CISO Tribune

Vendor comparison · 2 companies

Mave vs Torq

Mave runs investigations, searches, threat hunts, detection hardening, and governed responses across a customer's existing stack. Torq sells the Torq AI SOC Platform, which turns alerts into action across a security stack. CISO Tribune files both under AI SOC analysts. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Mave
  • Torq
Mave vs Torq: Products, Customers and Funding Compared
MaveMave runs investigations, searches, threat hunts, detection hardening, and governed responses across a customer's existing stack.mave.comTorqTorq sells the Torq AI SOC Platform, which turns alerts into action across a security stack.torq.io
What it sells
  • AI SOC[1][14]Governed AI agents that investigate alerts, apply threat intelligence, hunt across tools, improve detections, and execute authorized response actions.
  • Threat Hunting[1][13]Runs continuous, cross-tool threat hunts for threats that never triggered an alert.
  • Detection Engineering[1][13]Finds coverage gaps, tunes noisy detection rules, and creates new detections.
  • Threat Intelligence[1][9][10][14]Converts relevant threat intelligence into investigations, threat hunts, detections, and authorized responses.
  • Torq AI SOC Platform[4][6][9][14]Turns alerts into action across a security stack.
  • Auto Triage[4][6][7]Agentic AI engine that prioritizes threats and separates noise from actual risk.
  • Case Management[4][6][7][10]Native case management with evidence, timelines and case summaries.
  • Torq HyperAgents®[4]A group of autonomous, transparent, and customizable AI Agents.
  • Socrates[4][6][7][10]Natural language-driven agentic AI that autonomously remediates critical threats.
  • Hyperautomation[4][6]Workflow automation using integrations with the security stack.
  • Context Graph[4][7][9]A visual map of the identities, assets, and relationships in an environment.
  • Integrations[4][6]300 pre-built integrations and 4,000+ pre-built steps.
Categories
Headquarters
Not stated on its pagesTel Aviv, Israel[3]
Founded
Not stated on its pages2020[2][9]
Ownership and funding
Not stated on its pagesPrivately held[4][6][9][16]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • July 28, 2026Torq introduced Torq SOC Brain, a new layer of its AI SOC Platform that learns from historical investigations and analyst decisions.[15]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 10, 2026[16]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Mave sells mainly to security operations teams that run many tools and want investigation, hunting, detection work, and response across the stack they already have. Mave addresses managed security service providers that want to scale without adding analysts at the same rate as customers. Mave addresses organizations with multiple SIEMs, tenants, and subsidiaries. Mave addresses organizations that want to reduce SIEM ingestion and retention costs. Mave addresses organizations that want alert triage, investigation, and response in-house, and organizations with on-premises workloads alongside cloud and SaaS. Mave also describes an alternative package for smaller teams.From its own pages, Torq serves MSSPs and MDRs, which get an omniview across all customer workspaces. MSSPs can extend Torq automation capabilities to customer environments they do not directly manage. Torq offers to provide and sign a HIPAA Business Associate Agreement when engaging with HIPAA covered entities. Torq dashboards can be tailored to roles such as SOC Manager, CISO or customer. Torq customers include a global analytics company that rebuilt its playbooks with the Torq AI SOC Platform.
Last verified
October 23, 2026September 27, 2026

Where they overlap

  • AI SOC analysts is the primary category of both Mave and Torq.

Where they differ, field by field

  • Mave is also filed under SIEM and Threat intelligence. Torq is also filed under SOAR and security automation.
  • Mave lists AI SOC, Threat Hunting, Detection Engineering and Threat Intelligence. Torq lists Torq AI SOC Platform, Auto Triage, Case Management, Torq HyperAgents®, Socrates and 3 more.
  • Torq is headquartered in Tel Aviv, Israel.
  • Torq was founded in 2020.
  • Torq is privately held.

