CISO Tribune

Vendor comparison · 2 companies

RunReveal vs Torq

RunReveal sells a unified platform that handles the security lifecycle from data ingestion through investigation and remediation. Torq sells the Torq AI SOC Platform, which turns alerts into action across a security stack. CISO Tribune files both under AI SOC analysts. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • RunReveal
  • Torq
RunReveal vs Torq: Products, Customers and Funding Compared
RunRevealRunReveal sells a unified platform that handles the security lifecycle from data ingestion through investigation and remediation.runreveal.comTorqTorq sells the Torq AI SOC Platform, which turns alerts into action across a security stack.torq.io
What it sells
  • Security Data Lake[1][7]RunReveal integrates natively with 80+ sources and supports Bring-Your-Own-Source functionality to unify logs in one searchable security data lake.
  • Detections[1][4][6][11]RunReveal includes pre-built SQL detections for common threats across AWS, Azure, GCP, GitHub, Okta, and 80+ integrations.
  • Pipelines[1][10]RunReveal's data pipelines let users filter, route, transform, and enrich security logs before they hit storage.
  • Torq AI SOC Platform[4][6][9][14]Turns alerts into action across a security stack.
  • Auto Triage[4][6][7]Agentic AI engine that prioritizes threats and separates noise from actual risk.
  • Case Management[4][6][7][10]Native case management with evidence, timelines and case summaries.
  • Torq HyperAgents®[4]A group of autonomous, transparent, and customizable AI Agents.
  • Socrates[4][6][7][10]Natural language-driven agentic AI that autonomously remediates critical threats.
  • Hyperautomation[4][6]Workflow automation using integrations with the security stack.
  • Context Graph[4][7][9]A visual map of the identities, assets, and relationships in an environment.
  • Integrations[4][6]300 pre-built integrations and 4,000+ pre-built steps.
Categories
Headquarters
Not stated on its pagesTel Aviv, Israel[3]
Founded
2024[3]2020[2][9]
Ownership and funding
Not stated on its pagesPrivately held[4][6][9][16]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • July 28, 2026Torq introduced Torq SOC Brain, a new layer of its AI SOC Platform that learns from historical investigations and analyst decisions.[15]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 10, 2026[16]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, RunReveal sells mainly to security teams that want data management, detection, and response in a single platform. Its use cases include cloud security monitoring for misconfigurations, unauthorized access, and policy violations. Identity and access use cases cover detection of credential abuse, impossible travel, privilege escalation, and unauthorized access. RunReveal states that bring-your-own-cloud lets customers deploy in their own VPC for control over data residency, security, and compliance. RunReveal states that bring-your-own-database runs the platform on a database the customer's team controls.From its own pages, Torq serves MSSPs and MDRs, which get an omniview across all customer workspaces. MSSPs can extend Torq automation capabilities to customer environments they do not directly manage. Torq offers to provide and sign a HIPAA Business Associate Agreement when engaging with HIPAA covered entities. Torq dashboards can be tailored to roles such as SOC Manager, CISO or customer. Torq customers include a global analytics company that rebuilt its playbooks with the Torq AI SOC Platform.
Last verified
October 30, 2026September 27, 2026

Where they overlap

  • RunReveal and Torq are both filed under AI SOC analysts.

Where they differ, field by field

  • RunReveal's primary category is SIEM; Torq's is AI SOC analysts.
  • RunReveal is also filed under Security data lakes and pipelines. Torq is also filed under SOAR and security automation.
  • RunReveal lists Security Data Lake, Detections and Pipelines. Torq lists Torq AI SOC Platform, Auto Triage, Case Management, Torq HyperAgents®, Socrates and 3 more.
  • Torq is headquartered in Tel Aviv, Israel.
  • RunReveal was founded in 2024. Torq was founded in 2020.
  • Torq is privately held.

What it sells: RunReveal

What Security Data Lake does[1][7]
RunReveal integrates natively with 80+ sources and supports Bring-Your-Own-Source functionality to unify logs in one searchable security data lake. RunReveal can be deployed in its SaaS cloud, in a customer cloud account, on a customer database, or completely on-premise.
What Detections does[1][4][6][11]
RunReveal includes pre-built SQL detections for common threats across AWS, Azure, GCP, GitHub, Okta, and 80+ integrations. Existing rules can be modified, or custom detections written, using standard SQL or Sigma format. RunReveal lets users preview detections against historical logs, validate logic with real events, and iterate on rules. RunReveal can deploy Sigma rules that evaluate events during ingestion rather than on a schedule.
What Pipelines does[1][10]
RunReveal's data pipelines let users filter, route, transform, and enrich security logs before they hit storage. RunReveal provides a visual pipeline builder for filtering, routing, and basic transformations. For advanced uses such as complex data reshaping or custom enrichment logic, transformations can be written in SQL or built-in functions can be used. RunReveal provides real-time pipeline metrics showing volume processed, filtering rates, routing destinations, processing latency, and error rates.

