Last raised 01
140 USD M [CO010, CO011, CV001] Diligence report
Torq
AI SOC platform with strong enterprise traction but limited public financial disclosure.
Torq is a credible AI SOC specialist with strong enterprise traction, but its premium valuation still outruns the public evidence on financial quality.
Coverage and disclosure
Refresh based on September 2026 public evidence. Torq's latest disclosed financial milestone is the January 2026 Series D; product and customer evidence were refreshed from 2026 official updates and current independent coverage.
Cover facts
Company profile
Torq is a New York-headquartered AI SOC and security hyperautomation company founded in 2020 by Ofer Smadari, Leonid Belkind, and Eldad Livni. The platform automates SOC triage, investigation, and response across a large integration surface, and the company now says it serves 300+ enterprise customers, processes 100M+ daily automations, and employs 430+ people. The most recent disclosed financing was a $140 million Series D in January 2026 at a $1.2 billion valuation, with Merlin Ventures leading the round and federal-market expansion as a key use of proceeds.
- Website
- torq.io
- Founded
- 2020-01-01
- Founders
- Ofer Smadari, Leonid Belkind, Eldad Livni
- Founding location
- New York / Israel
- Headquarters
- New York, NY
- Product
- AI SOC platform for security workflow automation, investigation, and response.
- Customers
- Enterprise SOC teams, MSSPs, and regulated organizations.
- Business model
- Enterprise SaaS with partner/channel expansion.
- Stage
- Series D
- Funding status
- $140M Series D at $1.2B valuation; $332M total raised.
Executive summary
Top strengths
- Strong enterprise customer proof and repeated named-logo validation.
- Clear AI SOC positioning with rapid product cadence and broad integrations.
- Meaningful capital base and a credible federal-market expansion story.
Top risks
- Public ARR, margin, retention, and concentration data are still missing.
- SaaS-first delivery and autonomy trust issues can slow regulated adoption.
- Competitive pressure from suite incumbents and native AI features is real.
Open gaps
- Public ARR, gross margin, burn, and runway remain undisclosed.
- Retention and concentration data are still not public.
- The federal-market conversion path needs more evidence.
Contents
01Company Overview
1.1 Identity, Footprint, and Business Model
Torq is a private cybersecurity company founded in 2020 and headquartered in New York, with its main R&D base in Israel. It sells an AI SOC platform that combines hyperautomation, agentic AI, and workflow orchestration to help security teams triage, investigate, and respond to threats. The business is delivered as enterprise software and is positioned as a replacement for legacy SOAR tooling, with a SaaS-first operating model and a wide integration layer spanning SIEM, EDR, identity, cloud, and IT systems. Torq's own site and product pages emphasize self-service automation, AI-assisted investigation, and SOC workflow execution rather than point tools.[CO001, CO002, CO004, CO005]
| Date | Event | Type | Amount / Status | Implication |
|---|---|---|---|---|
| 2020 | Company founded by Ofer Smadari, Leonid Belkind, and Eldad Livni | founding | N/A | Security-operations thesis starts with founder-market fit |
| 2023-06 | Series B closes and HyperSOC / Socrates AI are launched | financing / product | $70M Series B | Platform shifts from workflow automation to AI SOC narrative |
| 2024-09 | Series C closes and expansion accelerates | financing | $70M Series C; total raised $192M | Enterprise growth and channel expansion intensify |
| 2025 | Revenue growth and customer adoption remain strong | scale | ~300% revenue growth | Expansion phase continues into larger enterprise deployments |
| 2026-01 | Series D closes | financing | $140M at $1.2B valuation; total raised $332M | Unicorn status and federal-market push |
| 2026-03 | Agentic Builder announced | product | Launch | Socrates can now build as well as investigate |
| 2026-Q2 | Product spotlight expands cases, reports, and connectors | product | Ongoing updates | Platform breadth keeps increasing |
| 2026-07 | SOC Brain coverage appears in the press | product / positioning | Self-learning layer | Narrative shifts further toward autonomous operations |
| 2026-09 | Company states 430+ employees | scale | 430+ Torqers | Headcount reflects continued hiring |
| 2026-09 | Company states 300+ enterprise customers and 100M+ daily automations | scale | 300+ customers / 100M+ automations | Customer scale supports premium valuation |
Milestones are compiled from Torq's official pages and corroborating market coverage. Growth, automations, and headcount are company-stated and not independently audited.
[CO001, CO003, CO010, CO011, CO012, CO013, CO014, CO015, CO016]1.2 Founders, Leadership, and Key-Person Risk
Torq was founded by Ofer Smadari, Leonid Belkind, and Eldad Livni, who remain the company's visible senior leadership bench. The three founders bring prior security-company experience and have continued to anchor the company narrative through its scale-up phase. That structure is a strength because it keeps product direction close to the original operating thesis, but it also creates key-person concentration: the product, technical, and commercial story still depends heavily on the founding team. Public governance detail remains limited, so outside diligence has less to work with than it would for a public company or a later-stage private issuer.[CO006, CO007, CO009]
| Person | Role | Prior company / context | Why it matters |
|---|---|---|---|
| Ofer Smadari | CEO | Security founder background | Commercial and product narrative anchor |
| Leonid Belkind | CTO | Security technology founder | Technical architecture anchor |
| Eldad Livni | CINO | Security operator and founder | Product / innovation anchor |
Public leadership disclosure is limited beyond the founding team.
[CO006, CO007, CO009]1.3 Funding History, Scale, and Recent Milestones
Torq's most recent capital event was a January 2026 Series D that raised $140 million at a $1.2 billion valuation and brought cumulative funding to $332 million. The company says the round supports product R&D, enterprise expansion, and a push into federal and public-sector markets, with Merlin Ventures providing both capital and go-to-market support. Since the last refresh window, Torq has also shipped Agentic Builder, expanded product updates across cases and reporting, and described SOC Brain as a new self-learning layer on top of the platform. The combination of funding, product cadence, and customer scale suggests the company is still in a rapid investment-and-expansion phase rather than a maturity phase.[CO010, CO011, CO012, CO013, CO014, CO015, CO016, CO017]
| Investor | Round | What the relationship signals | Visibility |
|---|---|---|---|
| Merlin Ventures | Series D lead | Federal / public-sector access and execution help | high |
| Evolution Equity Partners | Series C and D participant | Cybersecurity growth specialist backing | high |
| Bessemer Venture Partners | Series D participant | Long-running enterprise software support | high |
| Insight Partners | Series C and D participant | Scale-up and GTM capital | high |
| Greenfield Partners | Series D participant | Supportive growth capital | medium |
| Notable Capital | Series D participant | Late-stage enterprise validation | medium |
| J.P. Morgan Private Bank | Series D participant | Institutional credibility | medium |
The table is limited to disclosed investors; it does not imply a full cap table.
[CO010, CO012, CO017, CO017]Torq's key milestones from founding to the 2026 Series D and the most recent product releases.