How they differ

CISO Tribune files both Mave and Torq under AI SOC analysts as the primary category, and each also appears under a second area: Mave under SIEM and Threat intelligence, Torq under SOAR and security automation. Mave sells an AI SOC that investigates alerts, hunts across tools, improves detections, and runs authorized response actions against the data in a customer's existing systems. Mave also sells Threat Hunting, Detection Engineering, and Threat Intelligence as separate offerings. Torq sells the Torq AI SOC Platform, which turns alerts into action across a security stack with 300 pre-built integrations and 4,000+ pre-built steps. Its other offerings include Auto Triage, Case Management, Torq HyperAgents®, Socrates, Hyperautomation, and Context Graph.

The two overlap on AI-driven alert handling and response across existing tools, but their stated emphasis differs. Mave describes detection engineering across languages such as SPL, KQL, and Sigma, and says it needs no telemetry migration or duplicate data lake. Torq describes a native Case Management product built on the Open Cybersecurity Schema Framework and workflow automation through Hyperautomation. Mave is priced by endpoints protected and team size, and it offers a fixed-price package for smaller teams.

Torq is headquartered in Tel Aviv, Israel, was founded in 2020, and is privately held. Torq serves MSSPs and MDRs, and one named customer is Carvana, where Torq Agentic AI and Torq HyperSOC handle Tier-1 alerts. Mave addresses security operations teams running many tools, MSSPs, and organizations with multiple SIEMs, tenants, and subsidiaries. On July 28, 2026, Torq introduced Torq SOC Brain, a layer of its AI SOC Platform that learns from historical investigations and analyst decisions. Torq also acquired Jit in 2026, which brought a live Context Graph into its platform.

What it sells: Mave

What AI SOC does[1][14]
Mave runs an AI SOC across the security stack a customer already uses. Mave queries live data in the systems that already hold it, reasons across the evidence, and takes the next authorized action. No telemetry migration, duplicate data lake, central index, or fixed SOAR playbook is required.
What Threat Hunting does[1][13]
Mave applies threat intelligence to the customer's environment and runs continuous, cross-tool threat hunts across the SIEM, EDR, cloud, identity, and other security tools. Each finding becomes a complete investigation, a new or tuned detection, or an authorized response action. Source telemetry stays in place, with no new data lake, central index, or prebuilt correlation pipeline.
What Detection Engineering does[1][13]
Mave works across detection languages and formats, including SPL, KQL, YARA-L, Sigma, EQL, Lucene, and SQL-based rules. Agents review, create, translate, test, and tune detection content in the existing workflow, validate it against historical data where it already lives, and commit or deploy approved changes.
What Threat Intelligence does[1][9][10][14]
Mave determines which campaigns, actors, vulnerabilities, indicators, and techniques are relevant to the customer's environment. Mave evaluates each threat against assets, identities, technologies, vulnerabilities, detections, and live activity.

What it sells: Torq

What Torq AI SOC Platform does[4][6][9][14]
The Torq AI SOC Platform unifies visibility and turns alerts into action across a security stack. The Torq AI SOC Platform includes 300 pre-built integrations and 4,000+ pre-built steps. Torq describes the platform as taking action and closing cases across the complete threat management lifecycle.
What Auto Triage does[4][6][7]
Guidance and Rules for Auto Triage can be created with Socrates Builder. Auto Triage adds graph context directly to alerts.
What Case Management does[4][6][7][10]
Case Management is native to the Torq platform and provides a single source of truth with evidence, timelines, and case summaries. Torq case management is built on the Open Cybersecurity Schema Framework (OCSF) with automation-first, event-driven workflows.
What Torq HyperAgents® does[4]
Torq HyperAgents is a group of autonomous, transparent, and customizable AI Agents. Torq HyperAgents are given access to the existing tools and steps in the SOC to deliver agentic insights and take action. Agentic runbooks access authorized data and tools, and AI Agents cross-reference historical cases, recognize threat patterns and summarize findings.
What Socrates does[4][6][7][10]
Socrates is described as natural language-driven agentic AI that autonomously remediates critical threats. Socrates coordinates specialized AI Agents and manages cases end-to-end. Socrates handles Tier-1 and Tier-2 tickets as a 24×7 on-call teammate.
What Hyperautomation does[4][6]
Torq Hyperautomation uses integrations with the security stack for workflow automation. Torq fuses agentic reasoning and Hyperautomation, from alert through remediation. AI Agents can be used to build new integrations, workflows, and custom use cases.
What Context Graph does[4][7][9]
Context Graph gives a visual map of the identities, assets, and relationships in an environment. Auto Triage adds graph context directly to alerts.
What Integrations does[4][6]
The Torq AI SOC Platform includes 300 pre-built integrations and 4,000+ pre-built steps. AI Agents can be used to build new integrations, workflows, and custom use cases. Torq uses real-time API monitoring so that automations stay connected when third-party data formats change.

