Legion vs Torq: agents learned from your analysts or agents on a hyperautomation platform

How do you automate a SOC whose best runbook lives in one senior analyst’s head? That is the question Legion was built around. The founders came from Microsoft Sentinel and launched in July 2025 with a product that watches analysts work in the browser and turns what it sees into agent workflows.

Torq answers the same question from the other end. HyperSOC runs on the Torq Hyperautomation platform, where Socrates, an AI SOC analyst, directs Runbook, Investigation, Remediation, and Case Management agents, and integrations carry out actions such as isolating an endpoint in CrowdStrike or resetting a password in Okta. Legion says it needs zero integrations, because it drives the tools analysts already use through their browsers. Both claims come from vendor material and are stated, not independently demonstrated.

Buy Legion when your SOC runs on homegrown or hard-to-integrate tools and you want agents to learn from analysts’ own browser work before acting on their own. Buy Torq when you want an integration-backed platform where AI agents triage, investigate, and remediate through orchestrated workflows across the security stack.

Overview

	Legion	Torq
Primary use case	Agentic security operations learned from the team’s own investigations, playbooks, runbooks, and past cases	AI SOC and security hyperautomation: alert triage, investigation, case management, and remediation workflows
Day-to-day workflow	Analysts keep working while Legion observes, then review and approve the workflows it runs in Companion Mode before granting autonomy in phases	Alerts arrive, Socrates and its agents enrich and investigate, cases are prioritized, and remediation runs autonomously or escalates to a human
Main buying consideration	No public pricing. Sold by demo and quote	AWS Marketplace lists Torq Essential, Enterprise, and Elite each at USD 450,000 for 12 months, with contract units scaling the total and no plan feature split on the listing

We reviewed Legion’s homepage and its July 2025 launch coverage in Fortune, plus Torq’s HyperSOC-2o announcement and AWS Marketplace listing, on 14 Oct 2026. We did not run either product.

Legion

Torq

Editions and pricing

Torq’s one public figure is identical across its three plans, so it shows contract scale rather than plan differences. Legion publishes nothing.

	Legion	Torq
How it is sold	One platform with Learning, Companion, and Autonomous modes	HyperSOC on the Torq Hyperautomation platform, in Essential, Enterprise, and Elite plans
Plan differences	Not confirmed in public documentation	Not published on the Marketplace listing
Integration model	Zero integrations. Agents work through analysts’ browsers	Integrations and pre-built workflow steps that agents call to act on other tools

How investigations start

Both start an investigation with AI. They differ in where the investigation logic comes from.

	Legion	Torq
Source of the logic	Observed analyst investigations, playbooks, runbooks, and past cases captured in the browser	Runbook Agent plans investigations from past incident outcomes and similar attack patterns
Data access	Through the tools analysts already open in the browser	Investigation Agent correlates third-party threat intelligence and event data across connected sources
Transparency	Shows what it plans to do, does it, and logs every step	Records the reasoning behind decisions for each case, with AI-generated case summaries

Investigation output and response

Both can act without a human. Both also let the team keep a human in the loop.

	Legion	Torq
Autonomy model	Autonomy granted in phases, from companion to autonomous, on the team’s terms	Remediation Agent acts autonomously or escalates critical cases for human-in-the-loop remediation
Action path	Executes workflows directly through analysts’ browsers	Triggers Hyperautomation workflows in tools such as CrowdStrike, Okta, and Abnormal
Case management	Not confirmed in public documentation	Case Management Agent with dynamic case prioritization

Choose Legion when your investigations depend on homegrown or legacy consoles that are hard to integrate, and you want agents to copy how your analysts already work before you let them act alone. Choose Torq when your stack is integration-ready and you want orchestrated agents, case management, and remediation workflows that reach across EDR, identity, and email tools.