AI in Torq is designed to support day-to-day operational work. It operates within a defined scope, follows instructions and approved tools, and produces outcomes that can be reviewed, audited, and validated.

Torq applies AI directly within the investigation lifecycle to help move cases forward with less manual effort.

Socrates is Torq’s custom-built AI Analyst, designed to support investigation and response work within defined boundaries. One way Socrates can be used today is to support and manage security cases using case context and Actionplans (structured runbooks for AI execution).

Socrates can work in two ways:

Socrates can:

Case Summary provides concise, AI-generated overviews of a case’s status and key findings. Summaries are generated from existing case data and do not replace underlying evidence or investigation artifacts.

These summaries are designed to facilitate handoffs, escalations, and reviews by reducing the time needed to understand a case’s current state. This provides faster context without changing the investigation process, while maintaining full access to detailed information.

Torq uses AI within automation to add practical judgment at runtime, improving outcomes when conditions aren’t strictly predictable.

The AI Task operator runs a targeted AI task at a specific point in a workflow. It queries a configurable underlying LLM (Large Language Model) using a prompt you define, the model you select, and optional configuration parameters. The model returns a completion based on the provided context.

AI Task does not have agency. It performs a single operation and returns a result, making it useful when AI is needed for a specific task rather than continuous decision-making. This allows teams to introduce AI incrementally and in a controlled manner.

The AI Task operator can interpret unstructured alert data from legacy or external systems and convert it into structured, usable information. For example, when a plain-text alert is received, the AI Task operator can extract indicators, normalize them into a standard IOC format, and assess severity based on content and context. This makes it possible to route, enrich, or create cases from inputs that don’t follow a consistent schema, without relying on fragile parsing rules.

AI Agents are fully configurable agents that transform SecOps workflows. Like the AI Task operator, they use a prompt and an underlying LLM. The key difference is that AI Agents also use tools: approved actions that the agent can select and execute based on runtime context.

AI Agents have agency. They can reason about what to do next and then execute actions explicitly added to their toolbox. This makes them well-suited for adaptive automation that would otherwise require complex branching logic.

Torq also provides a library of ready-to-use AI Agents, so teams can start with proven agents and customize them as needed for their environment.

Use the End User Interviewer HyperAgent template to collect context from an affected user when an alert needs confirmation. For example, when an Impossible Travel alert triggers, the agent can ask whether the user used a VPN and then route the outcome to the next step based on the response, choosing only from the approved actions in its toolbox.

Torq supports both Torq-managed AI and Bring Your Own Subscription (BYOS). Use Torq’s managed subscription to get started quickly, or connect your own provider to align AI usage with internal standards, cost considerations, or provider preferences.

This flexibility applies across HyperAgents and AI Task operators. With BYOS, providers or models can be changed over time without rebuilding automation.

Torq also uses AI to reduce the effort required to build workflows. This includes multiple build-time capabilities that help accelerate setup while keeping results fully editable and governed.

AI-assisted workflow generation lets you describe automation needs in plain language and produces a draft workflow. The draft is intended to get you most of the way there quickly, with room to review and fine-tune details as needed.

AI-assisted parameter population provides step-level suggestions based on context. It can propose scripts, queries, and structured inputs in the format a step expects, which can be reviewed, accepted, or adjusted.

The Co-Builder assists during workflow design by suggesting logical next steps as you build. Available through QuickBuild, it works alongside standard step selection to make building automation more intuitive without replacing manual control.

Generated workflows and parameters remain fully visible, editable, and governed like any other automation. The value lies in faster setup and reduced friction, without compromising on control or transparency.

Torq includes dedicated data transformation capabilities for reshaping and manipulating structured data inside automation. Use the Transform Data operator to extract, map, filter, and restructure JSON using deterministic logic.

AI can also assist with creating the deterministic transformation logic, which can then be reviewed and used as a repeatable transformation.

This is best suited for predictable transformations, such as normalizing payloads, renaming fields, or preparing data for downstream steps, where the input structure is known and consistent. It keeps data handling explicit, repeatable, and easy to reason about, without introducing AI-driven interpretation.

All AI capabilities in Torq operate within defined guardrails. Scope and available tooling are explicitly controlled, and AI runs only where you choose to apply it within cases or automation steps.

Sensitive actions can require confirmation, and AI activity is logged with clear attribution. Torq does not use customer data to train AI models. AI actions and outputs remain traceable to configuration and intent defined by users.

These guardrails make it practical to apply AI to real operational work while maintaining trust, accountability, and governance.