrations, and agentic AI enable faster deployment, broader use cases, and easier maintenance. Organizations migrating off legacy SOARs cut operational overhead and unlock new automation and orchestration opportunities.

How does Torq support proactive vulnerability management?

Torq automates vulnerability management end-to-end. From ingesting scanner results to correlating with asset inventories, routing risk-based workflows, and triggering remediation or ticketing, Torq accelerates patching cycles and ensures consistent, audit-ready handling of vulnerabilities across environments.

How is Hyperautomation different?

Hyperautomation is automation at system scale: Many coordinated automations, governed by policy, context, and (increasingly) AI. Torq’s platform was built for this model, connecting your entire stack and enabling autonomous security operations.

How fast can we start with Torq?

Torq customers typically light up SSO, add integrations, and publish first workflows within days of onboarding, then expand by cloning patterns across use cases and business units. Torq provides a dedicated team and guidance for SSO, integrations, and workflow triggers to accelerate setup.

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI Hyperautomation Research Use Cases

Life in the SOC Sucks. Here’s How HyperSOC Can Save Us

By Patrick “PO” Orzechowski

August 19, 2025

7 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Torq Field CISO Patrick "PO" Orzechowski, SOC leader and expert

Patrick Orzechowski (also known as “PO”) is Torq’s former Field CISO, bringing his years of experience and expertise as a SOC leader to our customers. PO is a seasoned security veteran with a deep understanding of the modern security landscape. You can find him talking to SOC leaders and CISOs from major brands at cybersecurity events around the world.

You know the scene. The low hum of the servers in the server room, the cold glow of the SIEM dashboards on a wall screen, and a flood of alerts that never ends. For security teams, the promise of being on the frontlines of digital defense often crumbles into a daily grind of alerts, tickets, and long shifts that leave even the best analysts exhausted. If you’ve ever felt like the job is more about being a cog in a perpetual motion machine than hunting actual threats — you’re not alone.

The good news? Security automation isn’t here to replace analysts. It’s here to make the job worth doing again by taking on the tedious work that burns people out and slows SOCs down.

Below are some of the most common pains in the SOC, and how Torq HyperSOC ™ can make a real difference thanks to advanced case management, Hyperautomated workflows, and a collaborative AI SOC Analyst.

The Seven Levels of SOC Hell (and How to Escape)

“In my opinion, working at a SOC was either a joke or absolute hell with little in between.”

– SOC analyst on Reddit

1. The Eternal Fires of False Positives

The Pain: A recent survey found that nearly 60% of SOC leaders and practitioners simply have too many alerts. You’re forced to chase ghosts — an IoT device beaconing to a Russian IP, a routine software update flagged as a command-and-control server. The system is designed to generate noise, and you’re the human filter.

The Torq HyperSOC Fix:

Automated enrichment adds context to alerts before they ever hit your queue, shutting down the noise at its source.
Automated scoring and filtering ensure you only see what really matters.
Known false positives are closed automatically.

The Result: The ghost alert from the IoT device is auto-closed with a ‘known benign’ tag, a silent monument to a waste of time that never happened. Your existence is no longer defined by chasing shadows — instead, your time is spent investigating and remediating real, critical alerts that arrive in front of you with enrichment and context baked in.

2. Shift Handoffs: The Art of Getting Screwed at 6:59 am

The Pain: Ah, the shift handoff — always leaves you spending more time piecing things together than moving cases ahead. The previous analyst leaves a few vague notes, a trail of breadcrumbs leading to nowhere, and you’re left to figure out where to go next with the incomplete investigation you just inherited. The system rewards individual survival, not collective success.

The Torq HyperSOC Fix:

AI-generated case summaries capture every step of the investigation.
Automated playbooks enforce consistency across shifts.
Socrates, the AI SOC Analyst, provides a clear, factual summary of the overnight events, stripped of human error or forgetfulness, ensuring consistency in perpetuity.

The Result: You arrive at your terminal to an AI-generated summary of every event that clearly shows where every investigation stands and every action taken, so you can get up to speed fast. It’s like having a personal scribe who never sleeps and never forgets.

3. Customer Interactions: Between a Rock and a Clueless Place

The Pain: You are the frontline dealing with customers who don’t know their own networks. You may be the final authority, but you’re forced to babysit interactions with customers who clog up the queue by opening priority one (P1) tickets for their own phishing tests.

The Torq HyperSOC Fix:

AI chatbots act as a faceless, tireless Tier-1 interface, deflecting the mundane back-and-forth.
Context-aware automation automatically suppresses and closes known test alerts, silencing the false alarms before they ever reach your queue and ensuring that your only interaction is with real threats.

The Result: The system identifies a simulated phishing attack and closes the ticket without you ever seeing it. The only time you’re involved is when a confirmed critical issue requires your attention.

4. Alerts Have Names, You Don’t

“Alert fatigue is killing us. We get hundreds of alerts daily and 90% are false positives… The worst part is the one time you ignore an alert, thinking “probably another false positive,” ends up being the real deal. Meanwhile, management keeps asking why we’re not investigating every single alert faster. Like yeah, let me just clone myself real quick.”

