AI AI SOC News & Events

Torq’s New Security Milestones: BSI C5 & ISO 42001 Certifications

By Aner Izraeli

December 5, 2025

3 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Aner Izraeli is the Chief Information Security Officer (CISO) at Torq. He leads Torq’s cybersecurity strategy with a focus on innovation and resilience. Aner’s career spans over two decades in the cybersecurity field, where he has consistently demonstrated expertise in SIEM/SOC, incident response, and network security.

We’re proud to announce that Torq has recently completed two important milestones in our security and AI governance journey: German BSI C5 certification and ISO 42001:2023 certification.

These achievements reflect the same principle that guides our platform development every day — pairing cutting-edge AI innovation with the operational rigor enterprises expect. As our capabilities expand across Hyperautomation, agentic AI, and multi-tenant SOC operations, we continue to invest heavily in the foundations that keep the platform resilient, secure, and dependable at scale.

These new certifications join our existing SOC 2 Type 2, HIPAA, and ISO 27001 compliance frameworks, and reflect our ongoing commitment to delivering a platform that stays secure, governed, and dependable as customers scale.

Raising the Bar for Secure, Enterprise-Ready AI

Our customers rely on Torq for mission-critical security operations, and they expect a platform that stays resilient under pressure.

These certifications help us show — independently and transparently — that we meet rigorous standards for security, reliability, and responsible AI practices. These certifications validate not only the strength of our architecture but also our ongoing commitment to continually improve every aspect of the platform, enabling customers to trust Torq with their most sensitive workflows.

Why Do These Certifications Matter for Modern Security Operations?

German BSI C5: Proving Operational Security at Enterprise Scale

BSI C5 verifies the strength of our operational security foundation. It assesses how we secure and manage the infrastructure that supports Torq HyperSOC™, including:

Secure system configuration and hardened environments
Access control and identity management
Continuous monitoring of systems and workloads
Robust vulnerability and patch management
Structured incident detection and response processes
Strong data protection and privacy safeguards

For customers running large, distributed, or highly regulated environments, BSI C5 signals that Torq is built to operate securely at scale — and engineered to stay that way.

ISO 42001: The Global Standard for Responsible, Well-Governed AI

ISO 42001 is the first global standard for responsible AI operations. It confirms that Torq’s AI capabilities operate within a tightly governed lifecycle, covering:

AI risk management and accountability
Transparent and explainable AI practices
Model lifecycle governance (design → development → deployment → review)
Protections against bias and unfair outcomes
Data quality controls for AI systems
Human oversight of automated deBSIions

It reflects our commitment to building AI that is not only powerful, but safe, reliable, and aligned with the expectations of modern enterprises.

What This Means for Torq Customers

Becoming an ISO 42001 and BSI C5 certified company is an important step forward, and we’re not stopping here. As Torq continues to expand capabilities across AI SOC operations, we remain committed to:

Delivering innovation without compromising stability
Building AI systems that are explainable, governed, and secure
Maintaining a platform foundation that is resilient, mature, and ready for enterprise scale
Following the industry’s strongest operational and compliance standards

Our mission is to give customers technology that moves fast — on top of an operational backbone built to last.

Torq’s new certifications strengthen the same foundation highlighted in the latest GigaOm SecOps Automation Report, where Torq is recognized as a market Leader. See why our secure, multi-agent, enterprise-grade platform outperforms legacy SOAR.

Get the Radar

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI Hyperautomation MSSP

MDR vs MSSP: Why AI and Automation Are the Only Differentiator that Actually Matters

By Torq

December 20, 2025

9 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

TL;DR

MDR (Managed Detection and Response) is a specialized service focused on active threat hunting, incident containment, and hands-on response — ideal for teams that need someone not just to alert, but to act.
MSSP (Managed Security Service Provider) is a broader service that covers security infrastructure management, monitoring, and compliance — best suited for mature internal teams that need broad coverage and operational support.
Both models share the same core limitation: manual processes create response bottlenecks that slow down triage, investigation, and containment — regardless of how good the analysts are.
AI SOC automation and Hyperautomation close that gap — enabling MDRs and MSSPs to triage faster, scale without adding headcount, and deliver measurably better outcomes for their clients.

Anyone who’s evaluated security services has been there — staring at a slide deck and trying to make sense of whether they need managed detection and response (MDR) or a managed security service provider (MSSP). The acronyms often get used interchangeably, and it’s easy for the lines between them to blur.

MDRs and MSSPs are designed for fundamentally different needs. Choose the wrong fit, and you can end up with coverage gaps that adversaries love to exploit.

In this blog, we’re going to get into what MDR vs MSSP actually mean for your day-to-day SOC operations, where each model breaks down, and why the real differentiator in 2026 isn’t which acronym you pick — it’s whether your managed security setup is built on top of real Hyperautomation.

What is Managed Detection and Response (MDR)?

MDR is a specialized, outcome-focused security service. The mandate is narrow and deep: find threats, validate them, and stop them — fast. MDR providers embed their team into your environment, hunt for threats your tools might miss, and take hands-on action when something’s confirmed.

The keyword is response. MDR doesn’t just tell you the house is on fire. They show up with the hose.

MDR emerged as a direct answer to a real problem: organizations were drowning in security tooling that generated enormous volumes of alerts but required significant human expertise to act on them. MDR providers fill that gap by bringing the analysts to you.

What MDR Services Typically Include

A mature MDR offering typically includes:

24/7 threat monitoring and analysis: Continuous human-led review of your environment, not just automated rule triggers
Proactive threat hunting: Analysts actively searching for indicators of compromise before an alert fires
Incident containment and response: Hands-on remediation, including host isolation, account suspension, and malware removal
Forensic investigation: Root cause analysis after an incident, so you understand the full scope
Threat intelligence integration: Operationalizing current adversary TTPs directly in your environment
Endpoint Detection and Response (EDR) management: Active management and tuning of your endpoint tooling

What is a Managed Security Service Provider (MSSP)?

An MSSP is a broader, foundational security service. Where MDR goes deep on detection and response, an MSSP goes wide — managing your security infrastructure, ensuring your tools are running, and monitoring for events across your environment.

Think of an MSSP as the organization responsible for keeping your security stack healthy and for reviewing your logs. They’re your managed security operations partner for the long haul: compliance reporting, device management, vulnerability scanning, and security monitoring at scale.

MSSPs became the dominant model for enterprises that needed security coverage but didn’t have the headcount to staff a full internal SOC. They bring breadth. They bring coverage. They bring operational continuity.

What they traditionally haven’t brought — and this matters — is deep, hands-on incident response. When an MSSP flags an alert, the ball usually goes back to your team to run it down.

What MSSP Services Typically Include

A full MSSP engagement typically covers:

Security monitoring and SIEM management: Logs aggregation, correlation, and alerting across your infrastructure
Firewall and network device management: Configures, patches, and optimizes
Vulnerability management: Regularly scans, prioritizes, and reports
Compliance support: Helps meet regulatory requirements (e.g., SOC 2, PCI-DSS, HIPAA)
Identity and access management support: Monitors privileged accounts and access anomalies
Patch management: Coordinates remediation across your environment

MDR vs MSSP: Operational Differences For Your SOC

The surface-level pitch for both services sounds similar: “We’ll handle your security.” However, the operational reality is very different. If you’re running or building a SOC, you need to understand exactly what you’re getting before making a decision.

Proactive Threat Hunting vs. Reactive Alerting

Here’s the core operational distinction: MSSPs focus on scalable, rules-driven monitoring. Their strength is applying well-defined detection logic to large volumes of activity, ensuring consistent coverage for known threats and established attack patterns. It’s an effective model for organizations that need broad, foundational security monitoring.

MDR providers layer in active threat hunting — looking for anomalies, subtle indicators of compromise, and behaviors that don’t fit neatly into predefined rules. This adds a proactive dimension of detection coverage, especially for more complex or evasive techniques.

But even the best MDR providers are bottlenecked by human processes. Even after an analyst identifies a threat, the investigation, escalation, and response chain still involve significant manual steps. Mean Time to Respond (MTTR) takes a hit every time a human has to make a decision, write a ticket, and wait for approval. In a real incident, those minutes matter.

The 2025 IBM Cost of a Data Breach Report shows that faster response times directly correlate with lower breach costs. Human-led response, even excellent human-led response, has a ceiling.

The Cost and Scope of Management

MSSPs are generally priced by device or seat — a more predictable, infrastructure-tied cost model. That breadth comes at a lower per-function cost, making MSSPs attractive for organizations that need wide coverage across a complex environment.

MDR commands a premium. You’re paying for human expertise, continuous analysis, and active response capability. The trade-off is worth it for organizations that need genuine incident response capability but don’t have the internal team to deliver it.

The scope question matters too:

MSSP = wide coverage, security infrastructure management, monitoring, alerting. Your team still owns the response.
MDR = deep detection and response, threat hunting, hands-on containment. Your team retains control of broader security infrastructure.

Neither model is complete on its own. And for both models, the operational bottleneck is the same: manual processes slow everything down.

Why MDR and MSSP Both Hit the Same Wall

Here’s what nobody in the managed security space loves to say out loud: both models have a scaling problem.

MSSPs are managing more devices, more alerts, and more compliance requirements than ever — with analyst teams that aren’t growing fast enough to keep up. The result is alert fatigue, slower triage, and coverage gaps that only get worse as environments grow.

MDR providers face the same pressure from a different angle. The human-led threat hunting and response that makes MDR valuable is also what makes it expensive and hard to scale. Every new customer adds analysts to the queue. Response speed — the whole value proposition — degrades as volume increases.

Both models are fundamentally constrained by the same thing: manual processes at the core of their operations.

This is where AI SOC automation changes everything. By automating the high-volume, repetitive work — alert triage, enrichment, initial investigation, containment actions — AI-powered Hyperautomation removes the bottleneck that limits both MDR and MSSP performance. Analysts stop spending so much of their time on noise and start spending it on the threats that actually require human judgment.

For MDR providers, that means faster response times and the ability to take on more customers without burning out their team.

For MSSPs, it means transforming from a monitoring-and-alerting operation into one that can deliver a genuine automated response, closing the gap that traditionally separates them from MDR.

The managed security providers pulling ahead of the market right now are the ones who figured out how to make their analysts dramatically more effective through automation.

Choosing the Right Model: Leveraging Hyperautomation With Torq

Here’s the framework CISOs actually need when making this decision.

Go with an MSSP if: Your internal security team is mature and well-staffed. You need broad coverage for security infrastructure management and compliance. You have analysts who can run down alerts and handle management.

Go with MDR if: Your internal team is lean or early-stage. You need someone else to not just alert you, but actually respond. You’re dealing with sophisticated threats that require continuous hunting, not just rule-based detection.

But here’s what neither choice solves on its own: The SOC staffing shortage isn’t going away. Cybersecurity Ventures estimates that millions of cybersecurity roles are unfilled globally — and that gap is putting pressure on every managed security model. MDR analysts burn out. MSSP analysts miss alerts. Alert fatigue is real regardless of who’s handling your queue.

