CISO Tribune

Vendor comparison · 2 companies

Legion Security vs Torq

Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn. Torq sells the Torq AI SOC Platform, which turns alerts into action across a security stack. CISO Tribune files both under AI SOC analysts. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Legion Security
  • Torq
Legion Security vs Torq: Products, Customers and Funding Compared
Legion SecurityLegion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn.legionsecurity.aiTorqTorq sells the Torq AI SOC Platform, which turns alerts into action across a security stack.torq.io
What it sells
  • Legion[1][2][3][4][5][6][7][8]Turns a team's knowledge, tools and processes into agents that investigate alerts and carry out approved responses.
  • Torq AI SOC Platform[4][6][9][14]Turns alerts into action across a security stack.
  • Auto Triage[4][6][7]Agentic AI engine that prioritizes threats and separates noise from actual risk.
  • Case Management[4][6][7][10]Native case management with evidence, timelines and case summaries.
  • Torq HyperAgents®[4]A group of autonomous, transparent, and customizable AI Agents.
  • Socrates[4][6][7][10]Natural language-driven agentic AI that autonomously remediates critical threats.
  • Hyperautomation[4][6]Workflow automation using integrations with the security stack.
  • Context Graph[4][7][9]A visual map of the identities, assets, and relationships in an environment.
  • Integrations[4][6]300 pre-built integrations and 4,000+ pre-built steps.
Categories
Headquarters
Tel Aviv, Israel[1]Tel Aviv, Israel[3]
Founded
Not stated on its pages2020[2][9]
Ownership and funding
Not stated on its pagesPrivately held[4][6][9][16]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • July 28, 2026Torq introduced Torq SOC Brain, a new layer of its AI SOC Platform that learns from historical investigations and analyst decisions.[15]
G2 and Gartner Peer Insights
  • G2: listed, seen November 10, 2026[9]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 10, 2026[16]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Legion is described as running in production across the SOC, DLP, identity, vulnerability management and GRC. Legion Security says it has early traction among financial services, healthcare and manufacturing customers. Legion operates through a browser extension and integrates with anything accessed through the browser.From its own pages, Torq serves MSSPs and MDRs, which get an omniview across all customer workspaces. MSSPs can extend Torq automation capabilities to customer environments they do not directly manage. Torq offers to provide and sign a HIPAA Business Associate Agreement when engaging with HIPAA covered entities. Torq dashboards can be tailored to roles such as SOC Manager, CISO or customer. Torq customers include a global analytics company that rebuilt its playbooks with the Torq AI SOC Platform.
Last verified
November 8, 2026September 27, 2026

Where they overlap

  • AI SOC analysts is the primary category of both Legion Security and Torq.
  • Both are headquartered in Tel Aviv, Israel.

Where they differ, field by field

  • Torq is also filed under SOAR and security automation.
  • Legion Security lists Legion. Torq lists Torq AI SOC Platform, Auto Triage, Case Management, Torq HyperAgents®, Socrates and 3 more.
  • Torq was founded in 2020.
  • Torq is privately held.

How they differ

CISO Tribune files both Legion Security and Torq under AI SOC analysts as the primary category, and both companies are headquartered in Tel Aviv, Israel. Torq is also filed under SOAR and security automation. Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn. Legion operates through a browser extension, without integrations or APIs, and starts from a browser recording, runbook or past case. Legion Security describes itself as a Series A startup.

Torq sells the Torq AI SOC Platform, which turns alerts into action across a security stack and includes 300 pre-built integrations and 4,000+ pre-built steps. Its listed products include Auto Triage, Case Management, Torq HyperAgents®, Socrates, Hyperautomation and Context Graph. Torq was founded in 2020 and is privately held. Torq acquired Jit in 2026, which brought a live Context Graph into the platform. The two therefore overlap in agents that investigate alerts, while Legion works through the browser and Torq works through pre-built integrations and workflow automation.

Legion Security says it has early traction among financial services, healthcare and manufacturing customers, and describes Legion as running in production across the SOC, DLP, identity, vulnerability management and GRC. Legion can be bought on the AWS Marketplace and is offered through GCP Marketplace. Torq serves MSSPs and MDRs, and names Carvana, where Torq Agentic AI and Torq HyperSOC handle Tier-1 security alerts. On July 28, 2026, Torq introduced Torq SOC Brain, a layer of its AI SOC Platform that learns from historical investigations and analyst decisions.

What it sells: Legion Security

What Legion does[1][2][3][4][5][6][7][8]
Legion learns a team's current processes, tools and context from the browser, past cases and more. Legion investigates everything, clearing false positives and benign activity, and escalates what matters and contains threats. Legion operates through a browser extension, without integrations or APIs.