– SOC analyst on Reddit

The Pain: You feel like a cog in the machine. Your victories are anonymous, your failures are public, and you feel like you’re always one missed alert away from catastrophe. The system tracks tickets, but it doesn’t track you.

The Torq HyperSOC Fix:

Intelligent dashboards track analyst contributions, making your value visible to leadership.
Generative AI summarizes major incidents and assigns credit, giving you a name for your actions.
Efficiency and accuracy get measured, proving your worth beyond a simple ticket count.

The Result: You crack a complex credential stuffing campaign and, instead of a generic resolution, the AI-generated incident report lists your exact actions. You finally get credit for the work they do — and managers see the value you bring.

5. Death by Ticketing System

The Pain: The ticketing system can feel like a labyrinth designed to slow you down, a complex flow of queues and reassignments that delays real action. You’re trapped in a digital bureaucracy.

The Torq HyperSOC Fix:

Seamless integrations between your ticketing system and detection tools automates the flow of tickets and information.
Tickets are routed efficiently and instantly to the right queue.
AI summarization condenses log evidence into clean notes, eliminating the need for manual record-keeping.

The Result: A misclassified ticket that once took 45 minutes to reassign is now routed in 4 seconds. The system now serves you.

6. Burnout Is a Feature, Not a Bug

The Pain: The constant pressure, the endless stream of alerts, the cognitive fatigue of sorting the signal from the ocean of noise. The system isn’t just prone to burnout — it makes it practically inevitable.

The Torq HyperSOC Fix:

AI-driven triage drastically reduces the number of low-value alerts you have to touch.
Socrates handles 90% of Tier-1 grunt work and auto-remediates 9% of Tier-1 cases — freeing you for more interesting, creative security work.

The Result: A colleague, on the verge of breaking under alert fatigue, now has a system that filters out the low-value noise. Theis gives them breathing room and the bandwidth for engaging, higher-value investigations.

7. So Why Stay? (Or Why You Left)

The Pain: Over half of SOC analysts say stress on the job has made them consider walking away. The promise of a rewarding career became a reality of data overwhelm and endlessly copy-pasting data between windows — and they chose freedom.

The Torq HyperSOC Fix:

Automation doesn’t replace analysts; it removes the parts of the job that made it unbearable.
Automation gives you time to focus on genuine threats and your own career development.
AI empowers you to focus on high-level risk, not the mundane, repetitive tasks.

The Result: You almost left last year, but after Torq HyperSOC was implemented, you now have time to lead threat-hunting sessions. You’re still here — but now you’re a threat hunter, not a human alert filter.

Don’t Die: Get the Manifesto

The SOC grind is real. But there is a way to survive — by using Torq’s AI-driven HyperSOC to regain control. Let’s stop talking about alert fatigue and start redesigning the SOC to be more sustainable and, dare we say, human.

Find out how Torq HyperSOC combats the three core areas of unsustainable pressure in SOCs — across your people, your strategy, and your business impact.

Get the Don't Die manifesto to learn how HyperSOC solves SOC analyst challenges and pain points

Get the Manifesto

SEE TORQ IN ACTION

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

News & Events Research

SANS 2025 SOC Survey: SOCs in Slow Motion

By Torq

August 18, 2025

7 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

The SANS 2025 SOC Survey is a reality check: despite years of investment in shiny new tools and all the talk of AI and automation, most security teams are stuck in firefighting mode, drowning in unstructured data, and burning out talent.

The tools may be new, but under the hood, most SOCs still struggle with the same structural issues they were five years ago: reactive workflows, manual processes, and underwhelming AI adoption. This isn’t a technology shortage — it’s an execution failure.

Without strategic change, your SOC’s maturity progress will stay stalled. So what’s the fix?

The 5 Critical SOC Failures in 2025

1. Reactive, Alert-Triggered Response

According to the SANS 2025 SOC Survey, 85% of SOCs primarily trigger incident response from endpoint alerts, rather than proactive detection. The report notes that even what’s labeled “threat hunting” is often just retroactive analysis, not true, hypothesis-driven investigation. While most SOCs have plentiful threat intelligence available, it’s often left on the shelf or used unevenly. The result: teams stay trapped in reactive mode, moving only after the alarm sounds — when the attacker already has a head start.

2. Data Dumping Without a Plan

42% of SOCs shove all incoming data into a SIEM, with no plan to retrieve or analyze it. This “visibility strategy that risks collapsing under its own weight” creates a major challenge for analysis and response. Investigations slow down, visibility drops, and SIEM costs explode — all while real threats hide in the noise. Not to mention that SOCs are paying to hoard all of that unused clutter.

3. Underperforming AI Adoption

42% of SOCs are rolling out AI/ML tools “out of the box” with zero customization — and AI/ML tools ranked at the bottom of the satisfaction list. Without tuning and integration, it’s just another underutilized expense. This unmanaged adoption means that a significant portion of AI is used without being part of defined security operations, turning a promising technology into a source of frustration, wasted budget, and added risk.