So how do you win? Build Hyperautomation into your security operations layer — so that when an alert fires, the triage, enrichment, and initial response happen at machine speed, not human speed.

Maximizing MDR and MSSP Value With Hyperautomation

Whether you’re evaluating an MDR, an MSSP, or a hybrid model, the ceiling of that investment is determined by how much of the work is still manual.

When assessing providers, look for those that leverage AI SOC capabilities to ensure the capacity and response speed your environment demands. Providers built on Hyperautomation — automating alert triage, enrichment, and response workflows — can dramatically cut MTTR and handle higher alert volumes without the constraints of manual scaling. That translates directly into better, more efficient service: broader coverage, faster response, and analysts focused on decisions that actually require human judgment rather than repetitive, high-volume triage work.

That’s the model Torq’s AI SOC is built on — an autonomous SOC approach where the repetitive, high-volume work runs at machine speed, freeing up your MDR or MSSP team’s analysts to spend their time where it matters most.

The Proof is in the Performance

Check out how MSSPs are using Torq Hyperautomation today:

HWG Sababa, a leading European MSSP, deployed Torq to automate their SOC workflows — and the results weren’t incremental. They scaled their operations, improved response times, and differentiated their service offering in a crowded market.

Bloomreach deployed Torq and automated workflows that eliminated manual triage steps, freeing their security team to focus on what actually requires human judgment.

If you’re evaluating managed security providers right now, the question to ask every vendor is: “How automated is your response workflow, and what does your automation layer look like?”

The providers who can answer that question clearly — and demonstrate it — are the ones worth talking to. The rest are selling you a human-hours model in a machine-speed threat environment.

Ready to find out why the best MSSPs are using Hyperautomation?

Get the Managed Services Manifesto

FAQs

What is the difference between MDR vs MSSP?

MDR (Managed Detection and Response) is a specialized security service focused on active threat hunting, incident investigation, and hands-on response. An MSSP (Managed Security Service Provider) is a broader service that manages security infrastructure, monitors for events, and delivers compliance support. The key operational difference: MSSPs alert you to threats — MDR providers respond to them directly.

What is MDR vs MSSP vs SIEM?

A SIEM (Security Information and Event Management) is a technology platform that aggregates and correlates log data to generate alerts. An MSSP often manages and operates a SIEM on your behalf. MDR goes further — layering human-led threat hunting and active incident response on top of detection tooling. SIEM is the tool; MSSP is the managed service around your infrastructure; MDR is the specialized response capability.

What is the difference between MDR and XDR?

XDR (Extended Detection and Response) is a technology platform that unifies detection and response data across endpoints, networks, cloud, and identity into a single view. MDR is a managed service — a team of analysts who use tools like XDR (or EDR, SIEM, and others) to hunt threats and respond on your behalf. XDR is what you buy. MDR is who operates it.

Should I choose MDR or MSSP for my organization?

It depends on your internal team’s maturity. If you have a strong internal security team and need broad infrastructure management and monitoring coverage, an MSSP is likely the right fit. If your team is lean and you need someone to handle active threat hunting and incident response end-to-end, MDR fills that gap. That said, neither model fully solves the scaling challenge on its own — organizations getting the most from both are layering AI SOC automation on top to eliminate manual bottlenecks and accelerate response times.

Can MDR and MSSP services be combined?

Yes. Many organizations run a hybrid model — an MSSP for broad infrastructure monitoring and compliance, with MDR for specialized detection and response on high-value assets or critical environments. The risk with a hybrid approach is operational complexity: two providers, two escalation paths, and potential overlap or gaps in coverage. Hyperautomation can help unify those workflows by orchestrating triage, routing, and response across both services through a single automation layer.

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Hyperautomation Integrations

Reco + Torq: Dynamic SaaS Security, Fully Automated

By Bob Boyle

December 4, 2025

5 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Torq AMP spotlights the partners redefining what’s possible in security operations. Each partner brings a unique strength that seamlessly extends Torq’s autonomous SOC platform. Together, these partnerships help SOC teams achieve speed, accuracy, and scale that were once out of reach. Explore the future of SOC in the AMP’d Sessions video series.

Modern security teams are wrestling with a new kind of sprawl — one built not on endpoints or networks, but on SaaS. Identity drift, over-permissioned apps, AI tools, and unchecked data access create thousands of risks every day. Most incidents now start with who has access to what, not malware on a machine. And with SaaS adoption surging across every department, the attack surface expands faster than any manual control can keep up.

In Episode 6 of the AMP’d Sessions, we sat down with Todd Wilson, Head of Global Channels and Alliances at Reco, to show how organizations are tackling one of the hardest problems in security today: SaaS access risk. From shadow AI tools to over-permissioned apps to sensitive data movement inside platforms, the attack surface has shifted from endpoints to identities.

Through this integration, Reco maps the movement and Torq fixes it. Together, they turn messy SaaS environments into precise, governed, autonomous workflows.

Reco: Identity-Driven SaaS Visibility for the Modern SOC

SaaS is now the largest attack surface most companies have — and usually the least monitored. AI tools accelerate adoption even further, stacking identity drift, risky permissions, and shadow AI usage faster than humans can track.

Reco solves this by giving security teams deep, identity-first visibility across every SaaS app in use. That includes:

Full discovery of all sanctioned and unsanctioned SaaS and AI apps
Mapping who has access to what and whether that access is justified
Identifying risky permission sets, API scopes, and OAuth grants
Tracking data movement inside platforms like Google Drive and Microsoft 365

Enterprises often have more than 2,000 AI apps in active use, many granted through social logins, with wide-open access to sensitive data. That visibility alone changes the conversation — but visibility without action just moves the problem.

That’s where Torq comes in.

How the Reco + Torq Workflow Works

When Reco detects a high-risk SaaS access event — a suspicious AI app connection, abnormal permission grant, or data exposure — it sends that signal straight into Torq HyperSOC™. From there, agentic AI takes over.

Here’s the full flow as demonstrated in the AMP’d episode.

1. Reco Flags a Risky SaaS Access Event

In the demo, Reco identifies a user connecting Claude.ai to their corporate Google Drive — a risky action depending on the user’s role, data access, and organizational policy.

Reco enriches the event with identity context:

Who the user is
What they attempted to connect
What data the app is requesting
Whether the app is sanctioned, unsanctioned, or unknown
The user’s data exposure profile (PII, sensitive files, etc.)

Reco surfaces shadow AI usage and unsanctioned app connections instantly, giving security teams clear, identity-level visibility into who is using what and with what permissions.

2. HyperSOC Takes Over with Automated Validation and Policy Checks

Torq receives the Reco alert and triggers a Hyperautomated workflow that:

Pulls Google Workspace identity and group data
Checks for pre-approved AI app
Looks for personally identifiable information (PII) exposure tied to the user
Evaluates the request against business policy
Automatically revokes the connection if it violates policy

When Reco flags a high-risk SaaS event, Torq automatically pulls app details, sets context, and initializes an approval workflow without analyst intervention.

3. Socrates Investigates

If the case requires deeper investigation, Socrates, Torq’s AI SOC Analyst, steps in and:

Queries Reco for additional identity and permission detail
Summarizes risk in natural language
Writes a full AI-generated case summary
Suggests next-best actions aligned with internal policy

Torq turns the Reco signal into a structured case, mapping context, indicators, and risk so analysts see a complete, ready-to-act picture in seconds.

4. Autonomous Remediation

If the access request isn’t inherently malicious but needs validation, Torq handles it with a workflow that:

Opens a case
Notifies the user’s manager in Slack
Summarizes the risk and context
Asks for approval or denial
Logs all decisions in an immutable timeline

Once a decision is made:

If denied: Torq revokes the connection, restricts the user, and sends a notification.
If approved: Torq removes restrictions and allows the app connection automatically.

Torq loops the stakeholders into the decision, enriches the case with identity context from Reco, and documents every step for a fully audited SaaS access approval process.

Every step is consistent, policy-aligned, and documented. What once took hours of email back-and-forth now happens in minutes — or, in some cases, no time at all, if autonomous closure is enabled.

“What could have taken 8 hours of research is now 15 minutes. So if an analyst has to get involved — which most likely they don’t have to — it’s 15 minutes or zero.”

– Todd Wilson, Head of Global Channels and Alliances at Reco

Better Together: Torq + Reco

The Reco + Torq partnership gives security teams something they’ve never had before: identity-driven SaaS visibility and instant, autonomous control.

Together, we deliver:

Identity-driven context on every access risk
AI-to-AI triage and investigation across Reco and Torq
Autonomous remediation that enforces policy at scale
Repeatable business workflows for approvals, restrictions, and access requests
End-to-end auditability of all decisions and automated actions

Watch the full Reco + Torq AMP’d Session to see it in action.

Watch Now

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI SOC Hyperautomation Use Cases

Torq HyperAgents™: The Next Evolution of Agentic SecOps

By Tal Benyunes

December 3, 2025

9 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Tal Benyunes was one of the first engineers at Torq and now leads Product for HyperAgents™, Torq’s agentic AI initiative. Shaped by early career roles in mission-critical cybersecurity environments and leading companies, Tal brings deep technical expertise and strategic insight to the development of AI Agents. Today, Tal combines that engineering background with product strategy to shape the future of intelligent automation for Torq customers.

Security teams are drowning in alerts, processes, and telemetry coming from tool sprawl. Every SOC leader knows the pain: repetitive triage, endless enrichment steps, communication loops with employees and stakeholders, and constant ticket-handling overhead. Humans are left acting as interpreters between tools instead of focusing on real threat investigation.

The result: bottlenecks, burnout, missed alerts… and massive inefficiency.

AI is now shifting this paradigm. Instead of static workflows that only follow deterministic logic, we are entering the era of agentic security operations driven by adaptive AI Agents, working alongside your staff, and capable of reasoning, communicating, and taking action.

This is where Torq HyperAgents™ comes in.

Our Solution: Torq HyperAgents™

Since announcing a private preview of Torq HyperAgents at Black Hat USA 2025, we have worked closely with key design partners at Fortune 500 enterprises, including CISOs, SOC leads, and security engineers, to forge and refine a new approach to SecOps automation.

The result is a breakthrough capability that moves security automation beyond painstaking workflow assembly into thinking, adaptive operations — no more wiring workflows for every edge case. Instead, HyperAgents operates like a skilled analyst working alongside your staff.

Purpose-built for security operations, HyperAgents is a group of transparent, autonomous, customizable AI Agents that transform SecOps workflows. It reasons, makes decisions, and takes action. It executes security tasks end-to-end, not as scripted steps but as reasoned operations that understand context and adapt to diverse use cases and evolving conditions.

Each AI Agent of HyperAgents is composed of three main components:

Instruction and guidance that define the agent’s mission, boundaries, and goals.
- Instruction: What the agent must accomplish
- Guidance: How it should behave, escalate, and prioritize
The AI model: The intelligence powering the agent — interpreting instructions, applying context, and generating actions or decisions based on patterns and real-world data.
The AI Agent toolbox: A set of tools, APIs, actions, and integrations the agent can use to execute tasks across your security stack.

