TinesvTorq
Tines 6.42Torq 6.77
The totals are 0.35 apart. Read the rows that decide the pair as well as the total. Scores read 2026-11-03. The full bout page.
The nine rows, side by side
Playbook authoring model
weight 14 of 100Tines
8.0
No-code and low-code story builder; build AI agents, apps and automations; import and export of stories as files.
Torq
8.0
Low-code and full-code workflow builder; natural-language workflow creation and agentic runbooks for hunting.
torq.io, read 2026-11-03 (vendor claim) (search summary only)
Tines documents a no-code and low-code story builder, agents and apps, with stories that import and export as files (Tines docs, 2026-11-03). Torq's own page describes low-code and full-code builders, natural-language workflow creation and agentic runbooks for hunting (vendor claim, 2026-11-03). Neither side states what its AI authoring cannot build. The row is a draw. tines.com, read 2026-11-03
Integration count and depth documented
weight 14 of 100Tines
5.0
No integration count on the home page; positioned as vendor-agnostic. HTTP-based actions reach any API (not read on a docs page).
tines.com, read 2026-11-03
Torq
5.0
The torq.io home page read states no count. A third party reading Torq pages reports 300 integrations and 4,000+ pre-built steps; confirm on Torq's own page before publishing.
torq.io, read 2026-11-03
Neither home page read on 2026-11-03 publishes an integration count. Tines says it reaches any API through HTTP-based actions and was not read on a docs page. A third party reports 300 integrations and 4,000+ pre-built steps for Torq, and that figure is not on Torq's own page, so it does not count. Both publish nothing on this point, and both rows carry a re-read flag. The row is a draw. torq.io, read 2026-11-03
Case management and collaboration
weight 8 of 100Torq
8.0Ahead
A 'Manage' module creates, assigns and manages cases from one record, per the vendor page.
torq.io, read 2026-11-03 (vendor claim)
Torq's page describes a Manage module that creates, assigns and manages cases from one record (vendor claim, 2026-11-03). The Tines pages scored show no case management, so the row is 4.0 and carries a re-read flag: Tines' docs sidebar also lists a Cases section that the scoring pass did not open. The row goes to Torq, and it is worth 0.32 of the 0.35 total gap. torq.io, read 2026-11-03
Approvals and human-in-the-loop controls
weight 12 of 100Tines
7.0
Home page states governance, guardrails and monitoring, and that you choose where and when models are used. Coverage of the January 2026 AI interaction layer cites human-in-the-loop controls and audit logging (search summary).
tines.com, read 2026-11-03 (vendor claim) (search summary only); tines.com, read 2026-11-03 (vendor claim) (search summary only)
Torq
8.0Ahead
Vendor page: response can run completely autonomously or with human-on-the-loop oversight, with a manual override and transparent audit logs. Per-action gating detail not read.
torq.io, read 2026-11-03 (vendor claim)
Torq's page says response can run fully autonomously or with human-on-the-loop oversight, with a manual override and transparent audit logs (vendor claim, 2026-11-03); per-action gating was not read. Tines states governance, guardrails and monitoring on its home page (vendor claim), and its human-in-the-loop and audit logging detail comes from a search summary only. The row goes to Torq by one point. torq.io, read 2026-11-03
Agentic or AI features that are documented
weight 12 of 100Tines
7.0
AI SOC for alert intake, triage and remediation with routing to an analyst; agents inside stories. Tines 3B (July 2026) is reported by a competitor; Tines' blog read does not carry the launch post.
tines.com, read 2026-11-03 (vendor claim); tines.com, read 2026-11-03 (vendor claim)
Torq
8.5Ahead
Agents for triage, investigation, response, hunting and reporting on a continuously updated context model that records verdicts, exceptions and overrides. Limits of the agents are not stated. 'Over 90 percent of cases closed autonomously' is a vendor claim reported by third parties; not on the page read.