4. Manual, Time-Consuming Reporting

69% of SOCs still report SOC metrics manually — and nearly half say it’s too time-consuming. Analysts spend hours compiling data for reports instead of chasing threats. Leadership gets stale data, and optimization efforts stall.

5. A Retention Crisis

Although talent shortages remain a top challenge for SOCs, a staggering 62% of SOC pros say their organization isn’t doing enough to keep top personnel. The most common tenure for SOC staff is only 3-5 years. That’s your most valuable skilled asset walking out the door because they’re burned out, bored, or both. Without providing clear career paths and meaningful work, you’re just training people for their next job somewhere else, which creates a constant cycle of recruitment and loss of institutional knowledge.

How Torq HyperSOC Solves the SOC Nightmare

The SANS SOC Survey data doesn’t just show where SOCs are stuck; it points to what’s missing: strategic automation and integrated AI that actually executes. With an agentic AI-driven AI SOC Analyst and Hyperautomated case management, Torq HyperSOC™ turns SOCs from reactive to autonomous, freeing security teams from mundane, repetitive tasks for more strategic work.

How HyperSOC solves the key SOC challenges from the SANS 2025 SOC Survey

1. Proactive Detection, Faster Response

Thanks to full-stack integrations, Torq HyperSOC collects and analyzes data from XDR, SIEM, EDR, and other security platforms, automatically correlating alerts and enriching them with internal and external threat intelligence. Automated workflows can escalate, contain, and remediate threats immediately, including sandboxing suspicious files or URLs when deeper analysis is needed.

Analysts spend less time manually digging through logs and more time on high-value investigations, while observables, relationship tracking, and automated case management help shrink mean time to detect (MTTD) and mean time to respond (MTTR) and scale expert-level threat hunting across the enterprise.

2. Clear Out the Noise

Torq ingests, analyzes, and organizes data, intel, and alerts from across your entire security stack. Leveraging Hyperautomated workflows and agentic AI, Torq enables security teams to operationalize data regardless of where it is being stored. Automated workflows parse through endless SIEM logs, bubbling up only the most important events, while AI Agents autonomously triage, enrich, and create high-value, fully contextualized cases.

This gives organizations the freedom to reduce SIEM costs by offloading mass data dumps into more cost-efficient next-gen data lakes, while Torq acts as the glue in the middle — normalizing and correlating data from multiple sources, without impacting existing processes or sacrificing security data gaps for cost-savings.

3. Deeply Embedded Agentic AI That Works for You

Standalone AI tools lack the visibility to connect alerts, enrich context, and provide meaningful insights. Torq’s agentic AI is deeply embedded in our platform, which acts as the connective tissue across your security stack, correlating data, surfacing insights, and accelerating response actions at scale. Much like onboarding a new human analyst to the security team, each AI Agent is given clear roles, objectives, access to a specific set of tools necessary to complete their task, and is instructed to use historical context to better understand how various use cases are typically handled within the organization.

Torq gives security leaders the flexibility to tailor agentic AI to fit seamlessly into the organization as a finely tuned force-multiplier, a fatigue-resistent expert analyst, or simply an extra set of helping hands.

4. Instant, Automated Reporting

Torq dashboards give security leaders a real-time view of key metrics like incident resolution times, case closures, productivity gains, and cost savings, so teams can measure the impact of their security operations and automation efforts.

With an intuitive and completely customizable drag-and-drop interface, dashboards are easy to create, track trends, and export for deeper analysis, all without manual configuration or coding. Role-based reports can instantly generate executive-ready dashboards — no analyst effort required.

5. A Better SOC Day-to-Day

The autonomous SOC doesn’t replace analysts; it empowers them. By automatically triaging, contextualizing, and investigating alerts, Torq HyperSOC removes the constant reactive grind and frees security teams to focus on meaningful, strategic, and creative work they joined the field to do, like threat hunting, detection engineering, and deep analysis.

This not only makes analysts more engaged and more likely to stay — reducing turnover — but also boosts efficiency by eliminating wasted time on grunt work and rote tasks.

Torq HyperSOC is the first solution we’ve seen that effectively enables SOC professionals to mitigate issues including alert fatigue, false positives, staff burnout, and attrition. We are also impressed by how its AI augmentation capabilities empower these staff members to be much more proactive about fortifying the security perimeter.”

– Chris Kissel, Vice President, Security & Trust Products, IDC Research

Shift Your SOC into High Gear

The SANS 2025 SOC Survey makes it clear that progress in most SOCs isn’t stalled because they lack tools — it’s stalled because those tools aren’t integrated, automated, or built for action.

Torq HyperSOC replaces fragmented workflows, disconnected data, and manual bottlenecks with integrated, end-to-end, AI-driven Hyperautomation across the SOC. It’s how you stop chasing alerts, start hunting threats, and defend at scale. In other words: the SOCs that break free from react-mode will be the ones that automate the busywork and apply their human talent where it matters most.

Don’t die. Learn how HyperSOC saves security teams, transforms strategy, and proves business impact.

Get the Manifesto

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Hyperautomation

Everything You Need to Know About the AI SOC

By Bob Boyle

August 15, 2025

9 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Security operations are getting faster and more complex, and the AI SOC is the operating model built for that reality. It pairs agentic AI with governed automation to reduce MTTR, expand coverage, and eliminate manual work.

