Torq Purchases Jit to Provide AI-Powered Security Context

Torq purchased a context graph startup led by Cybereason’s former chief revenue officer to better understand relationships between users, endpoints, identities, alerts and privileges.

The New York-based security operations vendor said its acquisition of Boston-based Jit will make it easier for Torq to interpret the business significance of a security event rather than simply processing alerts in isolation, said co-founder and CEO Ofer Smadari. He said identical alerts can carry dramatically different levels of risk depending on who or what is involved.

“It’s an artificial intelligence context graph that can understand business relations between different assets from identity to endpoints to different types of alerts, and understand the real context in real time,” Smadari told ISMG.

Jit, founded in 2021, raised $38.5 million in a June 2022 seed round led by Boldstart Ventures and has 33 employees joining Torq, including co-founder and CTO David Melamed. The company has been led since May 2023 by Shai Horovitz, who spent nearly eight years at endpoint security firm Cybereason. Terms of the deal weren’t disclosed, though Business Insider reported Torq planned to pay $50 million (see: Torq Gets $140M Series D to Fuel AI-Powered SOC Capabilities).

How Jit’s Context Graph Aids Alert Triage, Case Management

Smadari said Jit’s context graph enables AI agents to understand the relationships between different personas in an organization immediately and make more intelligent triage decisions without extensive human involvement. Rather than querying external systems repeatedly for information, he said the context graph can learn histories, privileges, access patterns, entitlements and relationships between assets over time.

“For every prospect or customer, it can learn their environment, learn their assets, learn their history, learn their privilege access entitlements, logins without us needing to query your scene, query your vendors or query your data link,” Smadari said.

Jit’s technology will support alert triage, autonomous investigations, workflow automation, case management and AI agents across the company’s broader architecture, Smadari said. Torq currently ingests alerts from dozens of security tools and autonomously investigates and classifies many of them, and Smadari said contextual intelligence will help the system make more accurate decisions earlier.

“Everything that we are building today with context will help organizations learn a lot faster and stop alerts at the gate of the alert triage phase,” Smadari said.

When it comes to case management, Smadari said the platform will continuously learn from historical incidents and analyst decisions. If analysts previously identified a certain alert pattern as a false positive, Smadari said the context graph will remember that decision and prevent similar alerts from escalating unnecessarily in the future. This allows the system to become progressively more accurate over time.

“Everything that will go to case management, even if it’s false positive or true positive, we will learn it,” Smadari said. “We’ll get it back as a feedback loop to learn and stop it at the gate. It’s full context.”

How Jit’s Technology Makes Torq’s AI Agents More Powerful

Smadari said Torq’s platform is increasingly powered by AI agents capable of conducting investigations, automating workflows and resolving incidents with minimal human intervention. The addition of Jit’s context graph enhances those capabilities since agents will have immediate access to a continuously updated understanding of the organization’s assets, users, relationships and prior incidents, he said.

“We are going to release soon what looks like Cursor for security,” Smadari said. “You can build full security operation agents with prompting, and it’s working amazingly in production in minutes. So, we are connecting Jit to this component as well to other components.”

Torq currently claims to reduce alert noise by 70% through autonomous triage and investigation, and Smadari said contextual intelligence will help the firm increase that reduction rate to nearly 90%. The context graph gives agents access to deeper environmental awareness, helping the system probe prior incidents, user behavior, access privileges and historical outcomes before assigning a verdict.

“We are reducing the noise today like 70%,” Smadari said. “I believe that it will jump to like 88% because we’ll know a lot. To improve from like 70% noise reduction to 90% noise reduction is amazing.”

Torq increasingly competes against security operations vendors such as Palo Alto Networks and Splunk, and he said the company fully replaces legacy alert triage and case management systems in roughly 70% of customer deals. He said the remaining customers tend to be highly cloud-native organizations that deliberately avoid monolithic security platforms but still use Torq alongside selected third-party tools.

“We are replacing the alert triage,” Smadari said. “We are replacing your previous SOAR platform case management if you’re using Palo Alto or Jira or ServiceNow or any other sort of case management.”