torq.io, read 2026-11-03 (vendor claim)
Torq lists agents for triage, investigation, response, hunting and reporting on a context model that records verdicts, exceptions and overrides, and states no limits for them (vendor claim, 2026-11-03). Its claim that over 90 percent of cases close autonomously is reported by third parties and is not on the page read, so it is not scored. Tines describes an AI SOC for intake, triage and remediation with agents inside stories (vendor claim); its Tines 3B launch of July 2026 is reported by a competitor and its own blog read does not carry it. The row goes to Torq. torq.io, read 2026-11-03
Hosting and data residency options
weight 8 of 100Tines
6.0Ahead
Pricing page says 'flexible hosting options are available' and names none. A self-hosted tenant is mentioned in import docs.
Torq
5.0
Described as cloud-native with SOC 2, HIPAA and ISO certifications per third-party reading; no regions or self-hosted option read.
torq.io, read 2026-11-03
Tines' pricing page says flexible hosting options are available and names none, and its import docs mention a self-hosted tenant (2026-11-03). Torq is described as cloud-native with SOC 2, HIPAA and ISO certifications by a third-party reading, and no regions or self-hosted option were read. Both rows are thin. The row goes to Tines by one point. tines.com, read 2026-11-03
Pricing model and transparency
weight 8 of 100Tines
6.0Ahead
A free edition (3 live workflows, one-time USD 50 AI allowance) is published; paid editions are by request with no pricing unit.
tines.com, read 2026-11-03
Torq
3.0
No price on the home page; its pricing URL returned 404. Review sites report demo-only pricing and no free trial.
torq.io, read 2026-11-03
Tines publishes a free edition with 3 live workflows and a one-time 50 USD AI allowance, and sells paid editions by request with no pricing unit (Tines pricing page, 2026-11-03). Torq shows no price on its home page, and its pricing URL returned 404 on the read date. The row goes to Tines and is worth 0.24 of the total, which offsets most of Torq's case management lead. tines.com, read 2026-11-03
Migration tooling and import or export formats
weight 14 of 100Tines
6.0
Tines' help article, read 2026-11-03, names the format: stories export as JSON with credentials, resources and event data excluded and import with a Replace option, while the docs page itself does not name the format, no inbound SOAR converter was found, and a library story moves Splunk SOAR case records, not logic.
explained.tines.com, read 2026-11-03; tines.com, read 2026-11-03
Torq
6.0
Workflows export and import as YAML including custom steps, nested workflows and tags. No converter from XSOAR or Splunk SOAR found; a 'Kill Your SOAR' guide is behind a form.
kb.torq.io, read 2026-11-03
Torq exports and imports workflows as YAML, including custom steps, nested workflows and tags (Torq knowledge base, 2026-11-03). Tines documents story export and import across tenants with a replace option, and leaves out credentials and event data (Tines docs, 2026-11-03). Neither side publishes a converter from XSOAR or Splunk SOAR, and Torq's Kill Your SOAR guide sits behind a form and was not read. Both publish nothing on inbound conversion. The row is a draw. kb.torq.io, read 2026-11-03
Ownership stability
weight 10 of 100Tines
8.0
Independent; USD 125M round led by Goldman Sachs Alternatives in February 2025 at about USD 1.13B. Product naming changed in 2026 (Tines Stories and 3B).
pymnts.com, read 2026-11-03 (search summary only); tines.com, read 2026-11-03 (search summary only)
Torq
8.5Ahead
Independent. USD 140M Series D at USD 1.2B valuation announced 2026-01-12; USD 332M raised in total per press.
businesswire.com, read 2026-11-03
Torq announced a 140M USD Series D at a 1.2B USD valuation on 2026-01-12 (Business Wire, read 2026-11-03) and acquired Jit on 2026-05-19. Tines is independent after a 125M USD round led by Goldman Sachs Alternatives in February 2025 at about 1.13B USD (PYMNTS, read 2026-11-03), and renamed parts of its product in 2026. The row goes to Torq by half a point. businesswire.com, read 2026-11-03
Verdict by buyer type
- Microsoft shop
- No separation on the evidence read: neither Tines nor Torq has a Microsoft-specific page in the data, so test the Defender and Sentinel connectors in a trial.