[CO001, CO010, CO011, CO012]02Market Analysis
2.1 Market Boundary and Status Quo
The relevant market is broader than classic SOAR. Torq competes in the overlap of security orchestration, security case management, AI SOC, and workflow automation for SecOps. The status quo alternatives are manual analyst work, legacy SOAR platforms, ticketing-based process chains, and single-vendor automation embedded in SIEM/XDR stacks. Torq's own positioning, analyst commentary, and competitor comparisons all point to the same market boundary: buyers are purchasing automation that can execute work, not just summarize alerts. In practice, that means the category is defined by actionability, governance, and integration depth more than by a single SOAR label.[CM001, CM002, CM003, CM004]
| Segment | Why it matters | Evidence signal | Torq fit | Constraint |
|---|---|---|---|---|
| Enterprise SOCs | Own alert triage, investigation, response | Torq and analysts both emphasize AI SOC automation | Strong | Trust and deployment controls |
| MSSPs / MDRs | Need repeatable, multi-tenant workflows | Partner and comparison pages mention service-provider use | Strong | Margin and reporting requirements |
| Regulated enterprises | Need auditability and controlled automation | Techzine / Swimlane compare governance and AI control | Medium-strong | Explainability and data handling |
| Federal / public sector | Large logging volumes and compliance | Series D press highlights Merlin / FedRAMP path | Emerging | Certification and procurement friction |
| Cloud-first enterprises | Fast deployment and API-heavy stacks | Official site emphasizes integrations and SaaS | Strong | Integration depth expectations rise |
| Air-gapped / on-prem buyers | Need deployment control | Competitor comparisons stress this gap | Weak | SaaS-only delivery limits fit |
| SIEM / XDR users | Need action after detection | SOC Brain and builder narrative | Strong | Native AI features may commoditize value |
| Security engineering teams | Want workflow speed and guardrails | Builder / prompt-based workflow stories | Strong | Learning curve and governance |
| Compliance / audit teams | Need traceability | Swimlane comparison frames the gap | Medium | Audit-ready reporting must be proven |
| Budget owners | Need clear ROI and staffing relief | PeerSpot review quotes ROI and reduced manual work | Strong | Pricing sensitivity and proof burden |
This is a qualitative market lens. Torq does not disclose a public TAM, so the table uses adoption signals rather than a numeric market model.
[CM001, CM005, CM006, CM009, CM010, CM011]2.2 Buyer Segments and Adoption Path
Torq's best-fit buyers are enterprise SOC leaders, MSSP operators, and regulated organizations that need repeatable investigations, strong integrations, and a clear path from triage to response. The adoption path generally starts with a bounded alert- or case-heavy workflow, then expands into more autonomous response once the team trusts the controls and audit trail. Analyst commentary repeatedly stresses that buyers care less about the underlying model and more about workflow design, guardrails, and proof that the platform can show its work. The segmentation is therefore less about company size alone and more about how much operational discipline the buyer already has in the SOC.[CM005, CM006, CM007, CM008]
| Buyer profile | Buying motive | Adoption style | Constraint |
|---|---|---|---|
| Enterprise SOC | Need faster triage and response | Start with one workflow then expand | Needs strong governance |
| MSSP / MDR | Need repeatable multi-tenant automation | Deploy across many customer accounts | Reporting and margin discipline |
| Regulated buyer | Need auditability and deployment control | Proof-first rollout | On-prem / air-gapped expectations |
| Cloud-first buyer | Need integration speed | Broader platform adoption | Integration depth expectations |
This table separates operational style from company size, which is the more useful lens for AI SOC adoption.
[CM005, CM006, CM007, CM008]The strongest forces pushing buyers toward Torq-like AI SOC platforms, alongside the most common brakes on adoption.
[CM005, CM006, CM009, CM010, CM011, CM012]2.3 Growth Drivers, Constraints, and Diligence Gaps
Demand is being driven by alert fatigue, staffing pressure, 24x7 coverage gaps, and the need to operationalize security data already being collected by SIEM and XDR tools. The main constraints are governance, deployment flexibility, and trust: enterprise teams still want explainability, role controls, and an audit trail before they let AI act autonomously. Because public market sizing is inconsistent and Torq does not disclose enough economics for a clean top-down model, the right diligence posture is evidence-constrained rather than precise. That makes the addressable market large but not tightly quantifiable from public evidence alone. The public evidence supports a real category with real demand, but it still does not support a precise numeric sizing thesis without extra diligence.[CM009, CM010, CM011, CM012]
| Gap | Public status | Why it matters | Diligence ask |
|---|---|---|---|
| Top-down market size | Inconsistent across sources | Prevents a clean TAM model | Use evidence-constrained sizing |
| Pricing and packaging | Not public | Makes economics hard to map | Request pricing and ACV bands |
| Retention / expansion | Not public | Shows whether adoption compounds | Request cohort and renewal data |
Torq's addressable market looks real, but the public record does not support a precise sizing model without more operating evidence.
[CM003, CM010, CM012]03Competitors
3.1 Competitive Landscape
Torq competes against both direct AI SOC specialists and larger security vendors that can deliver automation as part of a broader platform. Swimlane is the clearest direct comparator in the public materials we reviewed, while PeerSpot users regularly compare Torq to Microsoft Sentinel, Palo Alto Cortex XSOAR, and other enterprise automation stacks. Torq's strength is the combination of agentic AI, integrations, and workflow speed; its weaker public posture is deployment flexibility, because competitors promote on-prem or air-gapped options that Torq does not foreground. That leaves Torq looking strong on product velocity but less complete on deployment optionality.[CP001, CP002, CP003, CP004]
| Competitor | Role | Public differentiator | Torq implication | Risk level |
|---|---|---|---|---|
| Swimlane | Direct AI SOC / automation rival | Cloud, on-prem, and air-gapped deployment; ISO 42001 messaging | Torq must defend SaaS-only delivery | High |
| Microsoft Sentinel | Suite incumbent | Native security-platform bundling | Torq must win on workflow depth and AI authoring | High |
| Palo Alto Cortex XSOAR | Legacy SOAR incumbent | Deep SOC footprint and enterprise installed base | Torq faces replacement friction | High |
| Tines | Adjacent automation vendor | Automation-first workflows and broad IT/security use | Torq must show better SOC specificity | Medium |
| BinkOps | Adjacent workflow competitor | Agentic workflow positioning | Torq needs clearer differentiation | Medium |
| Stellar Cyber | Open XDR platform | Integrated XDR + automation partnership story | Torq competes in workflow layer | Medium |
| Reco | SaaS-security adjacency | Partner ecosystem and SaaS visibility | Torq's partner story must stay strong | Medium |
| Manual SOC ops | Status quo substitute | No platform change required | Torq's ROI proof must be strong | High |
| SIEM-native AI triage | Bundle substitute | Automation embedded in existing spend | Torq risk of commoditization | High |
| Internal scripting / homegrown automation | DIY substitute | No vendor lock-in | Torq must justify SaaS subscription | Medium |
The table is a qualitative competitor map. Several rivals are analyzed via their own marketing pages or user review commentary rather than formal financial disclosures.
[CP001, CP002, CP003, CP009, CP010]3.2 Differentiation, Switching Costs, and Distribution
The main reasons Torq can win are workflow depth, AI-assisted builder experiences, and a channel ecosystem that helps it reach large enterprises and MSSPs. The main reasons it can lose are feature parity pressure, reporting and governance concerns, and incumbent distribution power from vendors already sitting inside the security stack. In practice, this means Torq looks more like a fast-growing specialist than a category monopolist. Buyers that value speed and AI-assisted authoring are likely to prefer Torq; buyers that value deployment control or audited governance may prefer a more conservative incumbent. The key question is whether workflow depth creates enough switching cost to offset the bigger vendors' distribution reach.[CP005, CP006, CP007, CP008]
| Rival | Main public pitch | Torq consequence | Strategic read-through |
|---|---|---|---|
| Swimlane | SaaS, on-prem, and air-gapped flexibility | Torq must defend SaaS-first delivery | Flexibility is a live differentiator |
| Microsoft Sentinel | Platform bundling inside the security stack | Torq must prove workflow depth | Incumbent distribution matters |
| Palo Alto Cortex XSOAR | Deep enterprise SOC footprint | Torq faces replacement friction | Switching costs are real |
| Tines | Automation-first workflows | Torq needs stronger SOC specificity | Category overlap remains high |
This table highlights the claims competitors use to make Torq look narrow or less flexible.
[CP001, CP002, CP004, CP005]A directional view of the features and distribution advantages that matter most in Torq's competitive set.