This FAQ answers the strategic questions leaders are asking — and shows how Torq HyperSOC™ makes an AI-powered SOC real in production.

What is an AI SOC?

An AI-powered SOC is a security operations center that leverages artificial intelligence to automate processes, enhance threat detection, accelerate incident response, provide contextual insights, and optimize resource allocation — resulting in greater efficiency and accuracy, improved decision-making, faster time to remediation, and a more proactive security posture.

How does legacy SOAR stack up to an AI SOC?

Legacy SOAR automates known, repeatable workflows using static rules and triggers — great for predictable incidents but limited when facing new or complex threats. An AI SOC uses agentic AI to ingest data, understand context, and dynamically decide the best action, even learning from past cases.

Torq HyperSOC™ is the next evolution of security operations — an autonomous SOC platform that fuses the speed and consistency of automation with the adaptive intelligence of AI. It goes beyond static playbooks to dynamically detect, investigate, and remediate threats in real time, enabling faster, smarter, and more self-sufficient security operations.

There’s a lot of AI in the SOC. What’s the difference?

Here’s a quick decoder for AI in the SOC:

GenAI writes and structures content from prompts — think incident summaries and draft runbooks.
Agentic AI goes further: it plans and executes multi-step actions across tools in real time.
An AI Agent is a specialist for specific functions.
A multi-agent system (MAS) runs many specialists in parallel for triage, investigation, containment, and case management.
An OmniAgent is the conductor that orchestrates them all.

Inside Torq HyperSOC™, GenAI drafts cases and workflows; single-purpose agents handle enrichment and remediation; the MAS (Runbook, Investigation, Remediation, Case Management Agents) works in concert; and Socrates, the AI SOC Analyst, serves as the OmniAgent, autonomously prioritizing and remediating threats.

What use cases should I automate first in my AI SOC?

Start with high-volume, high-impact workflows — then expand.

Endpoint Detection & Response (EDR): Auto-isolate hosts, kill processes, trigger sweeps, and generate incident reports.
Email Security / Phishing: Quarantine messages, detonate attachments/URLs, purge across mailboxes, and force password/MFA resets.
Identity & Access (IAM): Respond to impossible travel/MFA changes, suspend risky accounts, rotate credentials, and orchestrate just-in-time access.
Threat Intel–Driven Triage: Auto-enrich IOCs, risk-score alerts, suppress noise, and escalate only what matters.
Cloud: Remediate misconfigurations, rotate secrets, and enforce policy drift fixes across AWS/Azure/GCP and major SaaS.
Case Management & ChatOps: Open/update Jira/ServiceNow, capture evidence/timelines, and execute approvals directly in Slack/Teams with full auditability.

With Torq HyperSOC™, customers typically lead with EDR, phishing, and IAM. They reduce MTTR immediately and remove the most manual effort from Tier-1.

What is Torq HyperSOC?

Torq HyperSOC is Torq’s AI-driven autonomous SOC — a cloud-native security operations platform that fuses agentic AI with Hyperautomation to handle the full incident lifecycle, from detection to triage, investigation, and remediation, with minimal human intervention.

How does Torq’s multi-agent system work?

At the top of Torq’s multi-agent system is Socrates, our agentic AI SOC analyst. Socrates orchestrates and collaborates with four key AI Agents:

Runbook Agent: Converts natural language into automated workflows, accelerating response creation with zero code.
Investigation Agent: Automatically analyzes alerts, enriches them with context, and uncovers root causes in seconds.
Remediation Agent: Executes corrective actions across integrated systems, resolving incidents autonomously.
Case Management Agent: Tracks, prioritizes, and summarizes every incident in real time for full visibility and accountability.

These AI Agents work in parallel, share context in real time, and coordinate decisions through a central “decision” agent. Analyst feedback continuously refines their performance, enabling HyperSOC to operate like a fully staffed SOC team, only faster and with the consistency of automation.

How well does Torq’s AI SOC integrate with my existing tools, workflows, and compliance requirements?

If it can communicate, Torq can connect to it… and then automate it. Torq is designed to bring your entire security ecosystem into one Hyperautomated, responsive workflow engine. Its integration flexibility is unmatched due to:

300+ pre-built integrations: Unified within Torq’s Hyperautomation platform, from SIEMs and EDRs to cloud, identity, threat intel, and beyond.
4,000+ ready-to-use steps: Out-of-the-box automation actions tied directly to those integrations.
Customizable via AI or no-code/low-code UI: Expand your stack effortlessly with new, managed connections.
Compliance-ready automation: Every workflow execution is fully logged with inputs, actions, and results in an audit-ready format, supporting frameworks like SOC 2, ISO 27001, GDPR, and more.

