Swimlane vs Torq (2026)

The Swimlane Marketplace has connectors for Microsoft, AWS, Cisco, CrowdStrike, Palo Alto Networks and others. An Ingestion Agent integrates with any API instantly, and playbooks act across the connected stack after approval. Turbine has connectors for more than 30 vendors, Splunk among them, and every plan includes unlimited integrations. The Threat Intelligence Agent pulls together sources such as VirusTotal and Recorded Future. Hero AI tools reach the connected stack through an MCP server that calls the Turbine engine.

SourceSwimlane, swimlane.com/swimlane-turbine, /platform/enterprise-packaging and swimlane.com/news/ai-agents-case-managementread 2026-10-05

The Torq Store holds a catalog of vendor integrations and steps, and integration triggers ingest data. AI Tools let agents act through those integrations, and Socrates Tools take action on cases. Self hosted step runners reach systems inside the customer's network.

Sourcekb.torq.io/en/articles/12065486-ai-tools-enhance-ai-agent-capabilitiesread 2026-09-28

Swimlane calls Turbine Canvas the world's first ultra simple playbook and AI agent builder. Customers build playbooks with agents as steps, and they decide how alerts are routed between deterministic playbooks and deep and expert agents. Each alert goes to an existing playbook, an AI assisted investigation or a fully agentic one, depending on how complex it is. Hero AI agents can be dragged into a playbook as steps. In a playbook step, the Hero AI action takes a plain language prompt and decides which of its configured tools to call and when.

SourceSwimlane, swimlane.com/swimlane-turbine, /product/ai-soc and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Buyers build no code and low code workflows with triggers, conditions and approval steps, embed AI Agents and AI Task steps in them, and run HyperAgents and the Socrates analyst across triage, investigation and response. Socrates Builder can build and modify workflows from chat.

Sourcekb.torq.io/en/articles/12065413-ai-agents-bring-adaptive-intelligence-into-your-workflowsread 2026-09-28

Incoming alerts are routed to playbooks and AI SOC investigations through the Active Sensing Fabric ingestion layer, so work starts on an alert with no person launching it. Routing checks every alert and sends it to a playbook, an AI assisted investigation or a fully agentic one. The 26.4 release added custom dynamic responses to webhooks. Analysts can also start work from Hero AI chat, which finds and runs components marked visible to Hero AI.

SourceSwimlane, swimlane.com/swimlane-turbine, /product/ai-soc and docs.swimlane.com Create and Modify Components with Hero AIread 2026-10-05

Workflows start on integration events, webhooks, schedules, Torq system events and inbound email, and Auto Triage runs on every incoming alert.

Sourcekb.torq.io/en/articles/9121101-workflow-triggers-in-torq-initiating-workflow-executionsread 2026-09-28

Deep agents use MCP and methodical reasoning, and the AI SOC collects data for each investigation. The Investigation Agent uses identified threats, past investigations and knowledge base articles to plan an investigation and write the playbooks that carry it out. The Verdict Agent reads current, linked and historical case context, including knowledge base articles, threat intelligence and analyst notes. Swimlane does not say how a customer adds its own articles or how that knowledge store is kept up to date.

SourceSwimlane, swimlane.com/product/ai-soc and swimlane.com/news/ai-agents-case-managementread 2026-10-05

The Context Graph resolves identities, assets, networks and policies from IdP, EDR, SIEM, CNAPP, HR, ITSM and threat intel into one normalized, time stamped, source tagged representation enriched with business context. It is kept per tenant, and agents ground triage, investigation and response in it.

Sourcetorq.io/context-graph-and-memoryread 2026-09-28

Case management is the system of record, where case data sits in a set structure. The Verdict Agent and the Investigation Agent read historical cases and past investigations as they work, but Swimlane does not say what an agent keeps between runs, for how long or for whom. Case records count against a yearly allowance, from 100,000 records on the Starter plan to 1 million on Elite.