[CP005, CP006, CP007, CP009, CP010, CP011]3.3 Substitutes, Commoditization, and Adverse Signals
The biggest threat is not a single rival; it is commoditization. As XDR and SIEM vendors add more native AI triage, Torq must defend a software wedge that can look increasingly similar to adjacent products. User-review sites and competitor marketing pages also point to practical friction around reporting, learning curve, and deployment control. Those are not existential weaknesses, but they are enough to keep Torq in the "prove it" bucket rather than the "category winner" bucket. The risk is less a single rival and more the steady pressure of features becoming interchangeable over time.[CP009, CP010, CP011, CP012]
| Substitute | Why buyers might stay put | Torq challenge | Risk level |
|---|---|---|---|
| Manual SOC ops | No migration effort | Must prove ROI clearly | High |
| SIEM-native AI triage | Already inside the stack | Torq needs obvious workflow advantage | High |
| Internal scripting | Custom fit and no vendor lock-in | Torq must justify subscription spend | Medium |
The table keeps the focus on the least glamorous but most realistic alternatives to switching.
[CP009, CP010, CP011, CP012]04Financials
4.1 Revenue Model, Pricing, and Growth Signals
Torq sells enterprise security software, but the public record does not disclose a clean pricing sheet or audited revenue model. What is visible is the growth narrative: the company says revenue increased by roughly 300% in 2025, and third-party coverage repeats that Torq is gaining traction with large enterprises and federal-focused investors. The implied economics are strong enough to support a $1.2 billion valuation, but not transparent enough to underwrite a precise ARR model from public data alone. Pricing is still inferred from customer scale, deployment breadth, and contract intensity rather than from a published rate card or audited revenue bridge.[CI001, CI002, CI003, CI004]
| Date | Event | Amount | Evidence type | Diligence read-through |
|---|---|---|---|---|
| 2023-06 | Series B | $70M | official / news | Initial hypergrowth financing round |
| 2024-01 | Series B expansion | $42M | news | Keeps momentum going into 2024 |
| 2024-09 | Series C | $70M | official / news | Growth round with explicit 2026 ARR target |
| 2025 | Reported revenue growth | ~300% | company / news | Demand appears to be scaling quickly |
| 2026-01 | Series D | $140M | official / news | Unicorn valuation and growth acceleration |
| 2026-01 | Total funding | $332M | official / news | Deep capital base for expansion |
| 2026-01 | Valuation | $1.2B | official / news | Premium private-market pricing |
| 2026-01 | Hiring plan | +200 employees | official / news | Spend continues to rise |
| 2026 | Federal market push | Merlin Ventures support | official / news | Longer-cycle revenue opportunity |
| 2026 | Public ARR disclosure | Not disclosed | absence of disclosure | Underwriting remains estimate-heavy |
This table intentionally mixes disclosed facts and disclosure gaps. The absence of ARR, margin, and cash data is itself an important diligence signal.
[CI001, CI002, CI005, CI009, CI010]4.2 Capital Structure, Runway, and Use of Proceeds
The company has raised capital in enough size to keep scaling, but the latest public data still leaves the cash profile opaque. The Series D was explicitly framed as funding for R&D, go-to-market expansion, and federal market entry. That means the round was at least as much about growth acceleration as balance-sheet support. Because there is no public burn or runway disclosure, diligence should assume another financing cycle is likely if the company continues to spend heavily on hiring and federal readiness. The capital base is meaningful, but the real question is whether the company can convert the round into durable operating leverage before expansion costs outrun the growth story.[CI005, CI006, CI007, CI008]
Torq's capital history from Series B through Series D shows a rapid transition from growth financing to unicorn scale-up capital.
[CI001, CI002, CI003, CI005, CI006, CI007]4.3 What the Public Record Still Does Not Show
The biggest financial gap is the absence of audited operating metrics. Torq does not publicly disclose ARR, gross margin, customer concentration, or retention cohorts. That means investors have to price the company off funding multiples, growth claims, and strategic position rather than a defensible financial model. The result is a high-growth, high-opacity profile: attractive if the operating story is real, but still difficult to underwrite with the precision one would want before a large private-market entry. Skeptical coverage also reminds readers that AI-security valuations can outrun disclosed fundamentals, so the margin for error stays tight until the data room fills in the missing numbers.[CI009, CI010, CI011, CI012, CI013]
| Metric | Public status | Why it matters | Underwriting impact |
|---|---|---|---|
| ARR | Not disclosed | Core revenue anchor for any valuation multiple | Blocks clean ARR-based pricing |
| Gross margin | Not disclosed | Shows how much growth is left after delivery costs | Prevents a full model check |
| Burn / runway | Not disclosed | Determines whether spending is self-funding or capital-dependent | Makes timing risk harder to judge |
| Customer concentration | Not disclosed | Reveals single-account exposure | Changes downside severity |
| Retention / expansion | Not disclosed | Shows whether growth is durable | Keeps the premium thesis conditional |
This is an underwriting checklist, not a forecast table. The gaps are the point: the public record does not yet provide enough data to convert Torq's growth story into a precise financial model.
[CI007, CI009, CI010]| Source | What it implies | Read-through |
|---|---|---|
| The Register | AI security valuations can assume near-perfect execution | Premium pricing deserves a larger discount until execution is proven |
| Ars Technica | Autonomous SOC claims still need production validation | AI-led automation is not a substitute for evidence |
| Torq Series D coverage | $1.2B pricing with strong growth narrative | Upside exists, but the public proof set remains incomplete |
The table intentionally pairs skeptical coverage with the company's own disclosure so the valuation discussion stays evidence-first rather than momentum-first.
[CI002, CI009, CI012]05Product & Technology
5.1 Product Definition and Workflow
Torq is a cloud-delivered security operations platform that sits between detection and response. It ingests alerts and events, normalizes them into cases, automates investigation steps, and can trigger response actions across connected tools. In the company's 2026 product updates, Socrates can now both investigate and build, which pushes Torq from a workflow engine toward a more agentic authoring environment. That shift matters because it reduces the amount of manual playbook coding a SOC team has to do. It also makes the product more legible to operational teams that want to author and audit workflows in the same place.[CE001, CE002, CE003, CE004]
| Capability | Evidence | Why it matters | Risk / caveat |
|---|---|---|---|
| Socrates Builder | Build and modify workflows via chat | Cuts engineering effort for playbook authors | Needs user trust and control |
| Investigator / case workflow | Case-centric triage and investigation | Lets Torq orchestrate the SOC | Can feel rigid if case model is off |
| Case dashboards | New dashboard dimensions and reports | Adds reporting visibility | Still depends on user configuration |
| Notification inbox | Centralized failure / approval / alert view | Keeps operators inside the product | Only as good as integrations |
| Org-managed roles | Org-level permissions and governance | Helps large enterprises scale access | Governance must be proven |
| Group assignment | Team-based access and case routing | Improves operating model | Adds admin complexity |
| Native connectors | SentinelOne and Microsoft Defender announced | Expands ingest coverage | Integration maintenance burden |
| Step runners | Privileged Podman step runners | Supports more controlled execution | Deployment complexity remains |
| SOC Brain | Recall / Reflex / Retrospect layers | Creates learning narrative | Black-box risk remains |
| Partner program | AMP alliance / partner ecosystem | Extends reach and data sources | Channel execution matters |
The table mixes shipped features and product narrative. All rows are based on Torq's public updates or corroborating partner coverage.
[CE001, CE002, CE005, CE009]5.2 Architecture, Integrations, and Operating Model
The platform still depends on integrations and reusable workflow primitives. Official updates mention hundreds of connectors, scheduled reports, notification inboxes, case dashboards, org-managed roles, group assignment, and step-runners. The technical pattern is clear: Torq wants to be the control plane for security workflows, not just the alert console. That gives the product a real systems advantage if the integrations are reliable, because the value compounds as customers wire more of their security stack into the platform. The flip side is that every connector adds reliability work, so product quality depends on ongoing maintenance discipline.[CE005, CE006, CE007, CE008]
| Surface | What it shows | Why it matters | Risk / caveat |
|---|---|---|---|
| Builder | Plan, build, test, refine, publish | Shows controlled authoring | Still needs user trust |
| Case dashboards | Operational visibility into cases and reports | Improves operator workflow | Depends on configuration |
| Notification inbox | Centralized approvals and alerts | Keeps operators in product | Only as good as integrations |
| Connectors | SentinelOne / Defender and more | Expands coverage | Maintenance burden rises |
The table focuses on the surface area most likely to matter in day-to-day operations.
