AI in Torq is designed to support day-to-day operational work. Torq uses third-party model providers to power its AI capabilities. It operates within a defined scope, follows instructions and approved tools, and produces outcomes that should be reviewed, audited, and validated.

The following sections explain each of Torq's AI capabilities. When using these capabilities, you are interacting with AI systems powered by third-party AI models.

The Socrates surface hosts Torq's agents (at launch, Investigator and Builder), which are toggled at the top: Builder plans and builds AI agents and workflows, and can make changes across your workspace. Investigator is Socrates working outside a case. Which agents you see in Socrates depends on your permissions.

Torq applies AI directly within the investigation lifecycle to help move cases forward with less manual effort.

Socrates is Torq's custom-built AI Analyst, designed to support investigation and response work within defined boundaries. One way Socrates can be used today is to support and manage security cases using case context and Actionplans (structured runbooks for AI execution).

Socrates can work in two ways:

Socrates is also available outside a case as the Investigator agent on the Socrates surface, always available across your workspace. See Socrates: Investigate Outside a Case.

Socrates can:

Case Summary provides concise, AI-generated overviews of a case's status and key findings. Summaries are generated from existing case data and do not replace underlying evidence or investigation artifacts.

These summaries are designed to facilitate handoffs, escalations, and reviews by reducing the time needed to understand a case's current state. This provides faster context without changing the investigation process, while maintaining full access to detailed information.

Torq uses AI within automation to add practical judgment at runtime, improving outcomes when conditions aren't strictly predictable.

The AI Task operator runs a targeted AI task at a specific point in a workflow. It queries a configurable underlying LLM (Large Language Model) using a prompt you define, the model you select, and optional configuration parameters. The model returns a completion based on the provided context.

AI Task does not have agency. It performs a single operation and returns a result, making it useful when AI is needed for a specific task rather than continuous decision-making. This allows teams to introduce AI incrementally and in a controlled manner.

The AI Task operator can interpret unstructured alert data from legacy or external systems and convert it into structured, usable information. For example, when a plain-text alert is received, the AI Task operator can extract indicators and normalize them into a standard Indicator of Compromise (IOC) format. It can also assess severity based on content and context. This makes it possible to route, enrich, or create cases from inputs that don't follow a consistent schema, without relying on fragile parsing rules.

AI Agents are fully configurable agents that transform SecOps workflows. Like the AI Task operator, they use a prompt and an underlying LLM. The key difference is that AI Agents also use tools: approved actions that the agent can select and execute based on runtime context.

AI Agents have agency. They can reason about what to do next and then execute actions explicitly added to their Toolbox. This makes them well-suited for adaptive automation that would otherwise require complex branching logic.

Torq also provides a library of ready-to-use AI Agents, so teams can start with proven agents and customize them as needed for their environment.

Use the End User Interviewer AI Agent template to collect context from an affected user when an alert needs confirmation. For example, when an Impossible Travel alert triggers, the agent can ask whether the user used a VPN and then route the outcome to the next step based on the response, choosing only from the approved actions in its Toolbox.

Torq also uses AI to reduce the effort required to build workflows. This includes multiple build-time capabilities that help accelerate setup while keeping results fully editable and governed.

Socrates Builder is an autonomous agent that plans, builds, tests, fixes, and maintains production-grade AI agents and workflows on Torq (both agentic and deterministic) through chat. You describe what you need; the Builder plans, generates, validates, and iterates with you, with full context of your workspace (integrations, existing workflows, and execution history).

Unlike single-shot AI-assisted generation, the Builder runs an automated build → validate → test → fix loop. It can also edit existing workflows, create nested and multi-workflow systems, and operate across your whole workspace. It is the Builder agent on the Socrates surface. See Socrates Builder: Getting Started.

AI-assisted parameter population provides step-level suggestions based on context. It can propose scripts, queries, and structured inputs in the format a step expects, which can be reviewed, accepted, or adjusted.

The Co-Builder assists during workflow design by suggesting logical next steps as you build. Available through QuickBuild, it works alongside standard step selection to make building automation more intuitive without replacing manual control.

Generated workflows and parameters remain fully visible, editable, and governed like any other automation. The value lies in faster setup and reduced friction, without compromising on control or transparency.

Torq includes dedicated data transformation capabilities for reshaping and manipulating structured data inside automation. Use the Transform Data operator to extract, map, filter, and restructure JSON using deterministic logic.

AI can also assist with creating the deterministic transformation logic, which can then be reviewed and used as a repeatable transformation.

This is best suited for predictable transformations, such as normalizing payloads, renaming fields, or preparing data for downstream steps, where the input structure is known and consistent. It keeps data handling explicit, repeatable, and easy to reason about, without introducing AI-driven interpretation.

All AI capabilities in Torq operate within defined guardrails. Scope and available tooling are explicitly controlled, and AI runs only where you choose to apply it within cases or automation steps. You maintain the ability to stop, override, or modify AI output.

Sensitive actions can require confirmation, and AI activity is logged with clear attribution. Torq does not use customer data to train AI models without prior written consent. AI actions and outputs remain traceable to user-defined configuration and intent.

These guardrails make it practical to apply AI to real operational work while maintaining trust, accountability, and governance.

All AI outputs should be validated. AI-generated investigations, summaries, and recommendations may contain errors or incomplete analysis. As such, use of AI should augment human expertise, not replace it. We therefore recommend that you review all AI outputs with qualified security professionals and validate findings before taking action.

For more information on AI Governance at Torq, see our website at https://torq.io/ai-governance/.

Torq has achieved ISO 42001 certification. ISO 42001 is an international standard that ensures organizations are managing AI systems responsibly, and that AI is being developed and used ethically and safely. This certification demonstrates Torq's commitment to responsible, compliant, and trustworthy use of AI, and aligns Torq with global and regional regulatory frameworks, including the EU AI Act.

Regarding the EU AI Act, Torq is committed to compliance with its obligations under the Act. In line with the Act's Article 50 transparency requirements, Torq discloses when a user is interacting with an AI system through in-product notices, and provides information in our product documentation on each AI capability and how each capability leverages AI. Torq also maintains an AI literacy program for personnel involved in the development, deployment, and oversight of its AI systems, ensuring staff understand the capabilities, limitations, and appropriate use of AI.

Torq supports both Torq-managed AI and Bring Your Own Subscription (BYOS). Use Torq's managed subscription to get started quickly, or connect your own provider to align AI usage with internal standards, cost considerations, or provider preferences.

This flexibility applies across AI Agents and AI Task operators. With BYOS, providers or models can be changed over time without rebuilding automation.