Security Domain	Sample Tools
Endpoint Detection & Response	CrowdStrike, SentinelOne
SIEM & Log Management	Splunk, Microsoft Sentinel, QRadar
Threat Intelligence	Recorded Future, VirusTotal, MISP
Identity & Access Management	Okta, Atrix, Azure AD, OneLogin
Cloud Security	Wiz, Orca Security, AWS Security Lake
Email Security & Phishing	Abnormal Security, Proofpoint
Collaboration & Response Tools	Slack, Teams
DevOps & Infrastructure	Jira, ServiceNow
Custom & Legacy Systems	Any tool with API, CLI, SSH, or custom code

How do I create a new integration in Torq if it’s not available in the integration library?

If the integration you need isn’t in Torq’s library, you can create it yourself as a custom integration. In the Integrations section of the Build menu, select Create New Integration. Provide a name, description, and any required connection details such as API endpoints, authentication credentials, or tokens. After saving, your new integration becomes available for use in workflows just like any built-in connector.

*Need a new integration? Build it yourself in minutes. Torq lets you easily create custom integrations for any tool.*

How does Torq’s AI ensure accuracy and avoid false positives or missed threats?

At Torq, accuracy starts with context-rich decision-making. Our AI SOC Analyst, Socrates, doesn’t operate in isolation — it ingests alerts, telemetry, and threat intelligence from across your entire integrated stack, then enriches every signal with historical incident data, asset context, and external intelligence before deciding.

We use policy-based guardrails to ensure that autonomous actions only occur when confidence is high, and outcomes are fully traceable in the case timeline. When uncertainty exists, the AI escalates with all enrichment already attached so that human analysts can make rapid, informed decisions.

To continuously improve, Torq incorporates closed-loop learning — every analyst disposition feeds back into the system, refining enrichment logic, detection thresholds, and automated playbooks. This combination of broad context, defined guardrails, and iterative learning drastically reduces false positives while ensuring no high-priority threat slips through unnoticed.

How does Socrates, Torq’s AI SOC Analyst, decide when to escalate an incident to a human analyst?

Socrates follows a confidence-plus-impact model when determining escalation. Every alert it processes is enriched, analyzed, and scored against three dimensions:

Detection confidence: How certain is the AI that the activity is malicious, based on correlation with threat intel, historical patterns, and contextual signals?
Potential business impact: Does the incident involve critical assets, privileged accounts, sensitive data, or high-value targets?
Policy thresholds: Has the organization defined this type of event as always requiring human review, regardless of confidence?

If confidence is high and the action falls within pre-approved automated response parameters (e.g., blocking a known malicious IP, disabling a confirmed compromised account), Socrates executes autonomously.

If confidence is low, the incident is ambiguous, or the potential impact is high-risk, Socrates escalates immediately, attaching:

Full enrichment context
Mapped MITRE ATT&CK techniques
Recommended next steps based on prior outcomes

This ensures analysts receive a ready-to-act case file instead of a raw alert, accelerating decisions while keeping human oversight where it matters most.

How fast can I get up and running with Torq?

Most teams can ship their first live automations the same day they connect tools, see measurable MTTR reduction in week one, and mature to a policy-governed, AI SOC by day 90.

Here’s what the typical Torq onboarding looks like:

Connect your tools: Using Torq’s pre-built connectors for your SIEM, EDR, IAM, cloud providers, and threat intel feeds, you can establish integrations in minutes without writing code.
Import or customize playbooks: Start with Torq’s library of ready-to-use workflows (incident response, phishing triage, compliance evidence collection, etc.) and tailor them to your environment.
Deploy automation: Trigger workflows from alerts, chat commands, schedules, or APIs to handle real incidents right away.
Optional AI activation: Turn on Socrates for autonomous investigation, enrichment, and response with customizable escalation rules.

How much time are customers saving with Torq HyperSOC?

Customers using Torq HyperSOC are saving hours every single day. It starts with faster mean-time-to-assignment (MTTA), as HyperSOC automatically prioritizes alerts and generates fully enriched security cases.

Then comes accelerated mean-time-to-investigation (MTTI), powered by third-party threat intelligence seamlessly integrated into every case. Finally, mean-time-to-remediation (MTTR) is slashed — thanks to Socrates, who auto-remediates up to 95% of Tier-1 security incidents without human intervention.

See how Torq customers from major brands have accelerated their SecOps >

What kind of support and community does Torq offer its customers?

Torq has a robust Knowledge Base, Torq Academy, Torq Community, and dedicated Customer Success Managers to support your journey. There’s also a growing ecosystem of partners and solution engineers. Torq provides guided onboarding, workflow templates, and expert help from engineers and success teams to help you get your first automations live quickly.

Is there a HyperSOC demo available?

Yes. You can request a live demo at torq.io/demo, and, in some cases, access trial environments depending on your evaluation needs. You should also bookmark our Events page because we often run live virtual demos!

Request a Demo Today

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI Customers Research Use Cases

Hyper-AUTO-Mation: Why Carvana’s CISO Bet on Agentic AI for 5x SOC Efficiency

By Patrick "PO" Orzechowski

August 13, 2025

7 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

CISOs everywhere are feeling the AI fatigue. Every vendor at Black Hat 2025 was hyping ‘AI agents for SecOps,’ so there’s rightfully a lot of skepticism about deploying AI in production, especially in enterprise environments.

