HWG Sababa Hyperautomates Their Managed SOC to Fuel Customer ROI

The Problem: “From Scratch” Automation Coding Too Slow for Growing SOC and Customer Portfolio

About two years ago, global managed security services provider HWG Sababa reached a tipping point in their growth. The security team’s in-house automation tool that required custom coding was too time-consuming and resource-intensive to keep up with the needs of their expanding SOC as HWG Sababa onboarded more customers and added more tools to their stack. They needed a platform that could provide reliable, powerful, and easy-to-build automations.

Rather than simply replacing the old tool, the automation team saw this as an opportunity to enhance and streamline as many security processes as possible. With hundreds of global customers, HWG Sababa had a multitude of playbooks and procedures ideal for automation. They also needed a fast and easy way to integrate the wide range of tools and technologies used by their customers.

The Solution: Easy-to-Build Automations and Integrations from Torq Hyperautomation™

Avoiding platform lock-in: A search through Gartner and G2 reviews for security automation vendors led HWG Sababa’s automation team to Torq, which immediately sparked their interest. To maintain their best-in-breed security stack, HWG Sababa prioritized a vendor-agnostic automation solution with broad and flexible technology integrations, steering clear of platforms that would tie them down to a specific vendor’s EDR and other tools.

User-friendly automation building: “We wanted something easy to use, something that wasn’t legacy technology or too complex, like SOAR is known to be,” says Gianmaria Castagna, HWG Sababa’s Supervisor of Automation. While his team has coding expertise, he wanted an intuitive, easy-to-use solution that was approachable to users without programming skills or specialized training.

Integrations in record time: HWG Sababa steadily adds customers every year and, in turn, must support a growing array of customer technologies. Torq Hyperautomation’s quick and user-friendly integrations were a big draw for HWG Sababa’s team, especially as it has so many pre-built integrations that are practically instant to connect — no coding needed.

“The Implementation Was the Best Part”

“We recreated years’ worth of work in weeks”: HWG Sababa initiated a proof of concept (POC) with Torq engineers to Hyperautomate several key use cases. Gianmaria recounts that they successfully recreated years’ worth of automation development in just a matter of weeks — an achievement they could not replicate with the other solutions they evaluated.

Rapid time to value: Once they saw just how quickly they could rebuild the automations from their old tool using Torq Hyperautomation, HWG Sababa’s automation team began building in parallel — delivering significant value within the first few months of their Torq implementation. They swiftly achieved full coverage of their past automations, then moved on to building net-new automations for even more benefits.

Torq in Action: Hyperautomated Efficiency at Scale

Automated 55% of alerts, slashed MTTI/MTTR, and doubled productivity: HWG Sababa’s first focus for their Torq Hyperautomation implementation was to automate the processes that heavily consumed their SOC analysts’ time, such as alert management and repetitive, manual Tier-1 tasks. This strategy sped up MTTI/MTTR by 95% for medium- and low-priority cases and 85% for high-priority cases, with investigation and response now occurring nearly simultaneously in under eight minutes. The Torq platform automatically manages about 55% of HWG Sababa’s total monthly alert volume, from acknowledgment through investigation and response. This has nearly doubled the security team’s productivity and boosted operational capacity by 95%.

Boosted analyst morale: Beyond efficiency gains, HWG Sababa’s initial automation focus with Torq was also aimed at improving the job satisfaction and engagement of the SOC team. Gianmaria explains, “It’s annoying for SOC analysts to do the same tedious tasks every day, so we try to help them by automating the most time-consuming processes so they can focus more on the interesting analysis that requires high-level thought.”

Reduced customer-side effort: HWG Sababa’s Head of Innovation, Marco Fattorelli, shared that another key Torq use case was extending their capabilities to perform containment and remediation actions on the customer side, which they previously couldn’t deliver manually at scale. Now, thanks to Torq, HWG Sababa has augmented their SOC to deliver automated response and enrichment that reduces customer efforts.

Hyperautomation embedded in the roadmap: With Torq in the picture, a new operational difference is that evaluating new technologies or implementing new processes and playbooks now involves a “Hyperautomation-first” consideration upfront to ensure maximum efficiency. Gianmaria says, “If a tool or process can be effectively integrated or automated using Torq, that’s our top priority in the roadmap.”

Cross-functional automation adoption: HWG Sababa is also leveraging Torq to automate processes for other departments, like the domain team, after collaborating to find out their needs. As one team member noted, “Once you see [the value of] something automated, you want more.” Consequently, they’re seeing a steady increase in automations across the board.

Hyperautomation as an MSSP Differentiator

A clear competitive advantage: Marco shared that Torq is helping HWG Sababa differentiate their core managed SOC offerings when approaching new prospects. By leveraging Torq, HWG Sababa can demonstrate optimized internal processes that lead to improved KPIs like Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) — which, in turn, strengthens their customers’ resilience against threats.

Quantifiable value and 24/7 response automation: For HWG Sababa’s existing managed SOC customers, the value of Torq Hyperautomation is made tangible by quantifying the time saved. Whether it’s five, ten, or 15 minutes saved per automated action, the total time recovered adds up to hours per day. By tracking activities performed both internally and for customers, HWG Sababa’s SOC can provide concrete data on time savings, including showing how many tasks are handled outside of regular business hours. This is particularly beneficial as many customers lack 24/7 internal resources, allowing critical remediation actions to occur even when the customer is unresponsive.

“It saves days of time for customers”: The benefits of Torq Hyperautomation’s ability to reduce manual effort for their SOC analysts also extend directly to their customers, as Torq automates specific containment and remediation actions that lessen the burden on the customer’s side. For large clients, these minutes saved accumulate into days of reclaimed time, which they can allocate to more strategic priorities.

With Torq Hyperautomation, HWG Sababa has shattered their old automation limits. The shift from slow, custom coding to being able to build years’ worth of automations in weeks has accelerated their SOC operations, freed their analysts for critical work, and provided quantifiable time savings to customers. The result? A stronger security posture and a decisive edge over the competition.