The IOC Enricher AI Agent uses its toolbox of integrations like VirusTotal to gather context and deliver structured intelligence.

What Makes HyperAgents Different?

HyperAgents is described by the following characteristics and designed to operate within multi-agent architectures where several coordinated agents reason, communicate, and take action together:

Customizable to match the customer’s specific environment and security policies
Security-oriented with guardrails, audits, and reasoning baked in
Easy to use with natural language configuration and tools management
Transparent and accountable so you see how and why decisions are made, with full audit trails and guardrails that keep HyperAgents reliable in enterprise environments

HyperAgents extracts and enriches every IOC automatically, mapping each indicator to the right tool for investigation.

Why HyperAgents Matters

HyperAgents represents the next evolution of Torq’s vision for the AI SOC, a world where humans and AI collaborate seamlessly, infusing intelligence into traditionally static workflows.

As the number of detection tools grows, so do the flood of events and alerts. With increasing complexity and volume, security operations teams struggle to keep pace, often constrained by limited time and talent.

HyperAgents changes that narrative altogether, equipping SOC teams with cutting-edge tech that delivers SecOps at scale. It works alongside your human experts, taking on repetitive tasks, analyzing context, and pivoting at machine speed. As such, Torq HyperAgents is a force multiplier that redefines how modern SOCs operate.

By automating the repetitive and mundane tasks traditionally handled by Tier 1 analysts – such as enrichment, normalization, correlation, and triage — HyperAgents gives your SOC analysts the time they need to focus on what really matters: deep investigations, threat hunting, and advanced detection engineering.

How HyperAgents Works

HyperAgents orchestrates intelligent security operations through an iterative loop. Here’s how.

Tool Interaction

As shown on the left side of the diagram above, the HyperAgents AI Agent interacts with various SOC tools and platforms, including identity systems, messaging platforms, and security products, to gather the necessary information. It then processes and normalizes the data so that it can be used in a clear, structured manner. This ensures that every step is based on up-to-date contextual information rather than static, predefined logic.

LLM-Driven Reasoning

As shown on the right side of the diagram above, HyperAgents collaborates with an LLM to inform its reasoning. HyperAgents generates a constructed query that incorporates the situation, available tools, and relevant prior context. The LLM returns an execution plan detailing what to do next, which tool to call, and what parameters to use. HyperAgents then carries out those actions, evaluates results, and loops as needed until the task is complete.

Core Elements of Torq HyperAgents

Multi-Stage Reasoning

HyperAgents breaks down the mission into deliberate steps. Analyzing signals, weighing options, and determining the best next move at each stage. It uses short-term memory to retain context and learn from prior actions, ensuring every decision builds on the last and drives consistent, goal-oriented outcomes.

The execution flow shows HyperAgents’ chaining reasoning and tool calls to investigate alerts end-to-end without manual intervention.

Total Customizability and Bring Your Own AI Models

We’ve seen tremendous demand for a wide variety of AI model options — from providers like OpenAI, Google Vertex, Anthropic, and AWS Bedrock, to models such as GPT, Claude Sonnet, and Gemini — enabling users to leverage the best model for each specific task. There’s also a growing need to use internal AI model subscriptions. Customers want to utilize their own AI models to gain greater flexibility and ensure security. HyperAgents is designed to support exactly that level of flexibility.

Templates Library

Torq’s template library provides ready-to-use HyperAgents AI Agents that accelerate deployment of intelligent, security workflows.

Torq offers a collection of ready-to-use HyperAgents AI Agents designed to deliver immediate value for security operations teams. These templates provide a strong starting point for customization, allowing teams to operationalize HyperAgents while learning from proven best practices quickly. They help users accelerate adoption, adapt workflows to their needs, and draw inspiration when tailoring HyperAgents to their specific needs.

What Makes Torq HyperAgents Unique?

While other “AI automations” in the market still rely on static workflows dressed up with LLM prompts, Torq HyperAgents contains autonomous operational entities, each with:

Contextual reasoning
The ability to communicate and gather information in real time
Built-in transparency mechanisms and compliance guardrails
Its own memory and state logic

This is adaptive security operations, not linear automation.

HyperAgents in Action: EDR Alert Triage

Use Case: Automated security alert triage and decisioning

Triage is one of the team’s core missions, to rapidly make high-quality conclusions about whether an alert is malicious or not. It is also known all too well to be a manual and repetitive task.

One of the most common use cases for HyperAgents is to automate triage missions. Below, we outline how HyperAgents can help.

Processes that are traditionally manual and repetitive — such as enriching IOCs related to an alert, collecting and exchanging data about the alert, and opening a case with all relevant details — can now be done effortlessly using just three easy-to-use and easy-to-maintain HyperAgents AI Agents.

This workflow shows how a CrowdStrike® alert triggers a multi-agent sequence across Torq HyperAgents, moving from enrichment to communication to SOC decisioning, then completing the case automatically.

Step 1: Enrichment AI Agent

The EDR triage agentic workflow shown above includes a source (EDR) trigger, in this case from CrowdStrike. The Enrichment AI Agent is provided instructions on its role, objective, and available tools at its disposal. Its job is to:

Identify device logs, network traces, historical alerts, and IOCs
Normalize and correlate the data
Interpret suspicious activity
Pass structured intelligence to the next AI Agent

The Enrichment AI Agent reviews raw alert data, pulls user, device, and IOC details from integrated tools, and produces a structured summary that sets the foundation for downstream triage.

Step 2: Communication AI Agent

The Communication AI Agent takes input from the Enrichment AI Agent, and then:

Reaches out to the relevant employee for clarification
Provides structured questions and response validation
Handles back-and-forth messaging without analyst involvement

Any SOC analyst reading this blog may already be rejoicing. With this mundane data collection taken off their plate, they can work on other tasks that they otherwise would not have time to address. The end result? HyperAgents expands the bandwidth and productivity of your existing staff.

Once the Communication AI Agent has gathered the information required according to its instructions and role, it passes the data along to the Decisioning & Ticketing AI Agent in the next step.

The Communication AI Agent sends contextual Slack messages to users, validates their responses, and feeds structured answers back into the investigation without analyst involvement.

Step 3: Decisioning & Ticketing AI Agent

With full context, this Decisioning & Ticketing AI Agent:

Determines severity and recommended next steps
Creates an incident ticket with complete evidence
Attaches enriched observables and artifacts
Closes benign alerts automatically with clear reasoning

The Decisioning & Ticketing AI Agent analyzes all enriched evidence, assigns severity, creates a case with observables, and closes low-risk events while notifying the SOC with the full audit trail.

The result: The EDR alert triage completes in minutes, not hours, with complete explanatory detail readily available.

The IOC Enrichment AI Agent extracts file hashes, IPs, domains, and URLs, selects the right tools, and generates a structured IOC report used in downstream decisioning.

We place strong emphasis on logging and auditing to create a trusted AI experience. Every action, including the reason, timing, and details, is recorded, allowing for review and export on demand.

The execution log captures HyperAgents’ final reasoning, tool calls, and case actions, providing a complete audit trail for an alert resolved as a false positive.

HyperAgents: The Operational Core of Torq HyperSOC™

Torq HyperAgents represents the next evolution of security automation — security workflows that don’t just execute, but reason. By infusing agentic intelligence directly into SecOps’ daily work, HyperAgents drives operational efficiency, simplifying workflows and transforming manual processes to scalable, adaptive, AI-driven operations. Bottlenecks are eliminated, and human judgment and oversight remain intact.

Agentic SecOps combines the best of human expertise with AI-augmented, agentic workflows. This amplifies productivity and reduces risk at scale. Torq HyperAgents is the foundation on which this future SOC is being brought to life today.

For more on Torq’s HyperSOC™ platform, explore the 2025 GigaOm Autonomous SOC Radar Report.

Get the Report

FAQs

What is the difference between traditional SOAR and HyperAgents in SecOps?

Traditional SOAR platforms execute static, script-based playbooks — predefined sequences that follow deterministic logic and break when conditions change or vendor APIs update. HyperAgents are autonomous AI agents that reason through problems, adapt to context, and execute multi-step security workflows end-to-end without requiring a playbook for every scenario. Where SOAR requires dedicated engineering resources to build and maintain each workflow, HyperAgents use natural language instructions, LLM-driven reasoning, and a toolbox of integrations to investigate, communicate, and act — then loop and adapt until the task is complete. Valvoline’s legacy SOAR required hard-to-find coding skills and stalled on integrations for months; after switching to Torq, integrations that had been blocked were delivered in days.

How do HyperAgents handle complex multi-step security incident response?

HyperAgents break down each mission into deliberate stages using multi-stage reasoning. In a typical EDR alert triage, three coordinated agents work in sequence: an Enrichment Agent identifies device logs, network traces, and IOCs, then normalizes and correlates the data. A Communication Agent reaches out to the affected employee via Slack or Teams with structured questions, validating responses without analyst involvement. A Decisioning and Ticketing Agent then analyzes all enriched evidence, determines severity, creates a case with observables attached, and either closes benign alerts automatically with clear reasoning or escalates to a human analyst. Each agent retains short-term memory and context from prior steps, so every decision builds on the last. The entire process completes in minutes, not hours.

What types of security processes can HyperAgents automate without human intervention?

HyperAgents are designed for the repetitive, high-volume work that buries SOC analysts: IOC enrichment and correlation, alert triage and disposition, user verification and communication loops, case creation with full evidence chains, and automated closure of low-risk events with documented reasoning. For higher-severity or novel threats, HyperAgents complete the investigation and present structured findings for human review — so analysts start with a fully assembled case rather than a raw alert. Kenvue is automating 89% of cases using Torq’s platform and achieved a 60% decrease in MTTR within two months of deployment.

How do HyperAgents integrate with existing security tools and SIEM platforms?

Each HyperAgent has access to a toolbox of APIs, actions, and integrations across your security stack. Torq supports 300+ native integrations and 4,000+ out-of-the-box actions — covering SIEM (Splunk, Sentinel, QRadar, Elastic), EDR (CrowdStrike, SentinelOne), identity providers (Okta, Entra ID), cloud platforms (AWS, Azure, GCP), ITSM (Jira, ServiceNow), and communication tools (Slack, Teams). HyperAgents also support bring-your-own AI models from providers like OpenAI, Google Vertex, Anthropic, and AWS Bedrock — so organizations can use internal model subscriptions for greater flexibility and security. When Kenvue’s customized IT environment blocked a native Jira integration, Torq deconstructed and rebuilt it to fit their constraints.

What are the key benefits of agentic SecOps compared to rule-based automation?

Rule-based automation executes the same steps in the same order regardless of context — and breaks when conditions change. Agentic SecOps, powered by HyperAgents, introduces contextual reasoning, real-time communication, adaptive decision-making, and built-in transparency. HyperAgents don’t just follow instructions — they interpret context, select which tools to query based on the situation, gather additional information when needed, and adjust their approach based on results. Every action is logged with full reasoning for audit and compliance. The practical difference: rule-based automation handles the scenarios someone anticipated and wrote a playbook for. HyperAgents handle the rest.