But the old way of running a SOC just isn’t working anymore. After all the time and money spent on traditional playbooks, we’re still wrestling with the same challenges: alert fatigue, burnout, tool sprawl, and inability to scale. It’s time for a new approach — but what does that actually look like in the very real, often messy world of the SOC?

Dina Mathers, CISO of Carvana, is a leader who’s fearlessly challenging the status quo with an AI-first SecOps strategy in a Fortune 500 environment. I recently moderated a Black Hat 2025 session with her, where she shared her insights from the front lines of Carvana’s modern, AI-powered SOC.

Below are her key takeaways for any security leader considering (or concerned about) adopting AI.

The Business Case for AI in SecOps

Staffing a full 24×7 security operations center is expensive and doesn’t scale well. And, as Dina noted, “the SOC grind is real… and it’s tough.” In a traditional SOC, analysts are constantly triaging and responding to alerts from disparate security tools — and a lot of events are just noise. Analysts have to hop between multiple screens and dashboards to figure out what’s real and what’s impactful.

“Who wants to spend their time doing that?” Dina asked the audience. She also pointed out how inefficient it is to have human analysts spending their time on mundane, repeatable tasks that can be automated, such as responding to phishing emails or documenting cases. The leaner the team, the more these inefficiencies hurt, slowing down response and increasing risk exposure.

That’s why Dina says that, from her perspective, it’s a “no-brainer” to leverage AI to offload the Tier-1 and Tier-2 alert triage, so her team can focus on more critical and strategic work.

“Leveraging AI [in the SOC] seemed to me like a no-brainer. There’s a very strong use case to use AI for your traditional security operations to start. Then, you can grow from there.”

– Dina Mathers, Carvana CISO

The Carvana AI Adoption Playbook

For Carvana, AI isn’t just a buzzword — it’s core to their business and security strategy. While Carvana is a Fortune 500 company, it operates with a startup mindset, which means they move fast and are willing to adopt AI rapidly. But Carvana also underpins their AI-first strategy with a methodical and governance-focused approach designed to ensure security and alignment with business goals, including:

Establishing a cross-functional task force: Carvana has an AI task force with stakeholders from legal, information security, data governance, and engineering. This group meets bi-weekly to review new use cases and ensure a unified approach.
Starting with a clear business case: The first step when evaluating a proposed AI solution is to ask, “What is your actual use case?” This prevents teams from buying new AI tools just for the sake of shiny new toys to experiment with. The process also includes checking if an existing, sanctioned tool can fulfill the need to avoid “shadow AI” or redundant technologies.
Engaging legal and security early: When a business case is confirmed, Carvana spins up a POC and works with the legal team to ensure proper contractual documentation, such as a data protection agreement or information security amendment. A security review of the third-party vendor is also conducted in parallel to ensure the tool meets their standards.
Adopting a ‘crawl-walk-run’ approach: When deploying Torq’s AI SOC Analyst, Carvana started with a human-in-the-loop model, allowing the AI to triage lower-risk cases by following a defined runbook, then having a human analyst review the AI’s conclusions before a remediation or closure action was taken. Taking baby steps initially allowed Carvana to build trust and comfort in the AI’s ability to perform consistently over time as they slowly expanded the scope of tasks they assigned to the AI, such as having the AI ask end users questions over Slack in order to close out a case.

“Within one month of deploying HyperSOC, we had 41 of our runbooks created and we started assigning cases to Socrates, the AI SOC Analyst. But we used a ‘crawl-walk-run’ approach so we could say, ‘We’re comfortable with the AI Analyst triaging, but not with it remediating or closing out an incident yet.’ So we had a human in the loop from the beginning.”

– Dina Mathers, Carvana CISO

The Real-World Impact of Torq’s Agentic AI

Carvana’s Torq HyperSOC implementation delivered tangible results beyond simple automation.

100% Tier-1 and Tier-2 Triage Automation

Torq’s AI SOC Analyst now triages 100% of Carvana’s Tier-1 and Tier-2 security events, acting as an extension of their lean team. This has transformed the day-to-day work for their security team, which can now focus on higher-value work and operate at the effectiveness of a team five times larger.

Improved Team Morale and More Strategic Focus

Automating repetitive tasks has led to a happier, more engaged security team. Team members can focus on strategic projects like deploying new technologies and improving the overall security posture, instead of just monotonous triage.

Expanded Use Cases Beyond the SOC

There are also many use cases beyond the SOC that agentic AI can help with, such as automating onboarding and offboarding workflows and reducing tech debt by automatically disabling inactive service accounts. Carvana uses Torq to identify lost or stolen endpoints to ensure that the assets are properly updated in their configuration management database (CMDB) and that the assets are removed from disparate endpoint tools.

Dina shared, “Although we made the decision to invest in the AI SOC Analyst initially just to triage the security events, what we’re finding is there are so many more use cases beyond the traditional security operations center. I would implore you to check out Torq, honestly. There are so many use cases, so you don’t have to go get another agentic AI for some other purpose-built solution — you could standardize all of your automation using Torq’s agentic AI.”

“[With Torq], we have materially improved our operations. We’ve dramatically reduced the cost of operating a security operations center to the point where we can reallocate those funds to different technologies that we need.”