SourceSwimlane, swimlane.com/product/ai-soc, /platform/ai and /platform/enterprise-packagingread 2026-10-05

A memory layer keeps historical cases with their notes, actions and resolution rationale (Recall), the team's confirmed verdicts and corrections (Reflex) and imported case history (Retrospect), scoped to the tenant. Torq does not describe a lifetime, a retention period or a way to view, edit or delete entries.

Sourcetorq.io/context-graph-and-memoryread 2026-09-28

The AI SOC requires explicit human approval before any state changing action the organization has not already trusted to automation. Analysts can review, change or rebuild any plan the AI writes before it runs, and they can pause, reject or roll back a recommendation at any point. When Hero AI is unsure, it hands the case to a person instead of guessing. In the builder, a component Hero AI drafts stays on the canvas for review until someone saves it.

SourceSwimlane, swimlane.com/product/ai-soc and docs.swimlane.com Create and Modify Components with Hero AIread 2026-10-05

Workflows carry approval steps, and response runs autonomously or human on the loop. Roles can require a workflow to be reviewed before it is published, Case Reviewer lets a reviewer approve or reject a case conclusion before resolution, and analysts can override.

Sourcekb.torq.io/en/articles/10428912-case-reviewer-ensure-investigation-quality-in-torq-s-hypersocread 2026-09-28

Swimlane Cloud holds SOC 2 Type II, ISO/IEC 27001, 27017, 27018 and 27701 and CSA STAR, with a FedRAMP High GOV region, globally enforced two factor authentication, SAML SSO and role based access down to field level, plus SCIM provisioning and audit logging. It also holds SOC 1 Type II and ISO 9001, and Swimlane cites ISO 42001 and FedRAMP High authorization for Hero AI.

Role based access covers workspaces, dashboards, reports, applications and records, and sign in also works through LDAP and Active Directory. Data is encrypted at rest and in transit, and credentials are kept in a secure database. Only a few employees can reach production systems, and contractors have no access to customer production data.

SourceSwimlane, swimlane.com/solutions/swimlane-cloud and swimlane.com/platform/airead 2026-10-05

Torq offers RBAC with roles and scopes and organization managed roles, SSO through Okta, OneLogin, Entra ID, Auth0 and JumpCloud, and two factor authentication. Its site footer carries SOC 2, ISO and FedRAMP badges.

Sourcekb.torq.io/en/articles/9145815-explore-torq-s-rbac-architecture-an-in-depth-guideread 2026-09-28

For every investigation, the AI SOC keeps a plain language record of the agent's reasoning, covering what data it collected, what logic it applied and what conclusion it reached, which can be exported for audit. Turbine also keeps audit logs. The Investigation Agent writes a summary and a timeline for each case. Each Hero AI action returns a request ID, a finish reason and token counts along with its result, and dashboards and reports track how the security team is performing.

SourceSwimlane, swimlane.com/product/ai-soc, swimlane.com/news/ai-agents-case-management and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Workflow executions keep step outputs in the workflow context, and audit logs export automatically to Amazon S3. Socrates Auditing lets teams monitor the AI analyst's actions, and verdicts record their rationale.

Sourcekb.torq.io/en/articles/9743934-socrates-auditing-monitor-your-ai-analystread 2026-09-28

Swimlane runs in the cloud, on premises or air gapped, and Swimlane Cloud is offered in eight regions, the US, UK, EU, Canada, Singapore, Tokyo, Australia and a dedicated FedRAMP High GOV region. The cloud service runs on AWS. In an on premises install, the tools Hero AI calls run inside the customer's own cluster. Setup takes two weeks on the Starter plan and four weeks on the larger plans.

SourceSwimlane, swimlane.com/platform/enterprise-packaging, /swimlane-turbine and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Workspaces run in one of three regions, the United States, the European Union or Japan, provisioned in the region the customer needs. Self hosted step runners run workflow steps inside the customer's own environment, including on EKS and AKS.