How quickly can organizations see ROI from implementing HyperAgents?

ROI is measured in days, not months. Valvoline saw operational value within 48 hours of deploying Torq, saving six to seven analyst hours per day by automating phishing triage that previously consumed up to 12 hours daily. Kenvue went from kickoff to production in six weeks and hit their end-of-year automation goals in six months. Torq’s template library of ready-to-use HyperAgents AI Agents accelerates deployment further — teams can operationalize proven workflows immediately while customizing to their specific environment over time.

What security use cases show the highest success rates with HyperAgents?

The highest-impact use cases are the ones that combine high alert volume with repetitive, multi-step investigation patterns. EDR alert triage is the most common starting point — the blog’s walkthrough shows how three coordinated agents handle a CrowdStrike alert from enrichment through communication to case closure. Phishing response is another high-success use case: Valvoline automated end-to-end phishing triage including inbox monitoring, cross-tool correlation, and automated containment when users click malicious links. Case management and evidence assembly also deliver strong results — Kenvue’s team now goes “ten layers deeper” into investigations because HyperAgents handle the initial data collection and triage automatically, freeing analysts to focus on the work that actually requires human judgment.

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Hyperautomation Security Automation 101

How Agentic AI Security Is Shaping the Future of Cybersecurity

By Torq

December 16, 2025

11 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

The modern Security Operations Center (SOC) is no longer just busy; it is also increasingly complex. There is exponentially more data, more tools, and more attack surfaces than any human team can reasonably cover. The initial industry response — hiring more analysts to stare at more dashboards — doesn’t cut it anymore.

The first wave of AI adoption offered promise, but most deployments simply filled the SOC with chatbots and co-pilots. These tools explain alerts and summarize logs, but they do not act. They wait and assist only when prompted.

The future of the SOC isn’t about AI that talks; it’s about AI that independently acts, decides, plans, and executes security operations with minimal human intervention. This is the era of agentic AI security, and we’re only getting started.

Understanding Agentic Security in Modern Cybersecurity

What is Agentic AI Security?

Agentic AI refers to security solutions that utilize autonomous or semi-autonomous AI Agents to perform security operations tasks with minimal human intervention. AI agents can often independently reason, make decisions, plan multi-step workflows, and take actions to triage, investigate, and respond to security threats without constant human intervention. These systems behave more like digital analysts than scripted playbooks: they pursue goals, adapt when conditions change, and complete missions without requiring step-by-step instructions.

Unlike a standard automation script that follows a linear if/then logic path, or a GenAI chatbot that generates text based on a prompt, an agentic AI system functions as a digital worker. When given an objective — such as “Triage all phishing alerts” or “Contain compromised endpoints” — it determines the best sequence of steps to achieve that goal, adapting its approach if it encounters obstacles using a combination of deterministic and non-deterministic approaches.

Non-Deterministic vs. Deterministic AI

To understand agentic AI, you must understand the shift in security automation philosophy from deterministic to agentic:

Legacy SOAR (Deterministic): Rigid. If the log format changes, the playbook breaks. It requires a human to pre-program every single step.
Agentic AI security (Non-deterministic and reasoning): Adaptive. The system understands the task’s intent. If one tool fails, it reasons; for example: The EDR API timed out. I will try querying the firewall logs instead to verify the IP. This ability to reason and adapt — instead of simply follow pre-written instructions — is the core of agentic AI.

Defining Characteristics of Agentic AI Security

In security operations, agentic AI matters when it has these properties:

Goal orientation: Agents are given outcomes, not just steps. For example, reduce phishing backlog to zero while preserving business email uptime, or verify all high-risk logins within five minutes.
Autonomy with guardrails: Agents can decide and act without human approval on every step, but within clear boundaries, policies, and human-in-the-loop checkpoints for high-risk actions.
Perception and environment interaction: Agents ingest and interpret signals across your environment, including SIEM, EDR, IAM, cloud, SaaS, email, and more, and act back on those systems via APIs, tickets, and notifications.
Reasoning and planning: Agents break down complex incidents into multi-step plans, track progress, and adapt when new evidence appears or tools fail.
Tool use: Agents call tools the way a human analyst would: query an EDR, look up identity data, open or update a case, disable an account, adjust a firewall rule.
Learning and behavior adaptation: Agents improve over time based on feedback, outcomes, and updated policies.
Memory: Agents retain both short-term context for a case and long-term context across users, assets, and previous incidents, so decisions do not happen in isolation.

When these characteristics come together inside a security platform, you get agentic AI security rather than yet another assistant.

How Agentic AI Works in Autonomous Security Operations

Agentic AI systems operate through four architectural pillars. These allow the AI to move beyond text generation and take meaningful action inside the SOC.

1. Planning

Before an agentic system can act, it must sense and understand. In cybersecurity, this means ingesting real-time telemetry from the entire security stack, including SIEM, EDR, IAM, cloud, and email gateways. Unlike a SIEM that just stores logs, agentic AI actively listens for anomalies, parsing unstructured data into structured evidence. From there, it builds a plan: which tools to call, in what order, and what success looks like.

2. Memory

A chatbot has a short attention span. An agentic AI cybersecurity system requires persistent memory to understand both the immediate situation and the broader context, which includes:

Short-term memory: The context of the current incident (User X just failed 2FA).
Long-term memory: Historical context (User X travels to France often or This IP was flagged as benign last week). This memory enables the agentic system to make informed decisions based on the complete picture, rather than just the current alert.

This memory lets the agent interpret each alert in the context of user behavior, asset criticality, and previous outcomes, not as an isolated log line.

3. Reasoning

Reasoning is where the Large Language Model (LLM) shines. Using frameworks like ReAct (Reason + Act) or Chain of Thought, the agentic system breaks down a complex problem into steps.

Observation: “I see a suspicious PowerShell script.”
Thought: “I need to decode this script to understand its intent.”
Plan: “I will use a decoding tool, then check the domain against Threat Intel.”

4. Tool Use

Agentic AI is useless if it is trapped in a chat box. Agentic security systems need “hands” to interact with the real world, and in security operations, that translates into direct integrations with your entire technology stack via APIs, webhooks, and shells. The agent not only knows that CrowdStrike or Sentinel or Wiz exists, it knows which commands it is allowed to execute, and when:

Isolate a host
Search for a process hash
Look up a user in your identity provider
Open or update a case in ServiceNow
Purge emails from all inboxes

This combination of planning, memory, reasoning, and tool use is what turns agentic AI security into a working digital SOC analyst.

The Evolution from Manual Security to Agentic AI

The journey to the autonomous SOC has been paved with technologies that promised to solve the efficiency gap but fell short.

Stage 1: Legacy SOAR

Legacy SOAR promised relief but delivered complexity. These tools relied on brittle, linear playbooks. Building them required heavy coding, and maintaining them became a full-time job. They handled the “easy” automation but failed at anything requiring nuance.

Stage 2: GenAI Co-Pilots

The arrival of ChatGPT brought AI into the SOC, but largely as a sidekick. Analysts could ask, “What does this error code mean?” or “Draft a report.” While GenAI accelerated understanding, it didn’t reduce the volume of work. The analyst still had to click the buttons.

Stage 3: The Agentic Security Era

We are now in the phase of AI-driven Hyperautomation. Agentic AI combines the flexibility of GenAI with execution power far beyond SOAR. Built on elastic cloud infrastructure, Torq scales dynamically to handle virtually any event storm volume, processing hundreds of thousands to millions of events, while maintaining the same depth and quality of investigation for each one.

How Torq Powers the Agentic SOC

While traditional platforms rely on pre-defined playbooks, Torq’s architecture introduces a flexible model essential for agentic behavior.

Built for Adaptability

Legacy systems require heavy coding to handle complexity. Torq workflows are built using reusable steps, modular integrations, and dynamic data mapping, making them easier to adjust as tools and formats evolve.

Instead of forcing teams to hand-code logic or maintain rigid scripts, Torq lets analysts build automations through a no-code workflow builder backed by hundreds of integrations. This structure makes it possible for agentic AI to orchestrate complex multi-tool actions, drive escalations, enrich alerts, and interact with identity, cloud, and ticketing systems reliably and transparently.

Execution Through Transparent Workflows

Agentic AI in Torq doesn’t replace the underlying automation engine — it operates through it. Every autonomous action ultimately runs as a documented workflow built in the Torq platform. Workflows in Torq are constructed from triggers, steps, conditions, and integrations, all of which remain fully visible and editable. This ensures that even advanced, AI-driven actions stay grounded in a transparent automation framework.

The Intelligence Layer

To drive this autonomy, Torq leverages enterprise-grade foundation models, including OpenAI’s GPT-4 and Anthropic’s Claude 4.5, within its AI-native security architecture. This combination provides the system with persistent memory, contextual reasoning, and the full orchestration capabilities required to solve problems, not just summarize them.

Agentic AI Cybersecurity Use Cases

Agentic AI cybersecurity is not a theoretical concept for the future. Torq’s agentic AI is currently running in production environments — including at Fortune 500s — handling high-volume, high-noise workflows.

1. Autonomous Triage

Tier-1 triage is one of the most common workflow patterns documented in Torq. Using workflow triggers, enrichment steps, and case actions, AI agents automate the high-volume data gathering that normally overwhelms analysts.

Trigger: A SIEM or EDR sends an alert via webhook.
Enrichment: Workflows query threat intelligence and internal HR systems.
Decision: The AI agent classifies the alert (False Positive vs. True Positive).
Action: It auto-closes false positives or escalates true threats to specific teams.

Everything is visible in workflow logs, allowing teams to audit how each step was executed.

2. End-to-End Phishing Remediation

Phishing is dynamic; static playbooks struggle to catch up. An agentic approach mimics a human investigator.

Analysis: The agentic system parses headers, decodes URLs, and runs sandbox analysis.
Context: It checks user identity and history.
Remediation: If malicious, Torq searches the environment for the email, removes it from all inboxes, blocks the sender, and updates firewall rules, all while maintaining a full audit trail.

3. Cloud Security Auto-Remediation

In the cloud, risks appear and disappear in seconds. An agentic AI system acts as a 24/7 guardian of security posture.

Validation: When a misconfiguration alert fires, the workflow queries cloud APIs (AWS, Azure, GCP) to confirm the exposure.
Verification: The system messages the resource owner via Slack/Teams for verification.
Action: If no approval is received, the agentic AI applies conditional logic to revoke public access or modify configurations to restore compliance.

Risks, Challenges, and Governance in Agentic AI Security

The biggest barrier to adopting agentic AI is fear. What if the AI goes rogue? What if it shuts off the CEO’s laptop access?

Trust in AI can only be achieved through rigorous governance and architecture. This is where the distinction between human-in-the-loop and human-on-the-loop becomes vital.

