Tool profile
Torq: cost, fit and limits
Torq is an AI SOC and security automation platform made by Torq, with an Americas headquarters in Denver, that triages, investigates and responds to alerts using agents and hyperautomation workflows. It is sold through demos.
What to know first
Torq presents an AI SOC platform with auto triage, case management, agentic investigation and response, and threat hunting runbooks. The product page lists no prices and directs visitors to a demo. The security page lists SOC 2 Type II, HIPAA alignment, GDPR terms and BSI C5:2020, and names GCP and AWS for infrastructure without regions. Buyers should plan for a demo.
Torq at a glance
| Maker | Torq, United States |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI SOAR Platforms in 2026, rank 3 of 10 |
| Website | torq.io |
Who Torq is best for
SOC teams drowning in duplicate alerts
The triage layer deduplicates events, filters false positives and issues AI verdicts that learn from analyst decisions, with manual override and audit logs.
Healthcare and regulated buyers
The security page lists HIPAA compliance with a Business Associate Agreement available, GDPR terms with a data processing addendum, and BSI C5:2020 certification.
Teams moving to human-on-the-loop response
Torq says response can run autonomously or with human oversight, which suits teams that want to widen automation step by step.
Torq plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| AI SOC platform | Not shown, demo required | Auto triage, investigation agents, agentic response, threat hunting and case management; the site directs visitors to request a demo. |
| Hyperautomation | Not shown | Workflow automation across the security stack, available inside the platform; no separate price is listed on the pages read. |
| Socrates agent | Not shown | A natural-language agentic response layer named on the product page; its packaging is not described. |
Checked November 2026.
What Torq does
- Auto Triage
- Deduplicates events, filters false positives and gives AI verdicts that learn from past analyst decisions. The page says every verdict has an audit log and a manual override.
- Investigation agents
- Specialized agents handle routine investigation tasks and record evidence, timelines and recommended actions for the analyst to review. Analysts then review a ready case file instead of repeating the lookups.
- Agentic response
- Response can run autonomously or with human-on-the-loop oversight, and the platform keeps a context model that records verdicts, overrides and the reasoning behind them. That log supports later review of why an action was taken.
- Threat hunting runbooks
- Agentic runbooks cross-reference historical cases to surface patterns, which gives a small team a way to hunt without building every query by hand. Findings feed the case queue the same way alerts do.
- Case management and reporting
- Cases can be created and assigned automatically, and the platform produces stakeholder reports without a separate tool. Stakeholder reports are generated from the same case data the analysts use.
How Torq handles your data
The security and compliance page lists SOC 2 Type II across security, availability, confidentiality and privacy, with auditor reports on request, plus HIPAA compliance, GDPR compliance with a data processing addendum, and BSI C5:2020 certification. It says Torq relies on GCP and AWS for application infrastructure and that customer data is identified, segregated and encrypted at each stage, without algorithm or key details. It does not state hosting regions, data residency or whether customer data trains AI models.
Where Torq falls short in practice
- Regions and residency unstated. The pages read name GCP and AWS but no regions, which matters for EU buyers who need data kept in a given country. Ask which regions your data would sit in.
- Model training position missing. The security page does not say whether customer data is used for AI training, although it links to AI and data governance pages that were not read.
- No price in public. The product page offers a demo only, so the cost of agents, workflows and cases cannot be estimated beforehand. Ask for a quote based on your alert volume and agent use.
Works with
Alternatives to Torq
Torq: common questions
Is Torq SOC 2 certified?
The security page lists SOC 2 Type II covering security, availability, confidentiality and privacy, with external auditor reports available on request. It also lists HIPAA, GDPR and BSI C5:2020 statements. Request the report under NDA and check the audit period.
Does Torq offer a BAA for HIPAA?
The page says Torq never requires access to protected health information, and that it will sign a Business Associate Agreement with covered entities. Confirm the terms with the vendor before sending any health data. The page also says the infrastructure was found compliant with HIPAA privacy management requirements.
Where does Torq host customer data?
The security page says Torq uses GCP and AWS for application infrastructure. It does not name hosting regions or data residency, so request those in writing, particularly for EU deployments. This matters most when a regulator expects data to remain in a given country.
What does Torq's Socrates do?
The product page names Socrates as a natural-language agentic response capability. The page does not give pricing or packaging details for it, so ask what Socrates includes and how actions are approved. Ask whether it is licensed separately or included in the platform.
Can Torq analysts override AI verdicts?
Yes. The product page says triage verdicts come with audit logs and manual override, and the context model records verdicts, overrides and their reasoning, which feeds later decisions. This supports a gradual rollout where analysts correct the model first and widen autonomy later.