What it sells: Torq

What Torq AI SOC Platform does[4][6][9][14]
The Torq AI SOC Platform unifies visibility and turns alerts into action across a security stack. The Torq AI SOC Platform includes 300 pre-built integrations and 4,000+ pre-built steps. Torq describes the platform as taking action and closing cases across the complete threat management lifecycle.
What Auto Triage does[4][6][7]
Guidance and Rules for Auto Triage can be created with Socrates Builder. Auto Triage adds graph context directly to alerts.
What Case Management does[4][6][7][10]
Case Management is native to the Torq platform and provides a single source of truth with evidence, timelines, and case summaries. Torq case management is built on the Open Cybersecurity Schema Framework (OCSF) with automation-first, event-driven workflows.
What Torq HyperAgents® does[4]
Torq HyperAgents is a group of autonomous, transparent, and customizable AI Agents. Torq HyperAgents are given access to the existing tools and steps in the SOC to deliver agentic insights and take action. Agentic runbooks access authorized data and tools, and AI Agents cross-reference historical cases, recognize threat patterns and summarize findings.
What Socrates does[4][6][7][10]
Socrates is described as natural language-driven agentic AI that autonomously remediates critical threats. Socrates coordinates specialized AI Agents and manages cases end-to-end. Socrates handles Tier-1 and Tier-2 tickets as a 24×7 on-call teammate.
What Hyperautomation does[4][6]
Torq Hyperautomation uses integrations with the security stack for workflow automation. Torq fuses agentic reasoning and Hyperautomation, from alert through remediation. AI Agents can be used to build new integrations, workflows, and custom use cases.
What Context Graph does[4][7][9]
Context Graph gives a visual map of the identities, assets, and relationships in an environment. Auto Triage adds graph context directly to alerts.
What Integrations does[4][6]
The Torq AI SOC Platform includes 300 pre-built integrations and 4,000+ pre-built steps. AI Agents can be used to build new integrations, workflows, and custom use cases. Torq uses real-time API monitoring so that automations stay connected when third-party data formats change.

Questions about Legion Security and Torq

What do Legion Security and Torq sell?
Legion Security sells Legion. Torq sells Torq AI SOC Platform, Auto Triage, Case Management, Torq HyperAgents®, Socrates and 3 more.
Are Legion Security and Torq in the same category?
Yes. AI SOC analysts is the primary category of both on CISO Tribune.
Where are Legion Security and Torq headquartered?
Both are headquartered in Tel Aviv, Israel.
When were Legion Security and Torq founded?
Torq was founded in 2020.
Who owns Legion Security and Torq?
Torq is privately held.
Who are Legion Security and Torq sold to?
Legion is described as running in production across the SOC, DLP, identity, vulnerability management and GRC. From its own pages, Torq serves MSSPs and MDRs, which get an omniview across all customer workspaces.
What have Legion Security and Torq announced recently?
July 28, 2026: Torq introduced Torq SOC Brain, a new layer of its AI SOC Platform that learns from historical investigations and analyst decisions.

About Legion Security

Legion Security sells Legion, which turns a team's knowledge, tools and processes into agents that investigate alerts, carry out approved responses and continuously learn. Legion maps a team's knowledge, people and processes and grows with every investigation. Legion Security is building an AI security analyst designed to see, think and act like an expert human analyst. Legion Security built a companion that captures how a team actually works, and scales it.[2][3][4][5][6]

Legion learns a team's current processes, tools and context from the browser, past cases and more, and deploys agents for the team. Legion continuously learns from browser recordings, cases, tools and more. Legion starts from a browser recording, runbook or past case and turns it into an agent that the team reviews, refines and deploys. Agents in Legion reason where judgment matters and follow fixed steps where consistency does, in a single workflow. Legion lets teams build agents for the processes they run, in the tools they already use.[3][4]

Legion integrates with all of a team's tools, with or without APIs. Legion comes with prebuilt integrations for all common security tools. Legion integrates with anything accessed through the browser.[3][7]