Questions about Mave and Torq

What do Mave and Torq sell?
Mave sells AI SOC, Threat Hunting, Detection Engineering and Threat Intelligence. Torq sells Torq AI SOC Platform, Auto Triage, Case Management, Torq HyperAgents®, Socrates and 3 more.
Are Mave and Torq in the same category?
Yes. AI SOC analysts is the primary category of both on CISO Tribune.
Where are Mave and Torq headquartered?
Torq is headquartered in Tel Aviv, Israel.
When were Mave and Torq founded?
Torq was founded in 2020.
Who owns Mave and Torq?
Torq is privately held.
Who are Mave and Torq sold to?
From its own pages, Mave sells mainly to security operations teams that run many tools and want investigation, hunting, detection work, and response across the stack they already have. From its own pages, Torq serves MSSPs and MDRs, which get an omniview across all customer workspaces.
What have Mave and Torq announced recently?
July 28, 2026: Torq introduced Torq SOC Brain, a new layer of its AI SOC Platform that learns from historical investigations and analyst decisions.

About Mave

Mave runs investigations, searches, threat hunts, detection hardening, and governed responses across a customer's existing stack. Mave integrates through APIs across every kind of tool. Mave integrations start read-only.[4][14]

Mave states that a security team runs dozens of tools and still cannot prove there are no blind spots. Mave states that a SIEM waits for the user to write the query and read the result. Mave says SecOps is too fragmented to run from one data store or one alert queue.[3][4]

Mave pulls alerts, gathers context from every connected tool, and returns an evidence-backed verdict. Ask Mave lets a customer's team query the entire stack in plain language, with no query syntax required. Mave scores live campaigns against the customer's environment and watches for dormant indicators reactivating. Mave generates a response for each incident according to its blast radius.[3][4]

Mave lets the customer set what runs automatically and what waits for a human: notify, ticket, document, or remediate. Mave requires review for workflow actions and detection updates. Mave uses fine-grained, per-platform API permissions and is read-only on day one. Mave shows what every agent queried, how it correlated, what it concluded, and why.[3]

Mave offers a solution for bringing alert triage, investigation, and response in-house. Mave queries the systems that already hold a customer's data, gathers the required evidence, determines root cause and scope, and takes the next authorized action. Mave can close alerts, update cases, trigger containment, and execute remediation through connected tools. Mave connects on-premises workloads and security tools through lightweight, scoped bridges and combines their live context with cloud and SaaS integrations during each task. For organizations with multiple SIEMs, tenants, and subsidiaries, Mave connects to each SIEM and security tool through scoped APIs and queries data where it lives. Mave keeps context, permissions, and data access separated by environment.[1][4][5][6][7][8][10][13][14]

In the MSSP setting, every Mave agent operates with client-specific context, threat intelligence, permissions, and response policies. Mave applies threat intelligence to the customer's environment and runs continuous, cross-tool threat hunts across the SIEM, EDR, cloud, identity, and other security tools. Mave starts a hunt with a campaign, actor, vulnerability, indicator, technique, or analyst hypothesis. Mave finds coverage gaps, tunes noisy detection rules, and creates new detections from threat intelligence, hunts, and investigations. Mave works across detection languages and formats, including SPL, KQL, YARA-L, Sigma, EQL, Lucene, and SQL-based rules. Mave determines which campaigns, actors, vulnerabilities, indicators, and techniques are relevant to the customer's environment.[1][3][6][9][10][11][12]