Sourcekb.torq.io/en/articles/15516103-regional-availability-deployment-and-data-residency-optionsread 2026-09-28

Hero AI ships named agents (Playbook Generator, Intelligent Visualization, Ingestion) alongside deep and expert agents, and the Swimlane Marketplace carries prebuilt agents, playbooks and connectors that drop into playbooks. Hero AI has seven agents in all, adding Agentic Investigations, Verdict, Threat Intelligence, and MITRE ATT&CK and D3FEND.

The Verdict Agent gives a verdict on a case the way an analyst would, and the MITRE agent maps alerts to standard attack techniques. The Playbook Generator asks clarifying questions as it builds. NIST aligned action recommendations sort each response into containment, eradication, recovery and hardening.

SourceSwimlane, swimlane.com/platform/ai, /product/ai-soc and swimlane.com/news/ai-agents-case-managementread 2026-10-05

A template library of more than 100 workflow templates covers automations, integrations, case management and security operations. Prebuilt agents include Auto Triage, the Socrates analyst and HyperAgents.

Sourcetorq.ioread 2026-09-28

Customers select the AI model for each agent, including their own model, based on performance and availability. Any AWS Bedrock model can run a Hero AI agent, and customers can bring their own model from Anthropic and select Bedrock models. The Hero AI playbook action defaults to Claude Haiku 4.5, can switch to Sonnet or Opus models, and also offers OpenAI and Qwen models. Each plan includes a Hero AI credit allowance, from 37,500 credits on Starter to 262,600 on Elite.

SourceSwimlane, swimlane.com/product/ai-soc, /platform/ai, /platform/enterprise-packaging and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Under Bring Your Own Subscription, customers connect their own subscriptions to OpenAI, Azure OpenAI, Google Vertex AI, Anthropic Claude or Amazon Bedrock and pick the model per AI Agent and per AI Task from a dropdown.

Sourcekb.torq.io/en/articles/13052484-ai-models-bring-your-own-subscription-byosread 2026-09-28

The Turbine API uses personal access token authentication and has a generic request action for any endpoint, Turbine Canvas supports full code, and SCIM provisioning is supported. The API connector accepts a username and password or a personal access token, and its request action takes any method and path.

Hero AI actions can return JSON shaped to a schema the builder defines, and the Plus plan and above add an App Builder and a Git repository. Hero AI calls its tools through an MCP server that talks to the Turbine engine, and the deep agents use MCP as clients, but there is no MCP server for outside agents to connect to.

SourceSwimlane, docs.swimlane.com Swimlane Turbine API connector and Hero AI Native Actionread 2026-10-05

The Torq API is reached with workspace API keys (client ID and secret) exchanged for bearer tokens, and keys can be rotated. Webhooks give external systems endpoints that start workflows.

Sourcekb.torq.io/en/articles/9145827-create-a-torq-api-key-enable-programmatic-accessread 2026-09-28

There is no way to run agents or playbooks against test cases and score the results. The Playbook Generator writes and changes playbooks from prompts, and it does not test them. Swimlane's accuracy and savings figures come from customer stories, such as 100% recommendation accuracy at one customer and 128 of about 180 daily cases closed at a healthcare customer.

SourceSwimlane, swimlane.com/product/ai-soc and swimlane.com/platform/airead 2026-10-05

A workflow, including its AI Agent and AI Task steps, stays in draft where it can be test run with mock outputs and test pads while the published version keeps running, and only a publish puts it live. Torq advises several test runs first, roles can require review before publishing, and Socrates Builder tests and validates workflows before publishing. Torq does not describe a scored evaluation set.

Sourcekb.torq.io/en/articles/9115762-workflow-states-testing-and-publishing-workflows-in-torqread 2026-09-28

Automation acts through API connectors, and no agent operates a browser or desktop. Hero AI works through playbook actions and tools that call the Turbine engine, and the Ingestion Agent reaches new data sources through their APIs. None of these opens a web page or works a screen.

SourceSwimlane, swimlane.com/swimlane-turbine and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Torq does not describe an agent driving a browser, desktop or remote computer. Agents act through integrations, steps and step runners.

Sourcetorq.ioread 2026-09-28