Legion investigates everything, clearing false positives and benign activity, and escalates what matters and contains threats. Legion triages and investigates alerts with an organization's context and tunes detections from what it finds. Legion works across the teams that security depends on, including the SOC, identity and DLP. Legion is running in production across the SOC, DLP, identity, vulnerability management and GRC. Legion supports separating real exfiltration from false positives, establishing who did what and why, then revoking access, quarantining data or closing the exposure. Legion supports testing exploitability against an environment to prioritize real risk, then driving the fix with the teams that own it. Legion supports checking whether a threat is active against an organization's assets and feeding what is learned. Legion helps find which alerts, workflows and tasks take the most time and which are ready to become agents. Legion lets users ask one question across all their tools, hunt new threats and hand strong leads to the Investigator. Legion lets users describe a report or board summary, schedule it and ask what is behind the numbers.[3][4]

Legion runs agents beside analysts on live cases so the two can be compared decision for decision. Before agents gain authority, each is tested against the customer's benchmarks. Legion begins by observing, then supporting, and only takes on autonomous workflows when the customer's team decides it is ready. Every insight Legion captures, every suggestion it offers and every action it takes is visible, explainable and reversible.[3][4][8]

Legion operates through a browser extension, with the customer having full control over what data is collected and when. Legion operates directly in the browser without integrations or APIs. Customers decide when Legion records by starting and stopping it manually, set a browser-level allow list for where recording happens, and use masking rules that redact sensitive data. Legion does not train models on business data by default. Legion has a built-in DLP layer to help prevent unintended data exposure. Legion aligns with frameworks including SOC 2, ISO 27001 and HIPAA where applicable.[8]

CrowdStrike users can access Legion on the CrowdStrike Marketplace, with deeper access to Charlotte AI and CrowdStrike tools. Legion can be purchased on the AWS Marketplace. Legion is offered through GCP Marketplace and works natively across Google products from Chrome to GTI. Legion Security describes itself as a Series A startup with early traction among financial services, healthcare and manufacturing customers.[3][4][5][7]

Legion Security on the record

Sources

Legion Security full record

  1. [1]Legion security launches dragonclaw agent orchestration with context for your socLegion Security · legionsecurity.ai · published July 30, 2026 · Tier A
  2. [2]legionsecurity.aiLegion Security · legionsecurity.ai · undated page, accessed November 8, 2026 · Tier A
  3. [3]Legion Security | The Agentic Security Operations PlatformLegion Security · undated page, accessed November 10, 2026 · Tier A
  4. [4]Learning Mode - AI SOC Workflow Mapping | Legion SecurityLegion Security · undated page, accessed November 10, 2026 · Tier A
  5. [5]Legion CareersLegion Security · undated page, accessed November 10, 2026 · Tier A
  6. [6]About Legion Security | AI that learns from within your SOCLegion Security · undated page, accessed November 10, 2026 · Tier A
  7. [7]Partners & IntegrationsLegion Security · undated page, accessed November 10, 2026 · Tier A
  8. [8]Trust | Legion SecurityLegion Security · undated page, accessed November 10, 2026 · Tier A
  9. [9]Legion Security Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed November 10, 2026 · Tier C

Torq full record

  1. [1]Torq seriesdTorq · torq.io · published January 12, 2026 · Tier A
  2. [2]CompanyTorq · torq.io · undated page, accessed September 27, 2026 · Tier A
  3. [3]Security startup torq raises cash at 1 2 billion valuationBloomberg · bloomberg.com · published January 11, 2026 · Tier B
  4. [4]Torq AI SOC Platform | AI Agents and Agentic SecOpsTorq · undated page, accessed October 29, 2026 · Tier A
  5. [5]Torq Skull Hoodie – Torq MerchTorq · undated page, accessed October 29, 2026 · Tier A
  6. [6]The Torq AI SOC PlatformTorq · undated page, accessed November 10, 2026 · Tier A
  7. [7]Product Updates | Torq AI SOC PlatformTorq · undated page, accessed November 10, 2026 · Tier A
  8. [8]Torq Integrations | AI SOC and Security Automation IntegrationsTorq · undated page, accessed November 10, 2026 · Tier A
  9. [9]About Torq | The Leading AI SOC PlatformTorq · undated page, accessed November 10, 2026 · Tier A
  10. [10]Torq for MSSPs and MDRsTorq · undated page, accessed November 10, 2026 · Tier A
  11. [11]Torq Security Hyperautomation vs. Legacy SOAR | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  12. [12]Torq Hyperautomation vs. Security Workflow Automation Software | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  13. [13]Security and Compliance | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  14. [14]AI SOC Customers | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  15. [15]Torq Unveils The SOC Brain: The AI SOC That Learns, Not Just Remembers | TorqTorq · published July 28, 2026 · Tier A
  16. [16]Torq AI SOC Platform Reviews & Product DetailsG2 · undated page, accessed November 10, 2026 · Tier C

Spot a factual error? Request a correction.