Torq Threw Out Its First Startup Idea - Then Built the AI Security Operator Big Companies Actually Use

The first version of Torq was not Torq. It was StackPulse, a 2020 startup built to help developers and site-reliability engineers respond to outages. The software could orchestrate the frantic work after systems misbehaved, but the founders could not find a repeatable way to sell it. Then the usage logs offered an impolite correction: security teams were doing most of the serious pulling. They were connecting tools, routing alerts and automating responses with a product intended for a broader operations crowd.

Ofer Smadari, Leonid Belkind and Eldad Livni listened. They kept the automation core, threw out the category, renamed the company and aimed directly at security operations. The move sounds inevitable from the far side of a $1.2 billion valuation. It was not. It meant telling investors that the original market thesis had failed while insisting the underlying machine was worth keeping.

The pivot was hiding in plain sight

StackPulse had built for a horizontal problem: incidents happen everywhere, so nearly any technical team might need orchestration. That made the market enormous and the sales story mushy. Security supplied sharper pain. A modern security operations center, or SOC, can receive thousands of alerts from identity systems, endpoints, cloud services, email gateways and threat-intelligence feeds. Each alert may require an analyst to gather context from five tools before deciding whether it is malicious, harmless or merely weird.

Traditional SOAR software tried to tame that work with rigid playbooks. Those playbooks could be powerful, but customers often needed programmers to build and babysit them. An API changed, a field arrived in a new format, an alert spiked, and the automation designed to save labor became another system requiring labor. Torq's answer was a cloud-native, visual workflow engine with parallel execution, a low-code editor and integrations across the security stack.

That foundation matters because the company's newer AI is allowed to do things, not merely summarize them. Torq can enrich a suspicious login, check whether the user is traveling, inspect device history, open a case, ask for approval and disable credentials. The AI may plan the route, but a deterministic execution layer carries out the action and records what happened.

What Torq actually sells

Torq sells enterprise subscriptions, generally through a demo and negotiated order form. Plans can include usage limits for cases, compute and AI credits. One AWS Marketplace offer lists a 12-month contract at $450,000. That number is a useful scale marker, not a universal sticker price. The pitch is economic: a company already owns a crowded shelf of security products; Torq makes those products work together and lets expensive analysts spend more time on judgment.

The customer roster includes Check Point, Chipotle, FICO, PepsiCo, Siemens, Telefónica, Uber, Valvoline, Virgin Atlantic and Wiz. Managed security providers use it to operate across many clients. Torq says hundreds of multinational enterprises run its platform and reported more than one billion security automations a day in 2026. Those are company figures, but customer case studies make the trade concrete: FICO reported a 99.4 percent reduction in mean time to resolution; Valvoline said it recovered seven analyst hours a day; one unnamed real-estate company reported 1,000 hours and $120,000 saved in a quarter.

The comparison is not simply software cost versus salaries. It includes the engineering time spent maintaining old playbooks, the hours between an alert and containment, and the value of tools already purchased but poorly connected. Torq wins when those hidden costs are large and measurable. A five-person company with a quiet inbox and three security tools does not need an autonomous command center.

Agents arrived after the engine

Torq's product roadmap resembles a ladder. Hyperautomation supplied integrations and repeatable execution. Case Management put evidence, ownership and decisions in one record. HyperSOC added Socrates, an AI analyst coordinating specialist agents for runbooks, investigation, remediation and cases. Agentic Builder now turns a plain-language request into a planned and tested workflow. Nothing goes live until a person approves it.

The acquisitions expose what failed next. Generic agents can reason, but they lack company-specific memory and context. Torq bought Revrod in 2025 for multi-agent retrieval and deeper research. It bought Jit in 2026 to add a live context graph of identities, assets, privileges, data sensitivity and business relationships. Then came SOC Brain, designed to learn from prior investigations and analyst decisions. The sequence is revealing: first teach the system to act, then give it context, then teach it local judgment.

This is where Torq differs from an AI triage assistant. It covers the lifecycle from alert through investigation and containment, while retaining the option to use fixed workflows when variability is unwelcome. Its alternatives range from Palo Alto Networks' Cortex XSOAR and Splunk SOAR to Microsoft, Google, CrowdStrike and a crop of AI SOC startups. A customer can also keep writing scripts or outsource the problem to a managed provider. Torq fits between the detection tools and the people, acting as connective tissue, operator and record keeper.

The reader's copyable version

Few readers should copy the $332 million fundraising path. Many can copy the operating logic. Start where demand is embarrassingly obvious. Preserve the technical asset that users value. Narrow the buyer until the sales sentence becomes specific. In implementation, earn autonomy in stages rather than announcing it as a transformation program.

Phishing is a common starting point. The system can extract indicators, check reputation feeds, look for similar messages, identify affected mailboxes and prepare a recommendation. A human approves deletion or account action until precision is established. The work moves from copying data between tabs to reviewing a compact case. That is useful automation without pretending probability is certainty.

Where the machine should stop

Agentic security is a poor fit when the organization cannot identify its assets, agree on escalation policy or restrict credentials. An AI agent operating through a service account inherits the blast radius of that account. Weak permissions do not become safer because the interface uses natural language. Unstable integrations, contradictory runbooks and missing owners turn speed into risk.

Torq acknowledges the boundary in its own product design: Agentic Builder plans, tests and asks before publishing; Socrates escalates cases requiring judgment; audit trails preserve the chain of action. Human-in-the-loop is not a temporary embarrassment on the road to autonomy. In high-consequence systems, it is part of the product.

The company's culture wraps this sober machinery in skeletons, lasers, hot-rod language and a Grave Digger monster truck that appeared at RSAC. Torq even added a branded interface mode alongside light and dark. The theater works because enterprise security software often looks interchangeable. The controls remain conservative while the booth shouts. It is a better contrast than another navy shield logo promising peace of mind.

Torq now occupies a valuable market position. It does not ask a CISO to throw away every detector, identity product or cloud platform. It promises to make that sunk investment coherent. Its real test will be whether SOC Brain learns useful local precedent without laundering yesterday's bad decisions into tomorrow's automated ones. The company has already shown one kind of learning: when the market disagreed with its first idea, it listened.