What it sells: Torq

What Torq AI SOC Platform does[4][6][9][14]
The Torq AI SOC Platform unifies visibility and turns alerts into action across a security stack. The Torq AI SOC Platform includes 300 pre-built integrations and 4,000+ pre-built steps. Torq describes the platform as taking action and closing cases across the complete threat management lifecycle.
What Auto Triage does[4][6][7]
Guidance and Rules for Auto Triage can be created with Socrates Builder. Auto Triage adds graph context directly to alerts.
What Case Management does[4][6][7][10]
Case Management is native to the Torq platform and provides a single source of truth with evidence, timelines, and case summaries. Torq case management is built on the Open Cybersecurity Schema Framework (OCSF) with automation-first, event-driven workflows.
What Torq HyperAgents® does[4]
Torq HyperAgents is a group of autonomous, transparent, and customizable AI Agents. Torq HyperAgents are given access to the existing tools and steps in the SOC to deliver agentic insights and take action. Agentic runbooks access authorized data and tools, and AI Agents cross-reference historical cases, recognize threat patterns and summarize findings.
What Socrates does[4][6][7][10]
Socrates is described as natural language-driven agentic AI that autonomously remediates critical threats. Socrates coordinates specialized AI Agents and manages cases end-to-end. Socrates handles Tier-1 and Tier-2 tickets as a 24×7 on-call teammate.
What Hyperautomation does[4][6]
Torq Hyperautomation uses integrations with the security stack for workflow automation. Torq fuses agentic reasoning and Hyperautomation, from alert through remediation. AI Agents can be used to build new integrations, workflows, and custom use cases.
What Context Graph does[4][7][9]
Context Graph gives a visual map of the identities, assets, and relationships in an environment. Auto Triage adds graph context directly to alerts.
What Integrations does[4][6]
The Torq AI SOC Platform includes 300 pre-built integrations and 4,000+ pre-built steps. AI Agents can be used to build new integrations, workflows, and custom use cases. Torq uses real-time API monitoring so that automations stay connected when third-party data formats change.

Questions about RunReveal and Torq

What do RunReveal and Torq sell?
RunReveal sells Security Data Lake, Detections and Pipelines. Torq sells Torq AI SOC Platform, Auto Triage, Case Management, Torq HyperAgents®, Socrates and 3 more.
Are RunReveal and Torq in the same category?
They share AI SOC analysts. RunReveal's primary category is SIEM and Torq's is AI SOC analysts.
Where are RunReveal and Torq headquartered?
Torq is headquartered in Tel Aviv, Israel.
When were RunReveal and Torq founded?
RunReveal was founded in 2024. Torq was founded in 2020.
Who owns RunReveal and Torq?
Torq is privately held.
Who are RunReveal and Torq sold to?
From its own pages, RunReveal sells mainly to security teams that want data management, detection, and response in a single platform. From its own pages, Torq serves MSSPs and MDRs, which get an omniview across all customer workspaces.
What have RunReveal and Torq announced recently?
July 28, 2026: Torq introduced Torq SOC Brain, a new layer of its AI SOC Platform that learns from historical investigations and analyst decisions.

About RunReveal

RunReveal sells a unified platform that handles the security lifecycle from data ingestion through investigation and remediation. RunReveal unifies security data management with AI-powered detection and response. RunReveal brings data management, detection, and response into a single platform for security teams. RunReveal provides the core capabilities of a Security Information and Event Management (SIEM) platform, namely centralized log management, threat detection, alerting, and incident investigation.[1][2][4][5][6][13]

RunReveal integrates natively with 80+ sources and supports Bring-Your-Own-Source functionality to unify logs in one searchable security data lake. RunReveal ingests from 80+ sources including AWS, GCP, Azure, Okta, GitHub, and custom logs. RunReveal connects to Slack, PagerDuty, Jira, ServiceNow, and any destination via webhooks for alerting and response. RunReveal stores both the original raw logs and the normalized, enriched versions. RunReveal monitors, normalizes, and enriches log data to prepare it for querying, search, and investigations. Data monitoring alerts users when logs stop flowing, schemas change, or volume spikes unexpectedly.[1][6][7][8][9]

RunReveal's data pipelines let users filter, route, transform, and enrich security logs before they hit storage. RunReveal provides a visual pipeline builder for filtering, routing, and basic transformations. For advanced uses such as complex data reshaping or custom enrichment logic, transformations can be written in SQL or built-in functions can be used. RunReveal provides real-time pipeline metrics showing volume processed, filtering rates, routing destinations, processing latency, and error rates. RunReveal pipelines can enrich logs with threat intelligence, geolocation data from IP addresses, custom fields from lookup tables, and user or asset information from internal systems. RunReveal supports bring-your-own enrichment data from internal systems, custom threat feeds, employee databases, or any context source that helps investigations.[1][4][7][8][10]

RunReveal includes pre-built SQL detections for common threats across AWS, Azure, GCP, GitHub, Okta, and 80+ integrations. Existing rules can be modified, or custom detections written, using standard SQL or Sigma format. RunReveal lets users preview detections against historical logs, validate logic with real events, and iterate on rules. RunReveal can deploy Sigma rules that evaluate events during ingestion rather than on a schedule. RunReveal offers both code-based and built-in options for detections. RunReveal routes alerts based on severity, tags, and custom logic that users define. AI can analyze a detection library against MITRE ATT&CK, identify gaps for specific attack techniques, or recommend rules based on log sources.[1][11][12]

