Tines vs Torq: which SOAR fits your ops queue?

The open queue does not care which logo is on the SOAR slide. It is the same 40 or 400 alerts, a phishing report, and a case that has to leave the board before the next handoff.

If operators still need a workflow they can open, edit, and defend in an incident review, start with Tines Stories. If the failure is analysts stitching enrichment by hand while alerts wait on a playbook author, start with Torq.

Between these two, the split is the control model, not a hard authored-versus-autonomous line. Both can include AI steps. Tines keeps builders placing AI Agent actions inside a Story they version and debug. Torq closes more of the first mile with Auto Triage and Socrates under approval guardrails. Editions, how a case opens, and what each run leaves behind are below.

	Tines	Torq
Job	Stories and cases for security and IT: visual workflows with optional AI Agent steps, then cases hold the work	AI SOC that triages alerts into cases and runs hyperautomation under approval guardrails
How a bad day closes	A Story you already built opens or updates a case, then the actions you placed run	Auto Triage writes a verdict; malicious alerts become cases; response stays inside that case
Day-to-day workflow	Failed story runs, debugging a branch, approval waits on a Page, and cases waiting on a human action	Verdict overrides, approval-gated response steps, cases assigned to Socrates or an analyst, and guardrail stops
Deploy	Cloud tenant. Business and Enterprise can self-host	Cloud AI SOC platform
License/pricing	Community is free with hard caps. Cases are a paid add-on. Business and Enterprise are quoted	AWS Marketplace lists Essential, Enterprise, and Elite each at $450,000 for 12 months (identical posted line; feature split and unit quantity confirm on quote)
Who operates it	Whoever builds and owns the Stories, often SOC or IT automation	SOC leads set guardrails. Analysts confirm, override, or take a case back

We reviewed first-party product pages, pricing notes, and launch posts on 30 Sep 2026, plus one Hacker News comment from Sep 2025. We did not run either product in a paid tenant, so this is not a hands-on benchmark.

Tines

Torq

Tines shipped Tines 3B on 31 Jul 2026, a separate AI-native environment for agents, apps, and automations. Stories remains the visual designer for security and IT, and existing customers can explore 3B at no extra charge. Torq released HyperSOC-2o on 23 Apr 2025, with Socrates coordinating runbook, investigation, remediation, and case-management agents on the hyperautomation layer.

Editions and pricing

Stories Community is the only Tines tier with a published cap you can start today. Torq’s public number is a marketplace contract, not a self-serve calculator.

	Tines	Torq
How you buy it now	Community signup, then a quote for Business or Enterprise	Sales, or an AWS Marketplace contract
Public units (30 Sep 2026)	Community: 1 builder, 3 flows, 25,000 events a month, unlimited viewers, SSO. 3B Explore, a different product: 3 live workflows, 5,000 Tines units a month, one-time $50 AI allowance	Essential, Enterprise, and Elite each shown at $450,000 for 12 months
What the invoice covers	Stories edition plus add-ons. Cases also unlock records and dashboards. 3B paid plans scale Tines units: Core 150k, Scale 300k, Power 600k a month. Dollar rates for those plans are quote-only	Plan scope plus a unit quantity. The listing does not publish which features sit in which plan, so $450,000 is the posted contract line, not a confirmed all-in invoice
Self-serve start	Community is free. Cases on paid plans include a one-time 45-day trial. Business and Enterprise can self-host. Packaging for new Stories customers changed on 25 Jun 2025	No free SOC tier on the marketplace listing

Model the quote against event or unit volume, whether cases are in the Stories contract, and who maintains automations after the pilot.

How investigations start

	Tines	Torq
Entry	A Webhook action emits an event from an HTTP callback (SIEM, Jira, Slack, a git push). Pages, email, and schedules are other doors	Connectors ingest alerts, normalize them to OCSF, and extract IPs, domains, hashes, users, and hosts
First decision	The story you placed: HTTP steps, an AI Agent action, then a case open if you built that branch	Auto Triage enriches, applies deterministic rules for critical assets and users, then writes true-positive or false-positive, urgency, risk, evidence, a MITRE mapping, and suggested actions
Case open	Manual, a few clicks in Stories, or automatic from a story. Cases are absent on Community	Malicious alerts promote into Case Management. Non-malicious alerts can trigger tuning workflows
Who writes the next step	The story owner. Community includes the AI Agent action and cannot bring your own model	Socrates can run the case, calling specialist agents, until an analyst overrides the verdict or takes the thread

Example: Investigating an impossible-travel alert. A SIEM fires “impossible travel” on a privileged user. In Tines, a Webhook Story opens a case, runs enrichment HTTP steps, then pauses on a Page for manager approval before disable-user or session-revoke actions; if a branch fails, the builder debugs that Story run and re-runs the saved path. In Torq, Auto Triage writes a verdict and evidence package; a malicious verdict becomes a case where Socrates can propose containment, but approval-gated response steps stay blocked until an analyst confirms, and a guardrail stop or failed connector step is visible in the case thread. Package scope still differs: Tines Cases are a paid add-on (absent on Community), while Torq case promotion is part of the AI SOC path on the quoted plan.

This comment names Torq in the SOAR and AI SOC bucket. It does not mention Tines or score Stories against Auto Triage. Use the suspicious-login scenario above for approval gates, debug, failed-step recovery, and package scope.

What each playbook produces

	Tines	Torq
Artifact	Story events, case comments, and actions. Records and dashboards arrive with the cases add-on	A verdict package, then a case thread with evidence, tasks, and SLA timers
Response	Whatever actions the story calls: HTTP to the tools you wired, pages for a human, notifications	Automated containment, analyst approval at a checkpoint, or a manual action logged in the same thread. Torq’s Jul 2026 AI SOC guide cites 300+ integrations and 4,000+ pre-built steps
Memory	Version history, saved story runs on paid team features, and the case record you chose to keep	SOC memory: confirmations, overrides, closure reasons, and escalation paths feed the next triage
Audit shape	You can replay the story. The path is the one an author drew	Agent steps are logged in the case. Reasoning is visible, and a human can redirect mid-thread

If the artifact you will reread in an incident review is a story with a named owner, that is the Stories output. If it is a verdict plus the actions that followed inside one case, that is the Torq output.

Choose Tines when you need Stories and cases your team still owns and debugs six months later. Choose Torq when the shift needs Auto Triage verdicts and approval-gated response inside one case thread.