Human-in-the-loop: The AI recommends actions but needs explicit approval for high-impact steps.
Human-on-the-loop: The AI executes within defined guardrails, with humans monitoring and able to intervene or override.

Transparency Through Execution Logs and Case Records

A black box is unacceptable in security. An agentic system must expose its reasoning and actions.

Torq provides detailed execution logs and case histories for every AI-driven workflow, including:

Inputs and outputs
Tools called and parameters used
Timestamps and outcomes

This makes it possible to answer the question, Why did the AI do that? with concrete evidence.

Enforcing Guardrails With RBAC, Permissions, and Approvals

Agentic security requires controls. Torq enforces Role-Based Access Control (RBAC) to limit which users (human or machine) can execute workflows. Critical actions — like account lockouts or network isolation — can be designed with human-in-the-loop approval steps. This ensures that high-impact remediations always require human validation, creating predictable boundaries for the AI.

Getting Started: Building Your First Agent-Ready Workflow

The Torq Knowledgebase outlines exactly how teams can create workflows for agentic AI to operate end-to-end. Start with a high-volume or high-noise process, such as phishing triage or endpoint alert enrichment, and define your desired outcome. In Torq, workflows begin with a trigger (an alert, API call, or scheduled event), followed by a sequence of steps that query systems, enrich data, create cases, or notify users.

Once you build and test the workflow, you can incorporate human approvals, connect additional integrations, and refine logic using execution logs. This documented structure makes workflows dependable, transparent, and ready for agentic AI to orchestrate at scale.

The Future is Autonomous

The shift to agentic AI security is inevitable. The math of the modern threat landscape simply doesn’t support a human-only defense strategy. Attackers are using AI to scale their assaults, which means defenders must use AI to scale their response.

Agentic AI allows organizations to move from a posture of coping to a posture of control. It frees human analysts to focus on threat hunting, strategy, and architecture, while the agentic system handles the noise.

Don’t settle for an AI that just chats. Demand an AI that works. Learn more about how to strategically approach agentic AI in the SOC in our AI or Die Manifesto.

Get the Manifesto

FAQs

How is agentic AI different from generative AI in cybersecurity?

Generative AI (like ChatGPT) is designed as assistants to answer questions, provide recommendations, and create content or summarize text based on prompts. Agentic AI is generative AI embedded within an autonomous execution framework, which uses the same LLM reasoning capabilities but adds persistent memory, tool integration with contextual understanding, and orchestration to execute multi-step security workflows independently. In cybersecurity, this means an agentic system can autonomously investigate alerts, query multiple tools, reason through complex threats, and take remedial actions (such as blocking an IP) without human intervention. GenAI talks; agentic AI acts.

How can organizations effectively govern and monitor agentic AI security systems?

Safe adoption relies on three pillars: transparency (logging the AI’s “chain of thought”), guardrails (restricting high-risk actions, such as locking C-level accounts), and human-in-the-loop checkpoints (requiring approval for sensitive remediations). Platforms like Torq HyperSOC™ build these controls directly into the workflow engine.

Will agentic AI replace human security analysts?

No. Agentic AI replaces grunt work, not people. It handles the high-volume, repetitive work — such as initial triage, data enrichment, and false positive dismissal — that leads to analyst burnout. This enables human analysts to shift their focus to high-value tasks, such as strategic threat hunting, complex incident response, and security architecture.

What are the best use cases for agentic AI security?

Agentic AI delivers the highest ROI when deployed in high-volume, repetitive workflows. The top use cases include autonomous triage (investigating and resolving false positives), phishing remediation (analyzing emails and removing malicious messages), identity protection (verifying suspicious logins via Slack/Teams), and cloud security (automatically remediating misconfigurations, such as public S3 buckets).

What industries are seeing the biggest impact from agentic security adoption?

Industries with high-volume data and strict compliance requirements — such as Finance, Healthcare, and SaaS — are experiencing the most significant impact. The ability to autonomously triage thousands of alerts and enforce cloud posture in real-time is critical for these sectors.

How do I get started with agentic AI in my SOC?

Start by automating Tier-1 triage. Use a platform like Torq to build a workflow that ingests alerts, enriches them with threat intel, and classifies them. Once you trust the AI’s decision-making on low-risk alerts, you can gradually expand its autonomy to include remediation actions, adding human approval steps where necessary.

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI SOC Integrations

Expel + Torq: Smarter Investigations, Automation, and AI-Powered SOC Workflows

By Dylan Jensen

November 18, 2025

6 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Dylan Jensen is the Manager of Sales Engineering at Torq, where he leads presales execution and supports customers in adopting security automation and AI-driven SOC operations. Dylan brings over a decade of experience in cybersecurity, encompassing security operations, automation platforms, and incident response. He combines deep technical expertise with a strong customer-facing approach to help teams navigate complex security challenges.

Security teams love Expel for its transparent Managed Detection and Response (MDR) and powerful investigative platform that brings clarity to alerts and incidents. Expel’s Workbench API gives you deep access into alerts, investigations, findings, comments, remediation actions, and much more — making it ideal for automation and orchestration.

But what if you could go beyond reporting and dashboards? What if your security operations platform could investigate, triage, and respond autonomously, driven by deterministic logic and AI?

That’s where Torq and Expel come together.

What Torq Adds to Your Expel MDR Workflows

Traditional workflow builders help teams automate tasks. Torq goes further — enabling AI workflows that can reason, decide, and act without waiting on human input. With deterministic guardrails and agentic AI, Torq doesn’t just move data between tools; it investigates alerts, prioritizes risk, and executes response actions at machine speed. This is the difference between connecting tools and running security operations.

Torq gives you a powerful way to automate Expel’s API-accessible capabilities using:

Deterministic playbooks: Clearly defined steps that follow your SOC processes.
Copy-paste curl integrations: Every action can be triggered via REST with ready-to-use curl commands.
AI Agents that act on your behalf: Triage, investigate, and update Expel data with natural language guidance and context.
Bidirectional sync: Change Expel investigations, comments, findings, and more from Torq and reflect changes back in Expel automatically.

Core Expel Actions You Can Automate with Torq

Instead of starting from a blank canvas, Torq delivers production-ready playbooks. These playbooks include: built-in escalation logic and SLAs, AI governance and guardrails for approvals, and safety checks.

Below are the key Expel resources and interactions that Torq can orchestrate, pulling from both the Workbench API documentation and your existing set of Torq actions.

Investigation Lifecycle

Retrieve investigations for analysis and routing.
Pull findings to understand what Expel SOC has determined.
Review actions tied to investigations.

Torq playbooks can create new findings or update investigation fields using POST/PATCH calls via Expel’s API. These investigation-related resources give Torq the ability to see what’s happening in Expel and take action.

Alert Data and Comments

Fetch alerts from Expel’s Workbench, filter by severity or source.
Retrieve discussion threads on investigations.
Log analyst notes programmatically or via AI Agent decisions.

Remediation Actions

Understand the available actions for a given investigation or alert.
Get detailed context around specific actions.
Kick off remediation directly from Torq using curl-based API calls.

These actions let Torq trigger containment, cleanup, or other security responses in sync with Expel’s recommended workflows.

How We Implement This in Torq

1. Deterministic Steps You Control

Torq playbooks execute step-by-step logic that maps to how your SOC works.

Step 1: Retrieve new Expel alerts
Step 2: Enrich context (SIEM, Endpoint, Threat Intel)
Step 3: Evaluate alert severity + indicators
Step 4: If criteria met → create investigation or escalate
Step 5: Write back comments, findings, remediation actions

2. Curl-Ready Integrations

Every API call Torq performs can be surfaced as a simple curl command for reuse or embedding.

curl 'https://workbench.expel.io/api/v2/expel_alerts?filter[status]=OPEN' \
-H "Authorization: Bearer $EXP_KEY"

3. AI Agents That Investigate Like Analysts

Torq’s AI Agents can:

Query Expel for alert details
Enrich with context from other systems
Triage and suggest next steps
Write back decisions as comments, tags, or remediation tasks

For example, an AI Agent can analyze five related Expel investigations, identify shared indicators, determine likely root cause, and update every case automatically — saving hours of analyst time.

4. Bidirectional Sync

Changes in Expel MDR — like an updated investigation status or new remediation details — can be reflected back to Torq playbooks, dashboards, and downstream tools automatically.

Real-World Use Cases: Torq + Expel

Automated Triage Pipeline

When a new alert arrives from Expel, Torq triggers a workflow. The workflow automatically enriches the alert by querying additional systems such as SIEMs, endpoint tools, or identity providers using predefined steps.

How Torq handles it:

Enrichment steps gather context (related alerts, user attributes, or asset details).
Conditional logic evaluates alert fields and enrichment results to determine the next action.
Based on these conditions, the workflow can create or update a Torq case, add findings or comments, and route the case to the appropriate queue or team.

All actions occur immediately as part of the workflow execution, without requiring an analyst to collect or enter data manually.

Remediation Acceleration

When alert severity or defined conditions meet response criteria, Torq workflows can initiate containment or remediation actions through supported integrations.

How Torq handles it:

Workflow steps invoke remediation actions via REST API calls or native integration actions.
Actions include isolating a host, disabling an account, blocking an IP address, or triggering response actions exposed by Expel or other security platforms.
These steps are executed automatically based on workflow logic, not manual intervention.

Because predefined workflow conditions drive remediation, response actions occur consistently and quickly, while still remaining fully visible in execution logs and case records.

Investigation Orchestration

Torq workflows can be triggered by events or on a scheduled basis to coordinate investigation activity across multiple alerts, cases, or teams.

How Torq handles it:

Scheduled workflows can query systems for open cases, active alerts, or unresolved findings.
Aggregated results can be summarized into case updates, notifications, or reports.
Additional workflows can be triggered to collect deeper context, request analyst review, or assign follow-up tasks.

This approach allows teams to standardize investigation processes, maintain visibility across concurrent incidents, and ensure no cases are missed.

Why Torq + Expel Is a Game-Changer for Security Operations

Combining Expel MDR and Torq turns great investigations into fast, repeatable outcomes. With the Expel + Torq integration, you can automate the full lifecycle — from alert intake and enrichment to investigation updates and remediation — using deterministic playbooks, AI-driven SOC workflows, and bidirectional sync.

Ready to operationalize it? Get started with our Don’t Die, Get Torq manifesto.

Get the Manifesto

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI SOC Security Automation 101 Use Cases

EDR Tools: How Agentic AI Makes Them More Effective

By Torq

November 18, 2025

10 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

TL;DR

EDR tools go beyond antivirus — they monitor endpoints continuously, detect unknown threats through behavioral analytics, and enable forensic investigation and containment.
The biggest EDR challenge is response, not detection. Alert volume, siloed data, and manual handoffs create costly delays between alert and resolution.
Agentic AI and Hyperautomation close the response gap — automating triage, enriching alerts with cross-stack context, and executing response actions in seconds.
Torq integrates with 11+ leading EDR platforms and connects endpoint signals to automated response across your entire security stack.

