CyberKord, Mate Security, ReliaQuest and Torq

About Mate Security

Mate Security is a cybersecurity company that provides an AI-powered Security Operations Center (SOC) platform to help security teams investigate, manage and respond to cyber threats. Mate is an agentic cyber defense system that acts across every security use case. Mate grounds AI agents in organization-specific knowledge and validates every decision the agents make. Mate turns an understanding of a customer's organization into what it calls purified knowledge so that AI agents take action across every security use case.^{[1][10][11][12]}

Mate's Security Context Graph continuously maps an organization's architecture, crown jewels, exposures, activity and relationships. Mate captures the context that a customer's tools never recorded, then keeps it sourced, scored and current. Mate captures why an analyst made a call, not just the final verdict. Mate stores data as entities and relationships, and its reason mining engine keeps the underlying reason behind each conclusion.^[3][12][13]

Mate collects the artifacts, history, identities and tool outputs that an expert would check. Mate returns a conclusion with an evidence trail that a team can audit and tune. Mate runs data through cleanup, normalization and correlation.^[3][12]

Mate checks every action against the customer's environment before it runs. Mate scores every action on Confidence, Precision and Reversibility, and the platform enforces this outside the agent's reasoning loop so that Mate cannot widen its own permissions, hide its actions or grade its own accuracy. Mate describes precision as the smallest action that stops the threat, for example revoking the session while keeping the account. Mate acts on its own only where it has earned the right, measured by proven performance against known-answer cases, and escalates the rest.^[3][14]

A Gamebook is Mate's investigation process, built for AI agents. Gamebooks are a structured investigation process where AI agents reason and pivot dynamically within every step, and are customizable to align with a customer's processes. Mate queries tools as a separate flow, with access restrictions for their current task. Mate ships Gamebooks for core investigation domains. A customized Gamebook runs through Mate's evals and tests before it goes live. Customers can write an investigation in plain language, and Mate tests it against past cases, runs it in shadow mode, then waits for sign-off.^[3][4]

Mate migrates existing SOAR playbooks into agentic procedures designed for AI-scale attacks. Mate analyzes and migrates playbooks to Mate Gamebooks, and the Gamebooks are validated before activating. A Fortune 500 enterprise SOC migrated 711 SOAR playbooks into 10 Mate Gamebooks.^[4][14]

Mate extracts IOCs and TTPs, then hunts across every connected tool. Mate's Hunt Agents receive context from the Security Context Graph to understand where risk is highest. Mate moves through the environment, tunes detections as it goes, and pulls additional logs and context when something looks wrong. Mate correlates every match across tools into one picture, maps it to MITRE and provides a detection ready to deploy. Mate creates, tunes or deprecates detections based on investigation outcomes and contextual changes. Mate uses hunts and investigations to create and tune detections and to update the Context Graph.^[3][13]

Blue City is Mate Security's simulated enterprise for testing AI security agents, where business keeps running during an attack and every defensive action has real consequences. Mate's benchmark scenarios build on situations the Mate system resolves in production, rebuilt with synthetic data. Security tools in the benchmark are accessible through the Model Context Protocol (MCP).^{[3][6][7][9][13][15]}

About ReliaQuest

ReliaQuest sells GreyMatter, an agentic AI security operations platform that allows security teams to detect, contain, investigate and respond to threats, regardless of the data source. ReliaQuest states that it exists to Make Security Possible, allowing enterprise security teams to detect, contain and respond to threats using GreyMatter. GreyMatter includes 6 agentic Teammates that use hundreds of agent skills and AI tools to work toward an objective, not just tasks. GreyMatter includes persona-based agentic AI Teammates built on 10+ years of proprietary incident response data. GreyMatter collects data from any source or technology and normalizes it with the patented Universal Translator.^[1][2][4]

GreyMatter detects threats wherever customer data lives, whether in the cloud, on the endpoint, inside a SIEM, directly at the source, or in transit. GreyMatter unifies threat detection, investigation, hunting, and containment across a customer's environment without requiring data to be moved. GreyMatter Detect centralizes all created rule logic in its library from any author. GreyMatter Detect allows customers to test and validate detections before and after deployment and monitors their performance continuously. ReliaQuest describes detecting threats at the source or in transit and moving and storing only what matters. ReliaQuest designs GreyMatter to be vendor-neutral. Customers connect GreyMatter with sources like SIEM, EDR, network security, and cloud tools.^[6][7]

GreyMatter investigates, documents, and responds to routine alerts autonomously. GreyMatter automates phishing triage and applies shared intel for proactive defense across the ReliaQuest customer base. GreyMatter connects the steps between detection, investigation, and response with workflows tailored to the customer's business. ReliaQuest names Slack and Microsoft Teams as integrated tools for communication between users and business units. GreyMatter translates, normalizes, and correlates data to give a team a unified view. GreyMatter unifies tools such as email, network, and endpoint into one command system. GreyMatter lets teams find and fix vulnerabilities, prioritize what is exploitable, and validate risks.^[4][8]