[CE003, CE005, CE006, CE007]The 2026 release stream shows Torq shipping from basic product updates into a more agentic, control-plane style platform.
[CE003, CE004, CE005, CE006, CE009, CE010]5.3 Maturity, Differentiation, and Technical Risk
Torq's differentiation is strongest where it blends AI with deterministic workflow execution. The company has begun to describe multi-agent learning, context graphs, and natural-language builder workflows, which makes the platform feel more modern than classic SOAR. The remaining risks are familiar: cloud-only delivery, the burden of keeping many connectors healthy, and the possibility that competitors can copy the surface features faster than Torq can deepen its moat. Product maturity is good enough for large enterprises, but the evidence still suggests rapid iteration rather than a fully settled platform. That makes the product compelling, but it also leaves room for competitors to catch up if Torq stops shipping quickly.[CE009, CE010, CE011, CE012]
| Topic | Public signal | Read-through | Risk / opportunity |
|---|---|---|---|
| SOC Brain | Recall, Reflex, Retrospect narrative | AI learning layer is real | Needs continued validation |
| Partner program | AMP and ecosystem motion | Distribution is broadening | Channel execution matters |
| Internal use | Torq uses Torq in SDLC workflows | Product has practical dogfooding | Not yet a full proof of moat |
The table ties maturity to what Torq already uses internally and how it is extending externally.
[CE009, CE010, CE011, CE012]06Customers
6.1 Customer Base and Segment Mix
Torq's stated customer base spans Fortune 500 enterprises, regulated organizations, and managed security partners. The company names Marriott, PepsiCo, Procter & Gamble, Siemens, Uber, Virgin Atlantic, Valvoline, Check Point, Chipotle, Armis, Informatica, Wiz, and others in public material. Those names signal that Torq is not a small-team tool: it is being deployed where the SOC is already a large, business-critical function. The customer list also suggests that Torq is moving beyond a single vertical and into multiple enterprise motions, which is important because breadth usually matters as much as logo quality at this stage.[CU001, CU002, CU003, CU004]
| Evidence | What it shows | Confidence | Diligence note |
|---|---|---|---|
| Marriott / PepsiCo / P&G / Siemens | Large multinational enterprise adoption | medium | Named in official Series D materials |
| Uber / Virgin Atlantic / Wiz | Broader Fortune 500 / large enterprise adoption | medium | Named in official Series D materials |
| Valvoline | Fast deployment and workflow value | medium | Customer quote in Series D release |
| Check Point | High automation of internal security alerts | medium | Series C release customer quote |
| Chipotle / Armis / Informatica | Breadth across verticals | medium | Named customer logos in company materials |
| MSSP / MDR partners | Partner-led delivery path | medium | Reco and Stellar Cyber coverage |
| Fortune 100 / Fortune 500 | Enterprise-scale deployment | medium | Official company narrative |
| 300+ customers | Scale signal | medium | Company-stated and unaudited |
| 100M+ daily automations | Operational usage signal | medium | Company-stated and unaudited |
| No public NRR / churn | Retention gap | high | Still a key diligence blocker |
This table uses public customer references only. It is intentionally a mix of positive adoption signals and the biggest public gaps in customer diligence.
[CU001, CU005, CU009, CU010]6.2 Adoption Evidence and Use Cases
The strongest adoption signals are production usage and concrete workflow examples. Torq's own site and customer stories describe large daily automation volumes, rapid deployment of AI agents, and SOC workflows that span phishing triage, alert handling, remediation, and incident response. Partner coverage reinforces this by framing Torq as an operating layer for MSSPs and adjacent security platforms rather than a demo-only product. The implication is that Torq has real users, not just design partners. That said, the evidence is still mostly point-in-time and logo-based, so the public record supports adoption but not yet a full cohort analysis.[CU005, CU006, CU007, CU008]
| Proof point | What it implies | Public signal | Diligence read-through |
|---|---|---|---|
| Named Fortune 500 logos | Enterprise validation | Official customer names and quotes | Shows Torq can land inside large SOCs |
| Partner deployment | Channel-led distribution | Reco and Stellar Cyber coverage | Suggests MSSP and multi-tenant motion |
| Daily automations | Production usage | Company-stated scale claim | Signals operational depth if accurate |
| 48-hour usefulness quote | Fast time to value | Valvoline customer quote | Suggests onboarding can be rapid |
This is a proof-of-adoption table rather than a full customer roster. It emphasizes public signals that look like live deployment, not just evaluation-stage activity.
[CU005, CU006, CU007, CU008]The strongest public proof points are enterprise logos, real workflow quotes, and partner-channel deployment.
[CU001, CU005, CU007, CU009, CU010]6.3 Retention, Expansion, and Concentration Gaps
The public record does not show cohort retention, NRR, or churn, so the quality of the customer base has to be inferred from named logos and usage claims. That creates a gap: a company can have strong logo counts without proving expansion economics. The channel story also creates a second concentration risk because some of the growth is likely to flow through MSSP and partner relationships that are not fully disclosed. Net: the customer base looks real and growing, but not yet fully measurable from public evidence. The key diligence question is whether the visible usage translates into durable expansion, or whether the company is still carrying too much of its growth story in anecdotes rather than metrics.[CU009, CU010, CU011, CU012, CU013]
| Risk | Public evidence | Why it matters | What to ask in diligence |
|---|---|---|---|
| NRR / churn opacity | No public cohort metrics | Hard to tell if adoption is compounding | Request renewal cohorts and expansion by vintage |
| Customer concentration | No disclosed top-account mix | One large account could skew results | Request top-10 revenue share and contract terms |
| Partner concentration | MSSP motion is material but not quantified | Channel wins may hide concentration risk | Request partner-sourced ARR and churn |
The table keeps the public gap front and center: strong logos are not the same thing as measurable retention quality, and partner-led growth can obscure the true customer mix.
[CU009, CU011, CU013]07Risks
7.1 Product, Deployment, and Market Risks
The clearest risk is that Torq's public narrative leads with SaaS-delivered agentic AI just as many regulated buyers still ask for deployment control and auditability. Competitor comparison pages lean hard into that gap, and user-review data shows that Torq still has learning-curve and reporting complaints. That does not make the product weak, but it does mean adoption can stall when buyers compare it to platforms that feel safer to govern. In other words, Torq is selling a more advanced promise into a market that still wants a conservative proof set, especially in regulated environments where proof can matter more than novelty today.[CR001, CR002, CR003, CR004]
| Risk | Why it matters | Evidence | Severity | Mitigation |
|---|---|---|---|---|
| SaaS-only deployment | Limits fit for air-gapped or on-prem buyers | Swimlane comparison page | High | Prove enough control for regulated buyers |
| AI trust / black-box concerns | Autonomy still needs explainability | Techzine / KuppingerCole commentary | High | Keep human-in-the-loop controls visible |
| Reporting and dashboard friction | Can slow adoption in mature SOCs | PeerSpot and competitor pages | Medium | Keep shipping governance and reporting features |
| Competition from suite incumbents | Native AI in XDR/SIEM can commoditize the wedge | PeerSpot / market commentary | High | Deepen workflow differentiation |
| Founder concentration | Leadership risk if a founder departs | Company page / public profile | Medium | Broaden visible leadership bench |
| Disclosure opacity | ARR, margins, burn, and NRR are not public | News coverage | High | Improve investor transparency in the data room |
| Premium valuation | Leaves less room for execution misses | Series D coverage | High | Maintain growth and expansion pace |
| Federal-market execution | Compliance timelines can slip | Series D / InfoSec coverage | Medium | Use Merlin's market access effectively |
| Customer concentration unknowns | No public concentration data | No disclosure | Medium | Surface retention and top-customer mix |
| Integration maintenance burden | Many connectors create operational load | Product updates / official site | Medium | Invest in reliability and testing |
The table emphasizes issues that are visible in public sources. It intentionally separates market risk from disclosure risk because the latter is a diligence limitation, not just a product problem.