Endpoint detection and response (EDR) tools are a cornerstone of modern SOC operations. But even the best EDR solution on the market has a ceiling, and most security operations teams hit it faster than they expect.

The ceiling isn’t detection. Today’s EDR tools are excellent at spotting threats. The ceiling is response: what happens after the alert fires, how fast your team can move, and how much of that process still requires a human to do it manually.

This post covers what EDR tools are, what they do within your security stack, and how agentic AI and Hyperautomation platforms help SOC teams automatically turn EDR signals into resolved incidents.

What are EDR Tools?

EDR stands for endpoint detection and response. EDR tools are security software that continuously monitor endpoints — laptops, servers, cloud workloads, and mobile devices — for suspicious activity. They use behavioral analytics and machine learning to detect known and unknown threats in real time, and they give security teams the visibility and tooling to investigate and contain those threats.

The “endpoint” part is key. Unlike perimeter-based security tools that watch what comes in and out of the network, EDR tools watch what’s happening on the device itself: process execution, file modifications, registry changes, lateral movement, and more.

What Do EDR Tools Actually Do?

EDR tools do a lot more than just fire alerts. Here’s what’s happening under the hood across a typical deployment.

Continuous endpoint monitoring. EDR agents run on every enrolled device and continuously collect telemetry: process activity, network connections, file system changes, and user behavior. This isn’t periodic scanning; it’s always-on visibility.

Behavioral threat detection. Rather than relying solely on signatures, EDR tools analyze behavior patterns to identify anomalies. If a process that shouldn’t be making outbound network connections suddenly starts doing so, the EDR flags it, even if the underlying malware is brand new.

Alert generation and telemetry enrichment. When suspicious activity is detected, the EDR surfaces an alert with supporting context: what happened, on which device, under which user account, and what the process tree looks like leading up to it.

Forensic investigation. EDR tools give analysts the timeline and historical data to investigate an incident thoroughly, tracing lateral movement, identifying patient zero, and understanding the full scope of a compromise.

Containment actions. Most EDR platforms can take direct action on an endpoint: isolating it from the network, killing a malicious process, or blocking the execution of a specific file. These are the response capabilities that make EDR distinct from passive monitoring tools.

The challenge? EDR tools generate an enormous volume of signal. Enterprise environments can produce thousands of alerts per day. Detection isn’t the bottleneck. It’s what happens after the alert fires that separates high-performing SOCs from the ones perpetually stuck in reactive mode. Alert fatigue is real, and EDR alone doesn’t solve it.

Common EDR Security Tools in Enterprise Security Stacks

Most enterprise SOC teams are working with one or more of the following platforms. Here’s a high-level look at the tools encountered most often.

CrowdStrike Falcon

CrowdStrike Falcon is one of the most widely deployed EDR platforms in enterprise security. It’s cloud-native, built on a single lightweight agent, and backed by real-time threat intelligence from CrowdStrike’s global sensor network. Falcon is well-regarded for its speed of detection and depth of threat intelligence integration.

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is deeply embedded in Microsoft 365 environments, making it a natural fit for organizations already running the Microsoft stack. It provides EDR capabilities alongside vulnerability management, attack surface reduction, and integration with Microsoft Sentinel for broader SIEM correlation.

SentinelOne Singularity

SentinelOne is known for its AI-driven autonomous response capabilities. Its platform can detect, quarantine, and remediate threats at the endpoint without waiting for analyst input, a design philosophy that aligns well with automation-first SOC strategies.

Carbon Black (VMware/Broadcom)

Carbon Black offers both cloud-delivered and on-premises EDR solutions, with strong behavioral detection and threat-hunting capabilities. It’s widely used in regulated industries where deployment flexibility matters.

Regardless of which EDR platform is in your stack, the challenge most SOC teams face is the same: it’s not finding the threat. It’s operationalizing the response quickly and consistently enough to matter.

The Gap EDR Tools Can’t Close on Their Own

EDR tools are exceptional at what they’re built for. But detection is only half the equation. The gap between “alert fired” and “incident resolved” is where attacks do damage, and where most SOC teams are losing ground.

A few of the dynamics that create this gap:

Alert volume. Enterprise EDR deployments generate thousands of alerts per day. Analysts simply cannot manually triage everything. Without automated prioritization, high-fidelity alerts get buried in noise and response times suffer.

Siloed data. EDR telemetry lives in one console, identity data in another, network logs somewhere else, and threat intelligence in yet another platform. Correlating all of that manually takes time, and attackers use that time to their advantage.

Manual response steps. Even after a threat is confirmed, the response workflow often requires an analyst to touch multiple tools: isolate the endpoint in the EDR console, revoke credentials in the identity provider, open a ticket in the ITSM platform, and notify the user’s manager. Each handoff introduces delay.

Dwell time. The longer it takes to move from detection to containment, the greater the blast radius. IBM’s Cost of a Data Breach Report has consistently shown that organizations with faster detection and response times incur significantly lower breach costs. Every minute matters.

The tools themselves aren’t failing. The gap is structural. EDR was designed to detect and enable response. What fills the space between “enable” and “execute” is where automated incident response comes in.

How Agentic AI and Hyperautomation Extend EDR Capabilities

The most effective SOC teams today pair their EDR tools with agentic AI and an AI SOC platform that converts detection signals into response actions automatically.

Here’s what that looks like in practice.

Automated triage. Instead of an analyst manually reviewing every EDR alert, AI agents evaluate incoming detections, enrich them with context from other tools like SIEMs, threat intelligence feeds, and identity systems, and prioritize by actual risk. High-confidence threats get escalated immediately. Low-fidelity noise gets suppressed before it ever lands in an analyst’s queue.

Autonomous response workflows. Pre-approved playbooks execute containment actions the moment a threat is confirmed: isolate the endpoint, revoke the compromised credentials, block the malicious domain at the firewall, and notify the on-call analyst with full context. All of this can happen in seconds, without waiting for a human to kick off each step.

Cross-tool orchestration. Rather than an analyst pivoting between five different consoles, an orchestration layer connects the EDR, the SIEM, the identity provider, the ticketing system, and the threat intel platform into a single automated workflow. The data flows between tools without manual intervention.

Continuous improvement. Agentic AI refines its triage and response decisions over time based on analyst feedback, case outcomes, and new threat patterns, so the system gets smarter the longer it runs.

What This Looks Like with Torq

The Torq AI SOC Platform natively integrates with the EDR security tools already in your stack, including CrowdStrike, SentinelOne, Microsoft Defender, Cisco Secure Endpoint, Sophos, Carbon Black, Cybereason, Fortinet, Kandji, LimaCharlie, and Check Point. When an EDR fires a detection, Torq’s AI agents automatically enrich it with context from across your environment, apply risk-based prioritization, and execute the appropriate response without manual intervention. The result is faster containment, lower mean time to respond, and analysts focused on work that actually requires human judgment.

Torq acts as the connective tissue between your EDR and the rest of your security stack, turning detection signals into outcomes rather than action items waiting in a queue.

What to Look for When Evaluating Your EDR and Automation Stack

If you’re assessing whether your current EDR setup is built for scale, here are the questions worth asking, not just about the EDR tool itself, but about the automation layer around it.

Integration Depth

Does your EDR connect to the rest of your security stack? An EDR that doesn’t talk to your SIEM, identity provider, threat intelligence platform, and ticketing system forces analysts to manually bridge those gaps. Threat enrichment only works if the data can flow between tools automatically. Torq’s integration library spans 300+ tools, so the connective tissue is already there.

Response Automation

Can your environment automatically move from detection to containment, or does every confirmed threat require a human to initiate the response? For high-volume security operations environments, manual response workflows aren’t a process problem. They’re a risk.

Alert Fidelity

Are your analysts spending their time on real threats, or drowning in alerts they have to manually validate? The combination of strong EDR telemetry and AI-driven enrichment should surface high-confidence detections, not add to the pile. If your team is battling alert fatigue, the fix usually isn’t a better EDR. It’s a smarter triage layer on top of it. The Torq AI SOC Platform is built specifically to close that gap.

Scalability

As your environment grows, does your detection and response strategy grow with it? Adding endpoints shouldn’t mean adding analysts. The right combination of EDR and automation should let your existing team handle significantly higher alert volumes without proportional headcount increases.

EDR Tools Are the Signal. Automation Is What Acts on It.

EDR tools are essential infrastructure for modern security operations. They provide the continuous visibility and detection depth that enterprise environments require. But in a high-volume SOC, detection without fast, automated response is only half a strategy.

The data backs this up. According to the 2026 AI SOC Leadership Report, 97% of security leaders trust AI to handle triage — but only 35% are actually using it there. That gap between confidence and execution is exactly where most teams are leaving value on the table.

The teams getting the most out of their EDR investments aren’t just running the tool. They’re pairing it with orchestration and agentic AI that closes the gap between alert and resolution, moving from “we detected it” to “we contained it” in seconds without requiring an analyst to manually touch every step.

That’s what an autonomous SOC looks like in practice: EDR tools doing what they’re built to do, connected to an automation platform that makes sure every detection turns into an outcome.

Curious what 450 CISOs and SOC leaders say about why an AI SOC platform is no longer optional? The data is in.

Get the Report

FAQs

What does EDR mean in cybersecurity?

EDR stands for endpoint detection and response. It refers to security software that monitors endpoints like laptops, servers, and workstations continuously for suspicious activity, detects threats using behavioral analytics, and provides tools for investigation and containment.

What is the difference between EDR and antivirus?

Traditional antivirus software uses signature-based detection to block known malware. EDR goes further by monitoring endpoint behavior continuously, detecting threats that don’t match known signatures, and providing forensic investigation and response capabilities.

Is EDR a SIEM tool?

No. EDR tools focus on endpoint-level monitoring and response. SIEM platforms aggregate log and event data from across the entire environment. They serve complementary purposes and are often used together.

How does an AI SOC platform work with EDR tools?

An AI SOC platform sits on top of your EDR and connects it to the rest of your security stack. When your EDR fires an alert, the AI SOC platform automatically enriches it with context from SIEM, identity, and threat intelligence sources, scores it by risk, and executes a pre-approved response workflow, all without requiring an analyst to manually coordinate across tools. The EDR handles detection at the endpoint; the AI SOC platform handles everything that happens next.

Can an AI SOC platform reduce EDR alert fatigue?

Yes. One of the biggest pain points for SOC teams running EDR tools is the volume of daily alerts. An AI SOC platform applies automated triage and enrichment to incoming EDR detections, filtering out low-confidence noise before it ever reaches an analyst. Only high-fidelity, contextually relevant alerts are escalated, so analysts spend time on real threats rather than manually validating hundreds of alerts per shift. Learn more about how AI agents for the SOC handle triage at scale.

How does Torq integrate with EDR tools?

Torq natively integrates with leading EDR platforms, including CrowdStrike, SentinelOne, Microsoft Defender, Cisco Secure Endpoint, Sophos, Carbon Black, Cybereason, Fortinet, Kandji, LimaCharlie, and Check Point. These integrations allow Torq to ingest EDR alerts directly, automatically enrich them, and trigger response actions such as endpoint isolation or credential revocation without manual steps. You can explore the full Torq integrations library to see how it connects with your existing stack.