GreyMatter unifies detection, response, and visibility across a multicloud and multi-SIEM environment. GreyMatter correlates events across clouds and SIEMs, triggering automated playbooks. GreyMatter detects threats at the source across IaaS, PaaS, SaaS, and SIEM. GreyMatter integrates OT-specific technologies like Armis, Dragos, and Nozomi to enrich detection rules. GreyMatter correlates data from IT and OT sources, including firewalls, PLC logs, and remote access systems. GreyMatter bridges the gap between OT and IT environments. GreyMatter delivers metrics in a unified agentic AI SecOps platform. GreyMatter lets teams compare detection, investigation, and response performance across all entities to identify trends. GreyMatter lets teams benchmark data source visibility and coverage against peer organizations.^[9][10][11]

ReliaQuest is headquartered in Tampa, FL, with operations centers in Tampa, Las Vegas, Salt Lake City, Dublin, London and Pune, India. ReliaQuest states a valuation of over $3.4 billion, over 1,200 team members and over 1,000 customers. ReliaQuest states revenue growth to more than $400M in 2025. Brian Foster is responsible for overseeing all areas of ReliaQuest's product development and technical operations. ReliaQuest states four values: being accountable, helpful, adaptable, and focused.^{[2][5][9][10][11]}

About Torq

Torq sells the Torq AI SOC Platform, which turns alerts into action across a security stack. Torq describes the problem as security teams operating under constant alert overload. Torq says disconnected tools delay investigation and response. Torq says the Agentic SOC must manage the entire threat lifecycle, from triage through response. Torq describes the platform as taking action and closing cases across the complete threat management lifecycle.

Torq ingests and normalizes telemetry from across the security stack, correlating and deduplicating events to reduce noise. Guidance and Rules for Auto Triage can be created with Socrates Builder. Auto Triage adds graph context directly to alerts. Case Management is native to the Torq platform and provides a single source of truth with evidence, timelines, and case summaries. Torq opens and assigns cases to specialized, customizable AI Agents. Torq supports scheduled reports that deliver case metric snapshots to any recipient on a recurring cadence.^[7]

Torq HyperAgents is a group of autonomous, transparent, and customizable AI Agents. Torq HyperAgents are given access to the existing tools and steps in the SOC to deliver agentic insights and take action. AI Agents can be deployed and orchestrated to offload repetitive investigation tasks and record evidence, timelines, and recommended actions. Agentic runbooks access authorized data and tools, and AI Agents cross-reference historical cases, recognize threat patterns and summarize findings. Socrates coordinates specialized AI Agents and manages cases end-to-end. Socrates is described as natural language-driven agentic AI that autonomously remediates critical threats. AI agents in Torq have a dedicated hub where they live independently of any workflow. An agent can be published once and reused across workflows, Socrates sessions and Case Management. Agentic response runs either completely autonomously or with human-on-the-loop oversight.^[7][8]

Torq Hyperautomation uses integrations with the security stack for workflow automation. The Torq AI SOC Platform includes 300 pre-built integrations and 4,000+ pre-built steps. AI Agents can be used to build new integrations, workflows, and custom use cases. Torq uses real-time API monitoring so that automations stay connected when third-party data formats change. Context Graph gives a visual map of the identities, assets, and relationships in an environment. Torq acquired Jit in 2026, and the acquisition brought a live Context Graph into the AI SOC Platform. At Black Hat 2026, Torq announced the Torq SOC Brain™, a continuously learning layer of the Torq AI SOC Platform.^[7][8]

Torq uses a multi-tenant workspace model to automate services centrally and reuse workflows across customers, with environments computationally segmented. Torq case management is built on the Open Cybersecurity Schema Framework (OCSF) with automation-first, event-driven workflows. Socrates handles Tier-1 and Tier-2 tickets as a 24×7 on-call teammate. Torq executes containment, remediation, and recovery actions and escalates critical cases for human-in-the-loop intervention. Dashboards can be created for roles such as SOC Manager, CISO or customer, with metrics including MTTR, automation closure rates and case assignments. MSSPs can extend Torq automation capabilities to customer environments they do not directly manage.^[10]

Torq was founded in 2020 by Ofer Smadari, Leonid Belkind and Eldad Livni. Torq has 430+ team members, called Torqers, spanning the U.S, Canada, Israel, and Europe. Torq Agentic AI and Torq HyperSOC handle Tier-1 security alerts at Carvana. Check Point deployed more than two dozen AI-driven playbooks that automate responses to repetitive security alerts.^[11][12]

Torq compliance reports produced periodically by external auditors are available upon request. Torq infrastructure and operations were audited externally and internally and found compliant with the privacy management requirements of the Health Insurance Portability and Accountability Act. Torq information handling procedures and privacy operations are compliant with the EU General Data Protection Regulations (GDPR). Torq performs due diligence with its subcontractors and can provide a Data Processing Addendum for counter signing. Torq has achieved C5:2020 certification under the Cloud Computing Compliance Criteria Catalogue (C5), developed by the German Federal Office for Information Security. Torq relies on infrastructure providers such as GCP and AWS for hosting its application infrastructure. Torq integrates with Enterprise Single Sign-On and Multi-Factor Authentication providers such as Microsoft Azure AD, Okta, OneLogin, Ping Identity, Google Identity and Duo Security. Torq supports Role-based Access Control (RBAC) for managing permissions inside the automation and orchestration environments on a least-privilege basis. Torq penetration test reports from application and infrastructure security specialists are available upon request.^{[1][5][7][10][13][14]}