[CR001, CR002, CR005, CR007, CR009]7.2 Financial, Execution, and Concentration Risks
Torq is also exposed to standard scale-up risks: expensive hiring, premium valuation expectations, and a need to keep product velocity high while expanding into federal and public-sector markets. The customer record is real, but public evidence does not show NRR, churn, or concentration, so the quality of revenue remains partly hidden. Finally, Torq's founder-led narrative is a strength and a concentration risk at the same time. The financial risk is not that the business is fictitious; it is that the public evidence is still too thin to determine how resilient the growth story really is. Until those metrics are visible, the company remains a good business story with an incomplete risk map.[CR005, CR006, CR007, CR008]
| Layer | What can go wrong | Why it matters | Mitigation |
|---|---|---|---|
| Product | Deployment and AI-trust friction | Can slow early adoption | Show controls and governance |
| Financial | Opacity on ARR and margins | Makes underwriting difficult | Request the data room bridge |
| Execution | Hiring and federal-market complexity | Raises burn and timing risk | Stage spending carefully |
| Strategic | Native AI commoditization | Could shrink the wedge | Deepen workflow differentiation |
This table separates product, financial, execution, and strategic risks so the public evidence stays organized.
[CR001, CR005, CR007, CR009]The highest-risk items cluster around deployment flexibility, trust, and competitive commoditization.
[CR001, CR002, CR005, CR007, CR009, CR010]7.3 Strategic Triggers and Kill Criteria
The most important strategic trigger is whether native AI from larger security vendors erodes the need for a dedicated automation layer. If XDR or SIEM suites close the gap quickly, Torq must continue proving that it delivers differentiated workflow execution and not just a different wrapper on the same triage problem. Until then, the right posture is to treat the company as promising but still evidence-heavy. The kill criteria are therefore less about a single bad quarter and more about a durable loss of product differentiation.[CR009, CR010, CR011, CR012]
| Trigger | What would change | Why it matters | Response |
|---|---|---|---|
| Deployment flexibility gap persists | Regulated deals slow or stall | Limits TAM and velocity | Broaden control options |
| Retention data disappoints | Expansion thesis weakens | Raises valuation pressure | Reprice the risk |
| Suite vendors close the AI gap | Feature parity increases | Commoditization risk rises | Lean harder into workflow depth |
The table highlights the few events most likely to change Torq's risk profile quickly.
[CR001, CR002, CR007, CR009]08Valuation
8.1 Investment Thesis and Antithesis
The bull case is straightforward: Torq sits in a growing AI SOC category, has credible enterprise traction, and is shipping product at a fast pace. The bear case is also straightforward: public financial detail is thin, the platform still has to prove it can defend against suite incumbents, and the company is priced like a winner already. Those two forces pull in opposite directions, which is why the name sits closer to "track" than "buy" for a public-evidence-only diligence pass. Skeptical coverage also warns that AI-security valuations can get ahead of execution, so Torq's premium needs to be earned rather than assumed.[CV001, CV002, CV003, CV004, CV013]
| Case | Read-through | Indicative valuation view | What has to be true | Risk |
|---|---|---|---|---|
| Bear | Growth slows and suite vendors compress the wedge | Below current price support | No public ARR proof and weaker adoption | High |
| Base | Torq keeps growing but at a more normal rate | Around current valuation | Strong ARR and retention data in the data room | High |
| Bull | Torq becomes a category leader in AI SOC | Premium to current valuation | Defensible workflow moat plus federal traction | Medium |
| Public-comp lens | Strategic rather than strict multiples | Premium private-market pricing | Comparable category leadership evidence | High |
| Proof requirement | Need operating metrics | Cannot fully underwrite | ARR, margin, NRR, and concentration | High |
| Entry posture | Wait for more visibility | Track until diligence closes | Better data room or lower price | Medium |
| Downside trigger | Native AI closes the gap | Re-rate risk | Feature parity from incumbents | High |
| Upside trigger | Agentic automation proves durable | Multiple expansion | Repeatable enterprise expansion | Medium |
| Customer proof | Named logos and quotes exist | Supports premium | Production usage broadens | Medium |
| Financial proof | Still opaque | Blocks precision | Need audited metrics | High |
Scenario labels are intentionally qualitative because public ARR is not disclosed. This table should be read as a valuation framework, not a mathematical forecast.
[CV001, CV002, CV005, CV009, CV013]8.2 Valuation Context and Comparable Lens
Torq's $1.2 billion Series D valuation is high on any private-market lens, especially because ARR is not public. A strict multiple comparison is therefore not possible, so the cleanest comparison set is strategic: vendor category fit, customer proof, product velocity, and the ability to keep growing against larger suites. Public comparables and financing pages show that the market is willing to pay for category leadership in AI SOC, but the premium only holds if Torq keeps proving it is more than a feature layer. The decision point is whether the company can convert product momentum into a durable operating model before the market discounts the AI SOC category as another security-suite feature race.[CV005, CV006, CV007, CV008]
| Source | Concern | Valuation read-through |
|---|---|---|
| The Register | AI security premiums can assume too much execution | Keep a discount for disclosure opacity |
| Ars Technica | Autonomous SOC claims still need production proof | Do not overpay for narrative alone |
| Torq's own Series D release | Growth is real but financially opaque | Premium is possible, but only with diligence |
This table pairs bullish and skeptical evidence so the chapter stays anchored to public proof rather than extrapolation.
[CV003, CV005, CV013]An illustrative scenario view that keeps the current $1.2B valuation in the context of bear/base/bull outcomes.
[CV001, CV002, CV005, CV009, CV010]8.3 Recommendation, Confidence, and Diligence Ask
The recommendation remains track with medium confidence. Torq has enough evidence of real usage, real logos, and real product momentum to avoid an avoid call, but not enough public financial depth to justify a cleaner positive call. The main diligence ask is simple: validate ARR, retention, customer concentration, and margin structure in the data room before assuming the current premium is fully earned. If those metrics come back strong, the current valuation can be defended; if they do not, the premium becomes hard to justify.[CV009, CV010, CV011, CV012]
| Ask | Why it matters | If positive, then | If negative, then |
|---|---|---|---|
| ARR bridge | Shows whether the revenue base is real and growing | Support a fuller valuation case | Keep the rating at track |
| NRR / churn | Reveals product stickiness | Reduce downside discount | Treat the premium as fragile |
| Gross margin | Shows if growth is efficient | Validate scale economics | Assume more dilution risk |
| Customer concentration | Exposes account-level risk | Support a wider moat thesis | Apply a larger haircut |
The table focuses on the minimum evidence Torq needs to graduate from interesting growth story to better underwritten asset.
[CV008, CV011, CV012]Disclaimer
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.