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Hyperautomation

Survive the Holiday SOC Nightmare with Automation

By Torq

December 1, 2025

5 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

If you’re a CISO, your holiday season is probably defined by two things: family time and anxiety. Cybercriminals don’t celebrate the holidays. They know your SOC staff is running on fumes, paid-time-off accruals, and maybe checking 3am Slack messages from a ski slope. They strike when you are weakest.

The numbers aren’t entirely surprising: 86% of ransomware victims were targeted on a holiday or weekend, exploiting the fact that most organizations cut SOC coverage by half — and some leave their operations unstaffed altogether.

Security models that rely on human speed, human availability, and human judgment for Tier-1 and Tier-2 triage are the biggest, most unmanaged risk on your books. This holiday season, stop compensating for the human element and start building a defense that runs autonomously.

Four Holiday “Gifts” Hackers Leave for Understaffed SOCs

If you rely on traditional SOAR or any other legacy solution, you are exposing your business to four critical failures the moment your senior staff goes on PTO.

Your analysts are drowning in noise. The few running the skeleton crew during the holidays now have to triage a spike in “suspicious activity” from employees logging in from exotic vacation spots — the VPN alert paradox. It’s not just a workload issue; it’s a trust issue. Can that analyst, stressed and alone, tell the difference between a legitimate login from an employee in Thailand and an attacker in the same time zone?

The Autonomous Fix: Torq Hyperautomation™ doesn’t care if an alert comes in at 10am on a Tuesday or 11pm on Christmas Eve. Agentic AI handles all Tier-1/Tier-2 triage, enrichment, and context correlation instantaneously, ensuring only validated, high-priority incidents wake the on-call analyst.

2. The Silent Night Breach

The cost of a breach is directly tied to the Mean Time to Contain (MTTC). Attackers move laterally in minutes; if your containment relies on a single, sleepy analyst on-call, your MTTC goes from hours to days. Relying on a human to wake up, log in, and manually coordinate remediation is a financial and compliance liability. Human-led containment is simply a vulnerability during peak-risk times.

The Autonomous Fix: The autonomous SOC guarantees machine-speed containment (e.g., firewall block, identity lock, endpoint quarantine) for common and known threats, regardless of who is in the chair.

3. The Broken Playbook Fruitcake

Your legacy SOAR workflows are brittle, coded flows that rely on institutional knowledge to run. The moment the senior analyst who wrote the custom Python glue code is on a beach, that playbook is effectively dead — and so is your defense. A dependency on custom code is a dependency on the individual. You can’t afford to have your security posture tied to a single person’s vacation schedule.

The Autonomous Fix: Our no-code, API-first approach and multi-agent system architecture ensure all automated workflows are visible, centrally governed, and runnable by anyone.

4. The Compliance Ghost of Christmas Past

Regulations like SOC2, DORA, and the SEC’s disclosure rules don’t pause in December. Missing a critical incident due to understaffing is still a compliance failure, carrying massive potential fines and career risk. You need an audit trail that can prove, without human intervention, that an incident was detected, investigated, and contained according to policy.

The Autonomous Fix: Torq’s team of AI Agents automatically documents every detection, decision, and remediation step — creating a real-time audit trail you can present to auditors, not apologies to the board.

How Torq HyperSOC™ Saves the Holiday SOC

The CISO’s job isn’t to perfectly staff the SOC 24/7/365; it’s to build a defense that doesn’t require perfect staffing. You need to offload the reliability problem from your people to a platform designed for autonomy: Torq HyperSOC™.

Here’s how to stop staffing the gap and start automating the vulnerability, ensuring 24/7/365 coverage whether your team is full-stack or on skeleton crew.

Guaranteed Coverage with AI-Driven Response

Implement HyperSOC to handle all high-volume, low-fidelity incidents autonomously. Our agentic AI reasons, plans, and executes containment actions across your environment in milliseconds. The autonomous SOC guarantees the highest standard of defense when your analysts are away, ensuring only validated, high-severity incidents require human judgment.

No-Code Resilience for Any Team

Your defense shouldn’t depend on whoever wrote that Python script three holidays ago. Migrate all your fragile, code-based SOAR logic to our AI Workflow Builder. Our no-code architecture ensures all automated workflows are visible, centrally governed, and executable by anyone (or anything) — guaranteeing operational continuity.

Automated Compliance and Audit Trails

Use agentic AI not just to respond, but to generate the auditable reasoning trail for every autonomous action. This ensures compliance, even when no human was involved. You can confidently report to the board that containment was machine-speed, policy-driven, and thoroughly documented.

Give Analysts the Gift of Time Back

Every minute you automate is a minute your analysts get back — for strategy, for innovation, or for an actual holiday. Torq customers routinely save hundreds of analyst hours per quarter while improving MTTR, coverage, and team morale.

This holiday, trade burnout for balance and let Torq keep watch while your team finally gets a silent night.

Sleep Peacefully This Holiday Season — We’ll Leave the Torq On

This holiday season, give your team the gift of a break — and give your board the gift of guaranteed security. The autonomous SOC is the only system that truly operates 24/7/365. Stop settling for a security posture that is only as strong as the one analyst pulling the graveyard shift.

Don’t wait until the New Year to fix last year’s biggest problem.

Escape the Nightmare

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

AI AI SOC Hyperautomation Integrations

Panther + Torq: Closing the Loop on Detection & Response

By Bob Boyle

November 20, 2025

6 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

Torq AMP spotlights the partners redefining what’s possible in security operations. Each partner brings a unique strength that seamlessly extends Torq’s autonomous SOC platform. Together, these partnerships help SOC teams achieve speed, accuracy, and scale that were once out of reach. Explore the future of SOC in the AMP’d Sessions video series.

For years, security teams have been trapped by legacy SIEM and SOAR solutions. They’re forced to make compromises — slashing data retention to 30 days to control costs, spending more time tuning brittle tools than hunting threats, and manually bridging the gap between a noisy alert and a meaningful response.

In the latest episode of Torq’s AMP’d Sessions, we sat down with Mike Olsen, Director of Partner Solutions Engineering at Panther, to discuss how customers are moving on from this broken model. They’re modernizing their SecOps data pipeline with Panther’s cloud-native data lake and Torq’s autonomous response.

Together, Torq and Panther deliver a closed-loop system that moves from detection to remediation at machine speed. Here’s how.

Panther’s Cloud-Native Data Lake: Built for the Modern SOC

The core problem with legacy SIEMs is their architecture. They weren’t built for the cloud era, forcing teams to choose between cost and visibility. Panther takes a different approach.

The foundation to the Panther platform is leveraging a cloud-native, modern data lake architecture. This serverless approach provides four key benefits:

Limitless scale: “We have a customer that’s ingesting 40 terabytes daily,” Olsen noted. Teams no longer have to make compromises on what security logs to keep.
Long-term retention: Instead of 30 days, Panther customers can retain data for at least a year in hot storage, enabling threat hunting and long-tail investigations without requiring rehydration.
Data ownership: Your data stays in your cloud. Panther supports a “bring your own data lake” model, avoiding the vendor lock-in of traditional SIEM.
Separation of compute and storage: This allows teams to “query petabytes of data at peak performance” without bogging down the system.

On top of this data lake, Panther employs a “Detection-as-Code” model. This gives teams the flexibility to write, tune, and deploy detections using Python, a low-code builder, or even AI-assisted creation, all managed in a CI/CD pipeline.

How Torq Turns Detection into Autonomous Response

Panther provides the high-fidelity detection and AI-driven triage; Torq provides the autonomous action. When Panther generates a high-confidence alert, it doesn’t just send a raw log. It sends a rich, AI-triaged case summary. Torq HyperSOC™ ingests this data and hands it to Socrates, Torq’s AI SOC Analyst. This initiates an AI-to-AI communication that is fully explainable and auditable.

Socrates reasons through Panther’s findings, orchestrates the necessary response actions through Hyperautomated workflows, and documents every step — transforming Panther’s T1-to-T2 analyst elevation into a T3 strategic “analyst-as-validator” model.

“Panther identifies what is happening, and then Torq decides what to do about it next.”

– Bob Boyle, Product Marketing Manager, Torq

Inside the Demo: From Data Lake to Autonomous Remediation

The AMP’d session demo showcased this closed-loop system in action, remediating a sophisticated identity-based threat from start to finish.

1. The Detection (Panther)

A high-fidelity correlation rule fired in Panther, combining two separate events:

Event 1: An Okta login from a “watch list” country (France).
Event 2: An M365 enumeration activity (like Get Users or List Admins) from the same user within 30 minutes.

Individually, these might be noise. Together, they could be something more. Panther’s AI Triage autonomously analyzed the events, generated a summary: “This is an anomalous login. The user, Timothy, is based in the U.S., not France,” and exposed its thinking steps for human validation.

Panther and Torq integration powering autonomous SecOps — Panther identifies suspicious login activity from a watchlist country and correlates it with Azure AD enumeration to elevate signal fidelity.

2. The AI-to-AI Handoff (Torq)

Torq ingested the correlated alert and Panther’s AI triage summary.

AI-to-AI: A Torq AI Agent evaluated Panther’s findings: “Based on Panther’s analysis, is this showing signs of persistence?”
The verdict: The Torq Agent confirmed “Recurrence: True,” mapped the attack to the MITRE Initial Access tactic, and automatically escalated the new case in Torq’s Case Management platform to ‘Critical’ priority.

3. The Autonomous Response (Socrates)

The critical case was automatically assigned to Socrates, Torq’s AI SOC Analyst, which followed its autonomous remediation runbook:

Investigation: Socrates reached back into Panther, querying the data lake for more user activity logs to broaden the investigation.
User verification: Torq’s communication agent autonomously interviewed the user, Timothy, directly in Slack: “Hey, Timothy, did you log in from France recently?” Timothy’s reply: “No.”
Containment: Based on that “No,” Socrates immediately executed its containment plan: it disabled the user’s Okta account and added the malicious IP address to a company-wide blocklist.
Notification: For business continuity, Socrates identified Timothy’s manager and sent them a Slack message: “Hey, there’s an active SOC incident… Timothy’s account is locked, and he won’t be able to respond.”

4. The Closed-Loop SecOps Pipeline

The entire cybersecurity lifecycle — from initial detection to full containment — happened in seconds. Every AI thought process, query, and action was logged in an immutable audit trail. The case was then escalated to a human analyst, not to work the alert, but to simply validate the autonomous actions already taken and close the case.

This partnership fundamentally changes the SecOps paradigm. It’s no longer a linear, manual handoff from a legacy SIEM to a brittle SOAR. It’s a single, intelligent, and closed-loop system, or what we like to call an autonomous SOC.

“What I’m most amped about is the combination of Panther’s AI-driven context from detection, and then combining that with Torq’s Hyperautomation for response. It’s really closing that loop and eliminating the manual gap between detection and action.”