- Splunk shop
- Tines fits slightly better, because it moves Splunk SOAR case records through a library story, though not playbook logic; Torq names no converter and advises redesign over lift and shift.
- small team
- Tines fits better, because it publishes a free edition with 3 live workflows and a one-time 50 USD AI allowance; Torq shows no price and its pricing URL returned 404 on 2026-11-03.
- regulated or air-gapped
- Tines fits better, because its docs list a self-hosted deployment; Torq is cloud-native, with no self-hosted option read.
- agent-first
- Torq fits better, because it runs agents for triage, investigation, response and hunting on a context model that records overrides (vendor claim), and Tines scores 7.0 against Torq's 8.5 on documented AI features.
- leaving a legacy SOAR
- No separation on the evidence read: both export their own files and neither publishes a converter from another SOAR, so ask each for a written list of what does not port.
Moving between these two is a different question. The playbook portability matrix records, row by row, what each vendor documents about moving playbooks in and out. It is also a dataset you can download. The scoring page states every weight.
The card, in score order
- 1 Cyware 7.24 Threat-intel-led SOAR. Opens a band.
- 2 Torq 6.77 SOAR with agents. Opens a band.
- 3 Splunk SOAR (Cisco) 6.68 SOAR. In a band with Torq (within 0.25).
- 4 D3 Security 6.67 SOAR moving to agentic. In a band with Torq (within 0.25).
- 5 Tines 6.42 SOAR with agents. Opens a band.
- 6 Mate Security 6.22 Agentic platform, not a SOAR. In a band with Tines (within 0.25).
- 7 Microsoft Sentinel 6.21 SOAR bundled with a SIEM. In a band with Tines (within 0.25).
- 8 Palo Alto Cortex XSOAR 6.18 SOAR. In a band with Tines (within 0.25).
- 9 Swimlane (Turbine) 6.14 SOAR. Opens a band.
- 10 Google Security Operations 5.98 SOAR bundled with a SIEM. In a band with Swimlane (Turbine) (within 0.25).
- 11 BlinkOps 5.82 SOAR with agents. Opens a band.
- 12 ServiceNow Security Operations 4.90 SOAR bundled with ITSM. Opens a band.
Twelve platforms are covered and 14 are scored in the dataset. Totals within 0.25 of the top of a band are a band, not a ladder. Mate Security sits 6th of 14 scored; it is not a SOAR and the profile says which rows are answered by a different mechanism.
What this page cannot say
Every score rests on vendor pages read on 2026-11-03. Where a page was not opened in full the score is marked for a re-read, and totals can move once it is. Accuracy and closure figures are vendor claims and are not scored. IT workflow automation and general robotic process automation are out of scope.
ThreatConnect and Revelstoke are scored in the dataset and not profiled: see ThreatConnect and Revelstoke.
The card by buyer
Leaving a platform
- Leaving Palo Alto Cortex XSOAR
- Leaving Splunk SOAR (Cisco)
- Leaving Swimlane (Turbine)
- Leaving Microsoft Sentinel
- Leaving Google Security Operations
- Leaving D3 Security
- Leaving Cyware
Alternatives
- Instead of Cyware
- Instead of Torq
- Instead of Splunk SOAR (Cisco)
- Instead of D3 Security
- Instead of Tines
- Instead of Mate Security
- Instead of Microsoft Sentinel
- Instead of Palo Alto Cortex XSOAR
- Instead of Swimlane (Turbine)
- Instead of Google Security Operations
- Instead of BlinkOps
- Instead of ServiceNow Security Operations