Mave is priced by the number of endpoints a customer protects and the size of the team, not by the volume of data. Mave offers managed, searchable retention for security data, with hot and cold tiers set per source. Mave offers managed services: context tuning, threat hunting, detection engineering, and reporting. Mave offers an alternative package for smaller teams at a fixed price.[1][2][3][6][7][9][10][11][12][13][14]

Mave on the record

Sources

Mave full record

  1. [1]mave.comMave · mave.com · undated page, accessed October 23, 2026 · Tier A
  2. [2]Terms and conditionsMave · mave.com · published February 15, 2026 · Tier A
  3. [3]AI Security Operations Platform | MaveMave · undated page, accessed November 10, 2026 · Tier A
  4. [4]Mave Platform | The SecOps Operating SystemMave · undated page, accessed November 10, 2026 · Tier A
  5. [5]Reduce MDR Reliance | MaveMave · undated page, accessed November 10, 2026 · Tier A
  6. [6]SIEM Cost Reduction & Replacement | MaveMave · undated page, accessed November 10, 2026 · Tier A
  7. [7]On-Prem SecOps Deployment | MaveMave · undated page, accessed November 10, 2026 · Tier A
  8. [8]Multi-SIEM & Post-M&A SecOps | MaveMave · undated page, accessed November 10, 2026 · Tier A
  9. [9]Multi-Tenant SecOps For MSSPs | MaveMave · undated page, accessed November 10, 2026 · Tier A
  10. [10]Threat Hunting | MaveMave · undated page, accessed November 10, 2026 · Tier A
  11. [11]Detection Engineering with MITRE ATT&CK | MaveMave · undated page, accessed November 10, 2026 · Tier A
  12. [12]Threat Intelligence | MaveMave · undated page, accessed November 10, 2026 · Tier A
  13. [13]Pricing | MaveMave · undated page, accessed November 10, 2026 · Tier A
  14. [14]AI SOC Agents for Full-Loop SecOps | MaveMave · undated page, accessed November 10, 2026 · Tier A

Torq full record

  1. [1]Torq seriesdTorq · torq.io · published January 12, 2026 · Tier A
  2. [2]CompanyTorq · torq.io · undated page, accessed September 27, 2026 · Tier A
  3. [3]Security startup torq raises cash at 1 2 billion valuationBloomberg · bloomberg.com · published January 11, 2026 · Tier B
  4. [4]Torq AI SOC Platform | AI Agents and Agentic SecOpsTorq · undated page, accessed October 29, 2026 · Tier A
  5. [5]Torq Skull Hoodie – Torq MerchTorq · undated page, accessed October 29, 2026 · Tier A
  6. [6]The Torq AI SOC PlatformTorq · undated page, accessed November 10, 2026 · Tier A
  7. [7]Product Updates | Torq AI SOC PlatformTorq · undated page, accessed November 10, 2026 · Tier A
  8. [8]Torq Integrations | AI SOC and Security Automation IntegrationsTorq · undated page, accessed November 10, 2026 · Tier A
  9. [9]About Torq | The Leading AI SOC PlatformTorq · undated page, accessed November 10, 2026 · Tier A
  10. [10]Torq for MSSPs and MDRsTorq · undated page, accessed November 10, 2026 · Tier A
  11. [11]Torq Security Hyperautomation vs. Legacy SOAR | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  12. [12]Torq Hyperautomation vs. Security Workflow Automation Software | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  13. [13]Security and Compliance | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  14. [14]AI SOC Customers | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  15. [15]Torq Unveils The SOC Brain: The AI SOC That Learns, Not Just Remembers | TorqTorq · published July 28, 2026 · Tier A
  16. [16]Torq AI SOC Platform Reviews & Product DetailsG2 · undated page, accessed November 10, 2026 · Tier C

Spot a factual error? Request a correction.