– Mike Olsen, Director of Partner Solutions Engineering, Panther

Better Together: Torq + Panther

For security teams, the Torq and Panther partnership means:

Limitless scale: Ingest and retain all your security data in Panther’s data lake.
AI-triaged detections: Eliminate noise with Panther’s high-fidelity, AI-analyzed alerts.
AI-to-AI communication: Let Panther’s detection agents talk directly to Torq’s response agents for autonomous escalation.
Autonomous remediation: Go beyond simple automation to fully remediate threats — from investigation to containment and user verification — without human intervention.
End-to-end auditability: Maintain full, explainable audit logs of every AI decision and action, from detection to response.

Watch this workflow unfold in real time in the Torq + Panther AMP’d Session.

Watch Now

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

Customers Hyperautomation

Kenvue Turns Security Operations into a Strategic + Data-Driven Function

By Torq

November 17, 2025

6 Minute Read

Get a Personalized Demo

See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.

Request a Demo

The pace, complexity, and stakes of cybersecurity have changed — and most organizations are struggling to keep up. Every day, security operations centers (SOCs) are buried under thousands of security alerts from dozens of tools, each requiring validation, triage, and response. Meanwhile, attackers are using AI and automation to move faster and exploit every gap.

Most organizations struggle to keep up because their SOCs run on fragmented systems and manual processes. Too many tools, too little visibility, and not enough consistency to scale. What used to be a technical challenge has become a strategic business risk.

When every alert affects uptime, reputation, and compliance, SOC performance isn’t just an IT metric — it’s a business imperative. That’s why enterprises are embracing automated security workflows and security Hyperautomation — the foundation for modern, scalable security operations that defend at machine speed.

The Modern SOC Challenge

Across industries — from healthcare and retail to finance and tech — SOC teams face the same systemic challenges:

Inconsistent processes: Manual, siloed workflows lead to gaps in coverage and unpredictable results.
Limited visibility: Fragmented data across EDR, SIEM, IAM, and cloud tools makes it hard to see what’s actually happening.
Alert fatigue and burnout: Analysts spend most of their day validating false positives instead of investigating real threats.
Lack of measurable impact: Many SOCs can’t easily demonstrate performance, efficiency, or risk reduction to business stakeholders.

As a result, even well-staffed SOCs often operate reactively, always chasing incidents instead of improving resilience. To break this cycle, organizations need automated security workflows that standardize response, unify tools, and provide real-time visibility into performance and risk. That’s where Torq Hyperautomation™ comes in.

Hyperautomation: The Foundation for a Modern SOC

Hyperautomation transforms security operations from fragmented security workflows into a coordinated, self-improving system. It uses AI-driven security automation to connect every tool, process, and analyst decision, building the foundation for a continually improving SOC.

The benefits of implementing automated workflows extend far beyond speed:

Standardization: Every incident follows the same consistent, repeatable process.
Visibility: Unified context across tools ensures no critical alerts are missed.
Efficiency: AI-driven correlation eliminates manual triage and data entry.
Resilience: Automated responses scale effortlessly across hybrid and cloud environments.
Accountability: Built-in reporting and audit trails strengthen compliance and prove SOC value.

Inside Kenvue’s SOC Transformation with Torq

Global consumer health leader Kenvue — home to trusted brands like BAND-AID®, Listerine®, and Neutrogena® — faced these same challenges on an enterprise scale. Their outsourced “black box” SOC delivered coverage but not transparency. The team lacked visibility into how incidents were handled, and there was no consistent process to measure or improve performance.

When Kenvue brought operations in-house, they aimed to modernize security operations with automated security workflows that delivered consistency, visibility, and measurable value.

Their objectives:

Replace black-box operations with transparency
Establish consistent, standardized workflows across global teams
Prove quantifiable business value through data and visibility

They chose Torq Hyperautomation as their foundation to automate tasks and transform the SOC’s operation.

“It’s clear Torq was built for security operations functions — and it’s head and shoulders above any other automation tool I’ve used before.”

– Dustin Nowak, Cyber Threat Manager, Kenvue

How Kenvue Implemented Automated Security Workflows with Torq

Kenvue used Torq to implement automated security workflows that brought consistency, structure, and insight to every aspect of incident response.

Advanced Case Management Purpose-Built for SecOps

Torq provided Kenvue with mature case management, capturing observables, notes, and evidence in structured, repeatable formats. Every incident followed the same process, eliminating ambiguity and making investigations defensible and auditable by design.

“It wasn’t just about speed,” Dustin explained. “It was about consistency — and being able to prove we’re doing the right things the right way.”

Standardized Workflows for Consistency

Torq’s automated security workflows helped Kenvue normalize response procedures across dozens of incident types. Each case contained the same level of context, structured the same way, and followed the same escalation path.

This consistency built a foundation for speed and trust. Analysts no longer had to guess how to proceed, and leadership could see exactly what was happening, when, and why.

Unified Data for Actionable Insights

Before Torq, pulling meaningful metrics from scattered systems was difficult Now, with rich tagging and categorizations in Torq, Kenvue’s team can slice and dice data with depth and detail, creating a data-driven feedback loop that drives continuous improvement.

Interactive forms even allow other business units to submit issues directly into Torq, ensuring smooth intake for compliance or third-party incidents without extra manual steps.

SOC Transformation: More Than Just Workflow Automation

By adopting Torq, Kenvue achieved transformative outcomes:

Hit their automation goal in six months; automating 89% of cases
Reduced mean time to respond (MTTR) by 60%
Aligned their hybrid team around standardized, measurable processes
Built and adapted complex case workflows without sacrificing control

Even more critically, Torq enabled a deeper level of investigation. Analysts had more time to validate cases, detect anomalies, and trace threats that traditional tools and alert rules would have missed.

Today, Kenvue’s SOC is a measurable, strategic function that delivers real-time insights and value to the business. With Torq, they have the tools to show stakeholders:

Where risk exists and how it’s being addressed
How security posture is improving month over month
Why automated security workflows are the key to scaling without compromise

“We can now go to the business and say, ‘Here’s where the risk is, here’s how we brought that risk down, and we’re getting better at buying that risk down.’”

– Dustin Nowak, Cyber Threat Manager, Kenvue

Transform Your SOC with AI and Hyperautomation

Every enterprise — from startups to global brands — faces the same truth: cyber threats evolve faster than manual teams can react. Automated security workflows are the only way to keep pace. By unifying fragmented security workflows, minimizing human error, and enabling scalability, automation empowers SOCs to instantly and consistently handle every alert — from vulnerability management and phishing detection to cloud incident response.

But true modernization requires more than isolated automation. Hyperautomation creates an intelligent, scalable framework of consistency, visibility, and continuous improvement that protects not just your infrastructure, but your entire business.

Torq Hyperautomation™ empowers security leaders to:

Streamline operations through automated security workflows and unified case management.
Strengthen resilience with real-time insights into risks, trends, and SOC performance.
Elevate security’s role as a strategic business enabler, not a back-office function.

See how you can achieve the same speed, visibility, and operational maturity as Kenvue. Read the full story of how Torq delivered measurable SOC impact through automated security workflows combined with a strategic focus.

Read the Case Study

Ready to automate everything?

“Torq takes the vision that’s in your head and actually puts it on paper and into practice.”

Corey Kaemming, Senior Director of InfoSec

“Torq HyperSOC offers unprecedented protection and drives extraordinary efficiency for RSM and our customers.”

Todd Willoughby, Director

“Torq saves hundreds of hours a month on analysis. Alert fatigue is a thing of the past.”

Phillip Tarrant, SOC Technical Manager

“The only limit Torq has is people’s imaginations.”

Gai Hanochi, VP Business Technologies

“Torq Agentic AI now handles 100% of Carvana’s Tier-1 security alerts.”

Dina Mathers, CISO

“Torq has transformed efficiency for all five of my security teams and enabled them to focus on much more high-value strategic work.”

Yossi Yeshua, CISO

Get a Demo

Contents

Get a Personalized Demo

Raising the Bar for Secure, Enterprise-Ready AI

Why Do These Certifications Matter for Modern Security Operations?

German BSI C5: Proving Operational Security at Enterprise Scale

ISO 42001: The Global Standard for Responsible, Well-Governed AI

What This Means for Torq Customers

Related Articles

SOC Automation for MSSPs: The 2026 Guide

How AI SOC Operations Are Reshaping Security Teams in 2026

The CISO’s Role Is Rapidly Changing

Ready to automate everything?

Contents

Get a Personalized Demo

What is Managed Detection and Response (MDR)?

What MDR Services Typically Include

What is a Managed Security Service Provider (MSSP)?

What MSSP Services Typically Include

MDR vs MSSP: Operational Differences For Your SOC

Proactive Threat Hunting vs. Reactive Alerting

The Cost and Scope of Management

Why MDR and MSSP Both Hit the Same Wall

Choosing the Right Model: Leveraging Hyperautomation With Torq

Maximizing MDR and MSSP Value With Hyperautomation

The Proof is in the Performance

FAQs

Related Articles

SOC Automation for MSSPs: The 2026 Guide

How AI SOC Operations Are Reshaping Security Teams in 2026

The CISO’s Role Is Rapidly Changing

Ready to automate everything?

Contents

Get a Personalized Demo

Reco: Identity-Driven SaaS Visibility for the Modern SOC

How the Reco + Torq Workflow Works

1. Reco Flags a Risky SaaS Access Event

2. HyperSOC Takes Over with Automated Validation and Policy Checks

3. Socrates Investigates

4. Autonomous Remediation

Better Together: Torq + Reco

Related Articles

Your Security Product’s Favorite Integration Partner

Intezer + Torq: Agent to Agent Communciation

Panther + Torq: Closing the Loop on Detection & Response

Ready to automate everything?

Contents

Get a Personalized Demo

Our Solution: Torq HyperAgents™

What Makes HyperAgents Different?

Why HyperAgents Matters

How HyperAgents Works

Tool Interaction

LLM-Driven Reasoning

Core Elements of Torq HyperAgents

Multi-Stage Reasoning

Total Customizability and Bring Your Own AI Models

Templates Library

What Makes Torq HyperAgents Unique?

HyperAgents in Action: EDR Alert Triage

Step 1: Enrichment AI Agent

Step 2: Communication AI Agent

Step 3: Decisioning & Ticketing AI Agent

HyperAgents: The Operational Core of Torq HyperSOC™

FAQs

Related Articles

SOC Automation for MSSPs: The 2026 Guide

How AI SOC Operations Are Reshaping Security Teams in 2026

The CISO’s Role Is Rapidly Changing

Ready to automate everything?

Contents

Get a Personalized Demo

Understanding Agentic Security in Modern Cybersecurity

What is Agentic AI Security?

Non-Deterministic vs. Deterministic AI

Defining Characteristics of Agentic AI Security

How Agentic AI Works in Autonomous Security Operations

1. Planning

2. Memory

3. Reasoning

4. Tool Use