– Dina Mathers, Carvana CISO

Watch Now: Dina Shares More Insights

The Torq team had the chance to catch up with Dina ahead of her Black Hat 2025 session. Watch the interview now!

The Final Takeaway: Don’t Be the Department of ‘No’

Dina closed her on-stage session by challenging security leaders to embrace AI rather than be skeptical: “Don’t be the Department of ‘No’. Lean into AI. Try it out.” Just as Carvana disrupted car sales by automating the misery out of buying a car, their embrace of agentic AI in the SOC is automating the misery out of life in the SOC.

Dina also shared that she finds the limitless horizons of AI exciting. “What’s crazy about AI adoption is that your imagination is what’s limiting it. The tool can do anything you tell it to do.”

Want to see how Torq HyperSOC can transform your SecOps?

Get a Demo

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI Hyperautomation News & Events

Black Hat 2025: Grave Digger, Agentic AI, and… SOC Goblins?

By Britt Wittfeldt

August 7, 2025

5 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Torq’s mission at Black Hat 2025 was simple: go big or go EVEN BIGGER.

Yes, Grave Digger was in the booth again — but the real show-stopper that kept attendees around was our agentic AI-driven Torq HyperSOC™ demo. Oh yeah, and our Junior Media Intern Trevor was seen wandering around Las Vegas with a new furry, yellow frenemy…. more on that later.

Here are all the Black Hat highlights.

The Pre-Show Buzz: AMP, AI Internships & Fortune Top 50

Torq kicked off the week before Black Hat with a big reveal: a new Alliance & Momentum Partner (AMP) Program, with launch partners including Google Cloud Platform, Wiz, NVIDIA, Zscaler, Astrix, Intezer, Panther, Sweet Security, and more. Forget pay-to-play tiers and red tape. The Torq AMP program provides the go-to-market muscle, marketing firepower, and joint solution innovation to move beyond basic integrations and create the world’s leading ecosystem of agentic AI cybersecurity expertise.

“For years, integrations were treated as check-the-box activities, such as basic API connectors or one-way data flows. But security teams don’t need more connectors. They need outcomes. That’s where Torq AMP comes in. It gives partners a direct path to operationalizing agentic AI through real-world solutions, not just theoretical ideas.”

– Eldad Livni, Torq Co-Founder and CIO, in Channel Futures

Torq also announced a new nationwide AI internship program in partnership with AI4ALL. The program pairs underrepresented college students with hands-on experience in real-world cybersecurity and AI projects at Torq. Forbes described how “it goes beyond just job shadowing or résumé building. Interns will be mentored by Torq’s R&D and AI leadership teams while contributing directly to product innovation.”

To top off the pre-show spotlight, Torq was named one of Fortune’s Top 50 Cybersecurity Companies of 2025.

LinkedIn Votes: Best Booth at Black Hat 2025

What does a monster truck have to do with security operations? NOTHING AT ALL, BUT WHO CARES? IT’S FREAKIN’ GRAVE DIGGER! Oh, and also because Torq is on tour nationwide with Monster Jam® — RSVP for your city here!

The LinkedIn-osphere lit up with post after post after post calling Torq “the best booth at Black Hat”. (And “wicked”, “coolest”, “my first stop”, “killer”, “awesome”, and “the bomb”… We could keep going but we’re already blushing.)

The Hottest Demo in Cybersecurity

Grave Digger may have turned heads, but it was our demo that kept security pros hanging around Torq’s booth.

Torq HyperSOC™ is the AI-native autonomous SOC purpose-built to crush the SOC’s biggest challenges and pain points. HyperSOC integrates with your full security stack to automate, manage, and monitor critical SOC responses at machine speed to clear out Tier-1 grunt work and free your team to focus on critical threats.

The Torq platform was recognized as one of the “most feature-rich platforms” in Software Analyst Cyber Research’s comprehensive new 2025 AI SOC Industry Report from Francis Odum and Rafal Kitab. Torq stood head and shoulders above for delivering “notable improvements in detection and response” with an “extensive feature set” that goes beyond traditional SOC scope. (Francis loved our Black Hat booth ❤️, BTW.)

Want to see Torq HyperSOC in action and ask all your questions? Attend our half-hour live virtual demo. Save your spot.

Hyper-AUTO-Mation: Why Carvana’s CISO Bet on Agentic AI for 5X SOC Efficiency

Dina Mathers, CISO at Carvana, joined Torq’s Field CISO Patrick “PO” Orzechowski on stage to discuss her experience in applying Carvana’s AI-first mindset to the SOC “not just in talk but in actual execution” by becoming an early adopter of Torq HyperSOC.

With a lean team, Dina knew her SOC couldn’t afford the analyst burnout that comes with the mundane, repetitive low-level work of triaging alerts and hopping across screens to respond. “Who wants to spend their time doing that?” she asked the audience.

Dina explained how the Fortune 500 company “now legitimately has 100% of our Tier-1 and Tier-2 security events triaged by our [Torq] AI SOC Analyst that’s basically an extension of our team” — dramatically reducing costs and boosting team morale by allowing them to focus on strategic work. Ultimately, Dina’s message to other CISOs was simple: “Let’s not be the Department of ‘No’. Lean into AI. Try it out.”