Evidence index
| ID | Statement | Confidence | Sources |
|---|---|---|---|
| CO001 | Torq was founded in 2020. | High | SO002, SO007 |
| CO002 | Torq is headquartered in New York and operates with a major R&D presence in Israel. | Medium | SO003, SO007, SO008 |
| CO003 | Torq describes itself as an AI SOC platform for triage, investigation, and response. | High | SO001, SO003 |
| CO004 | Torq's business model is enterprise software delivered as a SaaS platform. | Medium | SO001, SO004 |
| CO005 | Torq markets a broad security integration layer across SIEM, EDR, identity, cloud, and IT systems. | High | SO001, SO004 |
| CO006 | Torq was founded by Ofer Smadari, Leonid Belkind, and Eldad Livni. | High | SO002, SO006, SO007 |
| CO007 | Public governance disclosure remains limited relative to a public company. | Medium | SO002, SO005, SO006 |
| CO009 | The founding team concentration is a key-person risk because the platform story still depends on the co-founders. | Medium | SO002, SO003, SO007 |
| CO010 | Torq closed a $140 million Series D in January 2026. | High | SO003, SO007, SO008 |
| CO011 | The Series D implied a $1.2 billion post-money valuation. | High | SO003, SO007, SO008 |
| CO012 | Torq says cumulative funding reached $332 million after the Series D. | High | SO003, SO007, SO008 |
| CO013 | Torq says it has 300+ enterprise customers. | Medium | SO003, SO001 |
| CO014 | Torq says it runs more than 100 million daily automations. | Medium | SO002, SO003 |
| CO015 | Torq's public materials indicate 430+ employees or Torqers worldwide. | Medium | SO002, SO003, SO008 |
| CO016 | The company planned to add about 200 employees in 2026 after the Series D. | Medium | SO003, SO007 |
| CO017 | Torq's January 2026 financing was tied to federal and public-sector expansion through Merlin Ventures. | High | SO003, SO008 |
| CM001 | Torq competes in the overlap of SOAR, AI SOC, and broader SecOps workflow automation. | Medium | SM001, SM005, SM007 |
| CM002 | The status quo alternatives include manual analyst work and legacy SOAR platforms. | Medium | SM001, SM003, SM004 |
| CM003 | Buyers are purchasing automation that can execute work, not just summarize alerts. | Medium | SM001, SM002, SM007 |
| CM004 | Analyst commentary frames the market as one where trust, control, and transparency determine adoption. | High | SM001, SM002, SM004 |
| CM005 | Large enterprise SOCs are the most obvious first adopters because they already own the alert backlog. | Medium | SM004, SM005, SM006 |
| CM006 | MSSPs and MDRs are attractive because they can monetize repeatable, multi-tenant workflows. | Medium | SM007, SM008, SM004 |
| CM007 | Regulated and federal buyers care most about explainability, governance, and deployment control. | High | SM002, SM003, SM001 |
| CM008 | Adoption usually starts with a bounded workflow before teams let the system act more autonomously. | High | SM001, SM002, SM004 |
| CM009 | Alert fatigue and 24x7 staffing gaps are the most visible demand drivers. | Medium | SM002, SM004, SM005 |
| CM010 | Deployment flexibility is a material constraint because competitors advertise on-prem and air-gapped options. | Medium | SM003, SM004 |
| CM011 | Torq's partner program is a market-expansion lever rather than just a channel accessory. | Medium | SM007, SM008 |
| CM012 | Public evidence is not sufficient to build a precise TAM, so evidence-constrained sizing is the safer diligence posture. | Medium | SM001, SM002, SM004 |
| CP001 | Swimlane is the clearest direct public rival because it compares itself explicitly against Torq. | High | SP001, SP004 |
| CP002 | PeerSpot review data shows buyers compare Torq against Microsoft Sentinel and Palo Alto Cortex XSOAR. | Medium | SP002 |
| CP003 | Torq's most obvious threat is not one named rival but suite incumbency and embedded automation inside larger platforms. | Medium | SP004, SP005, SP008 |
| CP004 | Competitor pages highlight deployment flexibility and auditability as key differentiators against Torq. | High | SP001, SP004 |
| CP005 | Torq's workflow depth and AI authoring are the most defensible parts of its wedge. | Medium | SP005, SP007, SP008 |
| CP006 | Torq's channel and partner ecosystem is a meaningful distribution asset. | Medium | SP006, SP007, SP008 |
| CP007 | User-review commentary suggests Torq has a learning curve and can be hard for beginners. | Medium | SP002, SP003 |
| CP008 | Reporting and dashboard flexibility are recurring points of comparison in the public materials. | Medium | SP001, SP002 |
| CP009 | XDR and SIEM-native AI triage create a commoditization risk for Torq's lower-end use cases. | Medium | SP001, SP004, SP008 |
| CP010 | Torq can still win when buyers need specialized SOC workflow execution rather than generic automation. | Medium | SP005, SP007 |
| CP011 | Manual SOC operations remain a viable substitute wherever automation proof is weak or budgets are constrained. | Medium | SP002, SP003 |
| CP012 | Torq is in a prove-it phase rather than a winner-take-all phase. | Medium | SP001, SP002, SP004 |
| CI001 | Torq's latest disclosed financing is a $140 million Series D. | High | SF001, SF002, SF005, SF006 |
| CI002 | The Series D valued Torq at $1.2 billion post-money. | High | SF001, SF002, SF003, SF006 |
| CI003 | Torq's financing history shows repeated large rounds that support a growth-expansion narrative. | Medium | SF001, SF005, SF008 |
| CI004 | Torq's 2025 revenue growth claim is about 300% year over year. | Medium | SF003, SF001 |
| CI005 | The Series D proceeds are aimed at R&D, go-to-market expansion, and federal/public-sector entry. | High | SF001, SF006 |
| CI006 | Merlin Ventures led the Series D and signals a federal-market relationship advantage. | High | SF001, SF002, SF006 |
| CI007 | Torq's public financial model remains opaque because ARR, margins, and burn are not disclosed. | Medium | SF001, SF002, SF008 |
| CI008 | The company appears to be spending aggressively on hiring and expansion rather than conserving capital. | Medium | SF001, SF002, SF003 |
| CI009 | Public evidence does not support a clean ARR multiple calculation for Torq. | Medium | SF001, SF002, SF004, SF008 |
| CI010 | Torq's capital base is large enough to sustain continued product and sales investment through the next growth phase. | Medium | SF001, SF005, SF006 |
| CI011 | The 2024 Series C and 2026 Series D suggest the company is still in a strong scale-up financing cycle. | Medium | SF004, SF001 |
| CI012 | Torq's public valuation remains premium relative to the limited public financial disclosure available. | Medium | SF001, SF002, SF008 |
| CI013 | Skeptical coverage suggests Torq's premium can only hold if execution stays near-perfect. | Medium | SF009, SF006 |
| CE001 | Torq is a cloud-delivered security operations platform. | High | SE001, SE007 |
| CE002 | Torq's core workflow is ingest, normalize, investigate, and respond. | High | SE001, SE007 |
| CE003 | Socrates can now both build and investigate workflows. | High | SE002, SE003 |
| CE004 | The Builder experience uses plan, build, test, refine, and explicit publish controls. | Medium | SE003 |
| CE005 | Torq shipped new case dashboards, scheduled reports, and notification inbox features in 2026. | Medium | SE002 |
| CE006 | Torq added org-managed roles and group assignment to strengthen access control. | Medium | SE002 |
| CE007 | Torq announced native SentinelOne and Microsoft Defender connectors. | Medium | SE002 |
| CE008 | Torq supports privileged Podman step runners for controlled execution. | Medium | SE002 |
| CE009 | SOC Brain adds Recall, Reflex, and Retrospect as a learning layer on top of Torq. | Medium | SE004 |
| CE010 | Torq's partner program is an important extension mechanism for integrations and distribution. | Medium | SE005 |
| CE011 | The SDLC automation blog shows Torq using itself internally for application-security workflows. | Medium | SE006 |
| CE012 | Torq's product cadence indicates continued rapid iteration across workflow, governance, and AI surfaces. | Medium | SE002, SE003, SE004 |
| CU001 | Torq publicly names Marriott, PepsiCo, Procter & Gamble, Siemens, Uber, Virgin Atlantic, and Wiz as customers. | High | SU001, SU002 |