RunReveal's native AI chat and Model Context Protocol (MCP) server bring AI into security workflows to investigate alerts, analyze patterns, and create detections using natural language. RunReveal's AI correlates logs, enriches context, and surfaces relevant insights when users investigate alerts. RunReveal supports Claude, ChatGPT, Gemini, AWS Bedrock, and other major large language models. RunReveal provides audit logging for all AI queries and data access, role-based access controls for AI features, and support for pre-approved model lists.[4][12]

RunReveal's AI agent automatically investigates alerts, pulls context from logs, and updates cases with findings. Specialized agents with custom prompts can be created for specific log types or detection categories. Agents can be configured with a chosen model and permissions, run on a schedule, or triggered on detection. RunReveal offers a built-in Weekly Threat Hunt agent template that runs automatically on a schedule.[13]

RunReveal can be deployed in its SaaS cloud, in a customer cloud account, on a customer database, or completely on-premise. Bring-your-own-cloud lets customers deploy RunReveal in their own VPC for control over data residency, security, and compliance. RunReveal is SOC2 Type 2 certified and compliant with CCPA and GDPR. RunReveal supports RBAC, SSO, and Just-In-Time provisioning for access control. RunReveal uses usage-based pricing in which customers pay for the logs they store and query, not for ingestion.[5][7]

SQL-powered dashboards and analytics cover core security metrics, detection performance, and operational KPIs. RunReveal's AI agent generates SQL queries from natural language prompts. Dashboard graphs can be sized S, M, L, or XL on a 12-column grid. RunReveal uses standard SQL as its query language. Cloud security monitoring covers misconfigurations, unauthorized access, and policy violations, with pre-built detections mapped to cloud security frameworks. Identity and access use cases cover detection of credential abuse, impossible travel, privilege escalation, and unauthorized access across Okta, Azure AD, and other identity providers.[1][4][5][6][7][12][13][14]

RunReveal on the record

Sources

RunReveal full record

  1. [1]runreveal.comRunReveal · runreveal.com · undated page, accessed October 30, 2026 · Tier A
  2. [2]runreveal.comRunReveal · runreveal.com · undated page, accessed October 30, 2026 · Tier A
  3. [3]AboutRunReveal · runreveal.com · undated page, accessed October 30, 2026 · Tier A
  4. [4]RunReveal | Fast, Scalable Security Log ManagementRunReveal · undated page, accessed November 10, 2026 · Tier A
  5. [5]RunReveal Platform | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A
  6. [6]Modern SIEM Alternative | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A
  7. [7]Modern Security Data Lake | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A
  8. [8]Security Data Readiness | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A
  9. [9]Security Data Readiness | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A
  10. [10]Security Data Pipelines | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A
  11. [11]Detections | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A
  12. [12]AI-Powered Security Analysis | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A
  13. [13]AI SOC Platform | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A
  14. [14]Security Dashboards & Analytics with AI | RunRevealRunReveal · undated page, accessed November 10, 2026 · Tier A

Torq full record

  1. [1]Torq seriesdTorq · torq.io · published January 12, 2026 · Tier A
  2. [2]CompanyTorq · torq.io · undated page, accessed September 27, 2026 · Tier A
  3. [3]Security startup torq raises cash at 1 2 billion valuationBloomberg · bloomberg.com · published January 11, 2026 · Tier B
  4. [4]Torq AI SOC Platform | AI Agents and Agentic SecOpsTorq · undated page, accessed October 29, 2026 · Tier A
  5. [5]Torq Skull Hoodie – Torq MerchTorq · undated page, accessed October 29, 2026 · Tier A
  6. [6]The Torq AI SOC PlatformTorq · undated page, accessed November 10, 2026 · Tier A
  7. [7]Product Updates | Torq AI SOC PlatformTorq · undated page, accessed November 10, 2026 · Tier A
  8. [8]Torq Integrations | AI SOC and Security Automation IntegrationsTorq · undated page, accessed November 10, 2026 · Tier A
  9. [9]About Torq | The Leading AI SOC PlatformTorq · undated page, accessed November 10, 2026 · Tier A
  10. [10]Torq for MSSPs and MDRsTorq · undated page, accessed November 10, 2026 · Tier A
  11. [11]Torq Security Hyperautomation vs. Legacy SOAR | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  12. [12]Torq Hyperautomation vs. Security Workflow Automation Software | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  13. [13]Security and Compliance | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  14. [14]AI SOC Customers | TorqTorq · undated page, accessed November 10, 2026 · Tier A
  15. [15]Torq Unveils The SOC Brain: The AI SOC That Learns, Not Just Remembers | TorqTorq · published July 28, 2026 · Tier A
  16. [16]Torq AI SOC Platform Reviews & Product DetailsG2 · undated page, accessed November 10, 2026 · Tier C

Spot a factual error? Request a correction.