“Leveraging AI seemed to me like a no-brainer…. We have materially improved our operations. We’ve dramatically reduced the cost of operating a security operations center to the point where we can reallocate those funds to different technologies that we need.”

– Dina Mathers, Carvana CISO

WTF Was That Furry, Yellow Thing?

Did you see the SOC Goblin at Black Hat and wonder “what the heck is that?” Turns out, 96% of security operation centers have a SOC Goblin lurking in the corner slowing down MTTR and burning out analysts — and they don’t even know it. Luckily, Torq can make SOC Goblins ✨disappear✨. Learn how.

This particular SOC Goblin was kickin’ it at Black Hat 2025 with our Junior Media Intern Trevor as he tried to get a SOC du Soleil show off the ground. (Don’t ask). Check out their misadventures from traveling across the country in a van to arriving in Vegas to causing a scene.

Agentic AI in the SOC That’s Real

Agentic AI was THE buzzword of Black Hat 2025 and it seems like every vendor has their own AI Agent for SecOps. But there’s a big difference between marketing hype and actual AI in production handling real-world use cases in Fortune 500 environments. Torq Co-Founder and CEO Ofer Smadari recently sat down for a video interview with BankInfoSecurity to share how Torq’s autonomous AI agents accurately resolve threats at scale.

Want to see Torq’s agentic AI in action? Request a demo. And learn more about how Torq HyperSOC saves your SOC with our new manifesto.

Get a Demo

Get the Manifesto

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

Contents

Get a Personalized Demo

Why Torq Built on NVIDIA AI

Inside the Torq Phishing Defense Architecture with NVIDIA

Orchestration in Practice with config.yaml

1. Tools and Agents Defined as Functions

2. LLMs Powered by NVIDIA NIM

3. VerdictAgent as the Final Judge

Spear-Phishing Detection in Action

Real-World Impact

Building AI Security That Learns and Scales

Related Articles

Hyperautomation Transforms MSSP Cybersecurity Trends in 2026

AMP’d Season 1: Building the AI SOC, Partner by Partner

Torq’s New Security Milestones: BSI C5 & ISO 42001 Certifications

Ready to automate everything?

Contents

Get a Personalized Demo

Other Vendors Build Features. Torq Builds the Foundation.

AI is Only as Useful as Where It Lives

Most Vendors Promise Outcomes. Torq Delivers Infrastructure.

1. AI decisions are explainable.

2. Human feedback is instantly integrated.

3. Automation logic is entirely customizable via a visual no-code editor.

Enterprise-Grade Infrastructure That Goes Beyond Detection and Response

Not Another Tool — A True Operating Layer

Choose the Platform That Makes AI Work

Related Articles

You’re Just 90 Days Away From a Modern SOC

Life in the SOC Sucks. Here’s How HyperSOC Can Save Us

Everything You Need to Know About the AI SOC

Ready to automate everything?

Contents

Get a Personalized Demo

What Are Vulnerability Management Tools?

Vulnerability Management Tools

How Torq Automates Vulnerability Management

Automating Vulnerability Prioritization & Alert Enrichment

Orchestrating Remediation Workflows Across Teams

Continuous Verification & Closed-Loop Remediation

Building a Proactive, Scalable Vulnerability Management Program with Torq

Accelerating MTTR and Reducing Risk at Scale

Empowering Security Teams with Autonomous Vulnerability Management

Why Hyperautomation is the Future of Vulnerability Management

Vulnerability Management Tool Categories

Vulnerability Scanning and Assessment Tools

Software Composition Analysis (SCA) and Application Security Testing (AST) Tools

Vulnerability Intelligence and Prioritization Platforms

Patch and Configuration Management Tools

From Findings to Fixes — Automatically

Related Articles

Hyperautomation Transforms MSSP Cybersecurity Trends in 2026

AMP’d Season 1: Building the AI SOC, Partner by Partner

Torq’s New Security Milestones: BSI C5 & ISO 42001 Certifications

Ready to automate everything?

Contents

Get a Personalized Demo

What is a Modern SOC?

30 Days: Build the Foundation

60 Days: Optimize Processes and Introduce Socrates

90 Days: Achieve Full SOC Autonomy

Why Torq is Built for the Modern SOC

7 Core Capabilities of a Modern SOC — Solved by Torq

1. Threat Intelligence

2. Continuous Monitoring

3. Proactive Cyber Threat Detection

4. Incident Response Automation

5. Post-Incident Review

6. Reporting and Compliance

7. Automation and Orchestration

Ready to Start Your SOC Autonomy Journey?

Related Articles

How Valvoline Hyperautomated Their SOC in Just One Week

Hyper-AUTO-Mation: Why Carvana’s CISO Bet on Agentic AI for 5x SOC Efficiency

The MSSP Hyperautomation Playbook: How HWG Sababa Doubled SOC Output

Ready to automate everything?

Contents

Get a Personalized Demo

Benefits of Security Automation

Faster MTTD/MTTR, Reduced Alert Fatigue