| CU002 | Torq also names Check Point, Chipotle, Armis, Informatica, Kyocera, and Valvoline in public materials. | High | SU001, SU002 |
| CU003 | Torq describes itself as serving Fortune 500 and Fortune 100 organizations. | Medium | SU001, SU002 |
| CU004 | Torq says it has 300+ enterprise customers. | Medium | SU001, SU002 |
| CU005 | The Valvoline customer quote says Torq was useful within 48 hours of deployment. | Medium | SU001 |
| CU006 | The Check Point quote says Torq investigates and remediates many internal alerts without human intervention. | High | SU001, SU002 |
| CU007 | Partner coverage suggests Torq is used in MSSP and multi-tenant security delivery motions. | Medium | SU004, SU005 |
| CU008 | Torq's customer stories emphasize production workflows such as phishing triage, alert handling, and remediation. | High | SU001, SU006, SU008 |
| CU009 | Public evidence does not disclose NRR, GRR, churn, or cohort retention. | High | SU001, SU002, SU007 |
| CU010 | The customer list suggests broad vertical diversification rather than a narrow niche. | Medium | SU001, SU002, SU006 |
| CU011 | There is no public evidence that any single customer dominates the revenue base. | Medium | SU001, SU002, SU007 |
| CU012 | The strongest customer signal is not expansion math but that the platform is already in daily production use. | Medium | SU005, SU006, SU008 |
| CU013 | Skeptical commentary still asks whether autonomous SOC claims can generalize beyond highly tuned customer environments. | Medium | SU009, SU007 |
| CR001 | Torq's SaaS-first delivery model is a real risk for buyers that require on-prem or air-gapped control. | Medium | SR001, SR004 |
| CR002 | AI trust and explainability remain central adoption hurdles. | Medium | SR004, SR001 |
| CR003 | User-review commentary points to a learning curve and reporting friction. | Medium | SR002, SR003 |
| CR004 | Torq's reporting and dashboard surfaces still need to prove enterprise-grade maturity. | Medium | SR002, SR001 |
| CR005 | The public record does not show ARR, burn, gross margin, or runway. | High | SR007, SR008, SR006 |
| CR006 | The founder-led public narrative creates a concentration risk if key individuals leave. | Medium | SR006, SR007 |
| CR007 | Torq's premium valuation leaves less room for execution misses. | Medium | SR007, SR008 |
| CR008 | Federal market expansion adds compliance and procurement execution risk. | High | SR007, SR008 |
| CR009 | Native AI from suite vendors can commoditize Torq's lower-end use cases. | Medium | SR001, SR004 |
| CR010 | Torq still has enough product depth and customer proof to avoid being an obvious write-off. | Medium | SR005, SR006, SR007 |
| CR011 | Integration maintenance burden rises as the platform adds more connectors and execution layers. | Medium | SR005, SR007 |
| CR012 | The right investment stance is to treat Torq as promising but still evidence-heavy. | Medium | SR001, SR002, SR007 |
| CV001 | Torq's latest disclosed valuation is $1.2 billion. | High | SV001, SV002, SV003, SV005 |
| CV002 | The valuation was set in the January 2026 Series D. | High | SV001, SV002, SV004 |
| CV003 | Public evidence supports a premium growth narrative, but not a precise operating model. | Medium | SV001, SV003, SV005 |
| CV004 | The bear case is that competitors and native security-suite AI can compress Torq's wedge. | Medium | SV003, SV008 |
| CV005 | A strict ARR multiple cannot be computed from public data because ARR is not disclosed. | High | SV001, SV005, SV007 |
| CV006 | The public-comp lens has to remain strategic rather than purely financial. | Medium | SV006, SV007, SV008 |
| CV007 | Torq's product velocity and customer proof support a premium relative to generic automation vendors. | Medium | SV001, SV003, SV008 |
| CV008 | The company still needs the data room to validate ARR, margin, NRR, and concentration before a buy call. | Medium | SV001, SV005, SV007 |
| CV009 | A track recommendation is justified because Torq has enough evidence to be interesting but not enough to underwrite aggressively. | Medium | SV001, SV003, SV005 |
| CV010 | Bull-case support depends on continued federal expansion and sustained enterprise product momentum. | Medium | SV001, SV003, SV005 |
| CV011 | Torq's public valuation looks stretched rather than obviously cheap. | Medium | SV001, SV002, SV005 |
| CV012 | The cleanest exit condition for a stronger recommendation is a better data room or a materially lower entry price. | Medium | SV001, SV005, SV007 |
| CV013 | Skeptical coverage suggests Torq's premium only works if execution stays near-perfect and production proof remains durable. | Medium | SV009, SV010 |
| ID | Publisher | Title | Quote |
|---|---|---|---|
| SO001 | Torq | Torq® AI SOC Platform | Agentic AI and Security Hyperautomation for SecOps | The AI SOC Platform that helps security teams triage, investigate, and respond to threats faster. |
| SO002 | Torq | Company | Founded in 2020 by security trailblazers Ofer Smadari, Eldad Livni, and Leonid Belkind. |
| SO003 | Torq | Torq Secures $140M Series D at $1.2B Valuation to Lead the AI SOC and Agentic AI Era | Closed a massive $140 million Series D funding round, propelling its valuation to $1.2 billion and total funding to $332M. |
| SO004 | Business Wire | Torq Becomes the Cursor of Security Operations With New Agentic Builder | Socrates can now build as well as investigate. |
| SO005 | Startup Nation Central | torq — Cyber Security - Start-Up Nation Finder | Founded in December 2019 ... Torq operates with 201–500 employees. |
| SO006 | Forge Global | Torq IPO Timeline and Financing Details - Forge | Founded by Ofer Smadari, Leonid Belkind, and Eldad Livni in 2020 and headquartered in Tel Aviv, Israel. |
| SO007 | Calcalist Tech | Cyber startup Torq joins unicorn ranks after $140 million raise at $1.2 billion valuation | Torq, a NYC-based agentic AI security operations provider, raised $140M in Series D funding, at $1.2 Billion valuation. |
| SO008 | Information Security Media Group | Funding at $1.2B Valuation to Propel Federal Market Entry and R&D; in GenAI | Torq, founded in 2020, employs 372 people and has raised $332 million in six rounds. |
| SO009 | Swimlane | Torq vs Swimlane: AI SOC Comparison | Torq is positioned as a SaaS-only platform. |
| SM001 | KuppingerCole | Beyond SOAR: How AI Agents Are Transforming Security Operations | Security automation ... assess[es] the market, the trends, the customer requirements and needs. |
| SM002 | Techzine | Torq’s SOC Brain learns from every security decision | The result is intended to deliver a solution that is more than just a simple LLM wrapper. |
| SM003 | Swimlane | Torq vs Swimlane: AI SOC Comparison | Torq is positioned as a SaaS-only platform. |
| SM004 | PeerSpot | Torq Reviews, Competitors and Pricing | Torq is the enterprise AI SOC solution that effectively combines adaptive insights and automation. |
| SM005 | Torq | Torq® AI SOC Platform | Agentic AI and Security Hyperautomation for SecOps | The AI SOC Platform that helps security teams triage, investigate, and respond to threats faster. |
| SM006 | Torq | Company | The Fortune 500 Runs on Torq. |
| SM007 | Business Wire | Torq Becomes the Cursor of Security Operations With New Agentic Builder | Socrates can now build as well as investigate. |
| SM008 | Reco | New Torq AMP Alliance Program Debuts with Reco As a Launch Partner to Accelerate Autonomous SecOps | Torq AMP partners ... create unique, high-value solutions. |
| SP001 | Swimlane | Torq vs Swimlane: AI SOC Comparison | Torq is positioned as a SaaS-only platform. |
| SP002 | PeerSpot | Torq Reviews, Competitors and Pricing | Torq is popular among the large enterprise segment. |
| SP003 | Torq vs Binkops vs Tines : r/automation | Torq leans more enterprise with heavier AI integration and broader workflow capabilities. | |
| SP004 | KuppingerCole | Beyond SOAR: How AI Agents Are Transforming Security Operations | You have platform vendors, specialist vendors, and managed providers. |
| SP005 | Torq | Torq® AI SOC Platform | Agentic AI and Security Hyperautomation for SecOps | The AI SOC Platform that helps security teams triage, investigate, and respond to threats faster. |
| SP006 | Torq | Company | The Fortune 500 Runs on Torq. |
| SP007 | Business Wire | Torq Becomes the Cursor of Security Operations With New Agentic Builder | Socrates can now build as well as investigate. |
| SP008 | Stellar Cyber | SC and Torq Partner to Deliver Automation-Driven Security | Together, Torq Hyperautomation and Stellar Cyber’s automatic threat detection capabilities deliver a unified cybersecurity solution. |
| SF001 | Torq | Torq Secures $140M Series D at $1.2B Valuation to Lead the AI SOC and Agentic AI Era | propelling its valuation to $1.2 billion and total funding to $332M |
| SF002 | Information Security Media Group | Funding at $1.2B Valuation to Propel Federal Market Entry and R&D; in GenAI | Torq, founded in 2020, employs 372 people and has raised $332 million in six rounds. |
| SF003 | Calcalist Tech | Cyber startup Torq joins unicorn ranks after $140 million raise at $1.2 billion valuation | In 2025, Torq reported approximately 300% revenue growth. |
| SF004 | Dark Reading | Torq Announces $70M Series C | Torq has also established an aggressive 2026 ARR target of $100M. |
| SF005 | FinSMEs | Torq Raises $140M Series D Funding | The round was led by Merlin Ventures, with participation from all existing investors. |
| SF006 | SecurityWeek | Torq Raises $140 Million at $1.2 Billion Valuation | The company will use the new funding to scale its AI SOC platform and accelerate adoption in the commercial and government markets. |
| SF007 | Forge Global | Torq IPO Timeline and Financing Details - Forge | This company was founded by Ofer Smadari, Leonid Belkind, and Eldad Livni in 2020. |
| SF008 | Multiples | Torq Revenue, Valuation, Funding & Investors | Multiples | Torq has raised a total of $330M across 6 funding rounds. |
| SF009 | The Register | AI Security Valuation Bubble? Analysts Question Unicorn Premiums in SecOps Automation | Several analysts have warned that AI security operations platforms are being priced at revenue multiples that assume near-perfect execution. |
| SE001 | Torq | Torq® AI SOC Platform | Agentic AI and Security Hyperautomation for SecOps | The AI SOC Platform that helps security teams triage, investigate, and respond to threats faster. |
| SE002 | Torq | Product Updates | Socrates can now build as well as investigate. |
| SE003 | Business Wire | Torq Becomes the Cursor of Security Operations With New Agentic Builder | Plan before it builds. |
| SE004 | Techzine | Torq’s SOC Brain learns from every security decision | SOC Brain learns from past incidents, investigations, and daily operations. |
| SE005 | Torq | Torq Delivers Cybersecurity’s Highest-Upside Partner Program With Guaranteed Margins Up to 25% | Guaranteed margins up to 25%. |
| SE006 | Torq | A Blueprint for Hyperautomating Your Next-Gen Secure Software Development Lifecycle (SDLC) | Hyperautomation enabled us to combine no-code workflows, AI-driven orchestration, and system-wide integrations. |
| SE007 | Torq | Automated Incident Management: Detection to Resolution Without the Fire Drill | Detection to resolution without the fire drill. |
| SE008 | Torq | Company | 100 million daily security automations running on Torq. |
| SE009 | SC Media | Security Automation Platform Risk — AI Decision Accuracy and False Positives 2026 | AI-driven security platforms risk autonomous remediation of false positives, potentially disrupting legitimate business processes when confidence thresholds are misconfigured. |
| SE010 | Torq Documentation | Torq Connector Framework — Integration Maintenance and Reliability | |
| SU001 | Torq | Torq Secures $140M Series D at $1.2B Valuation to Lead the AI SOC and Agentic AI Era | Fortune 100 customers adopting our AI Agents in their SOCs. |
| SU002 | Torq | Company | The Fortune 500 Runs on Torq. |
| SU003 | Torq | Torq Introduces New Agentic Builder for SOC Workflows | Socrates now opens as the Torq homepage. |
| SU004 | Reco | New Torq AMP Alliance Program Debuts with Reco As a Launch Partner to Accelerate Autonomous SecOps | Torq AMP partners easily leverage Torq’s SecOps platform and Agentic AI capabilities. |
| SU005 | Stellar Cyber | SC and Torq Partner to Deliver Automation-Driven Security | Since using the Stellar Cyber Open XDR Platform and the Torq Hyperautomation Platform together, we can service more customers without adding resources. |
| SU006 | Torq | How A Leading Museum Automated Its Security Operations with Torq | How A Leading Museum Automated Its Security Operations with Torq. |
| SU007 | PeerSpot | Torq Reviews, Competitors and Pricing | Torq is most commonly compared to Microsoft Sentinel. |
| SU009 | Ars Technica | Can AI Really Run Your SOC? Skeptics Question Autonomous Security Claims | Claims of 90%+ autonomous alert resolution should be viewed with skepticism until independently validated in production environments at scale. |
| SU008 | Techzine | Torq’s SOC Brain learns from every security decision | Torq Reflex's decision is said to be identical to that of human SOC analysts in 85 percent of cases. |
| SR001 | Swimlane | Torq vs Swimlane: AI SOC Comparison | Torq is positioned as a SaaS-only platform. |
| SR002 | PeerSpot | Torq Reviews, Competitors and Pricing | Torq has a steep learning curve. |
| SR003 | Torq vs Binkops vs Tines : r/automation | Torq leans more enterprise with heavier AI integration. | |
| SR004 | Techzine | Torq’s SOC Brain learns from every security decision | The result is intended to deliver a solution that is more than just a simple LLM wrapper. |
| SR005 | Torq | Torq® AI SOC Platform | Agentic AI and Security Hyperautomation for SecOps | The AI SOC Platform that helps security teams triage, investigate, and respond to threats faster. |
| SR006 | Torq | Company | Founded in 2020 by security trailblazers Ofer Smadari, Eldad Livni, and Leonid Belkind. |
| SR007 | Torq | Torq Secures $140M Series D at $1.2B Valuation to Lead the AI SOC and Agentic AI Era | The new funds will accelerate the adoption of the Torq AI SOC Platform. |
| SR008 | Information Security Media Group | Funding at $1.2B Valuation to Propel Federal Market Entry and R&D; in GenAI | Torq aims to penetrate the highly regulated federal cybersecurity space. |
| SR009 | Reuters | Israeli cyber startup Torq raises $140 million, valued at $1.2 billion | |
| SR010 | G2 | Torq Reviews | |
| SV001 | Torq | Torq Secures $140M Series D at $1.2B Valuation to Lead the AI SOC and Agentic AI Era | propelling its valuation to $1.2 billion and total funding to $332M |
| SV002 | Calcalist Tech | Cyber startup Torq joins unicorn ranks after $140 million raise at $1.2 billion valuation | Torq ... raised $140M in Series D funding, at $1.2 Billion valuation. |
| SV003 | SecurityWeek | Torq Raises $140 Million at $1.2 Billion Valuation | The company will use the new funding to scale its AI SOC platform. |
| SV004 | FinSMEs | Torq Raises $140M Series D Funding | The round was led by Merlin Ventures. |
| SV005 | Information Security Media Group | Funding at $1.2B Valuation to Propel Federal Market Entry and R&D; in GenAI | Notching a $1.2 billion valuation serves as a credibility signal. |
| SV006 | Forge Global | Torq IPO Timeline and Financing Details - Forge | Founded by Ofer Smadari, Leonid Belkind, and Eldad Livni in 2020. |
| SV007 | Multiples | Torq Revenue, Valuation, Funding & Investors | Multiples | Torq has raised a total of $330M across 6 funding rounds. |
| SV008 | Dark Reading | Torq Announces $70M Series C | Torq has also established an aggressive 2026 ARR target of $100M. |
| SV009 | SC Media | Security Automation Platform Risk — AI Decision Accuracy and False Positives 2026 | AI-driven security platforms risk autonomous remediation of false positives, potentially disrupting legitimate business processes when confidence thresholds are misconfigured. |
| SV010 | UnderDefense | Torq HyperSOC Alternatives — AI SOC Platform Evaluation 2026 | Torq's cloud-only delivery model excludes regulated enterprises with on-premises data sovereignty requirements, limiting its addressable market in government and financial services. |