ThreatConnect Threat Intelligence Platform and Tines are competitors in the cybersecurity space. ThreatConnect has an advantage in tool integration and visibility, while Tines excels in automation and workflow efficiency.
Features: ThreatConnect TIP includes extensive threat data integration, enhanced detection capabilities, and customizable intelligence automation. Tines offers powerful security task automation and easy workflow configuration.
Ease of Deployment and Customer Service: ThreatConnect TIP supports complex integrations with excellent customer support, making it suitable for large organizations. Tines provides straightforward deployment and quick setup, appealing to teams seeking rapid implementation.
Pricing and ROI: ThreatConnect TIP has a higher setup cost but is valuable for comprehensive threat management, providing significant ROI. Tines is cost-effective with efficient automation, offering high ROI for teams focusing on operational savings.
Since we started working with Torq, I am handling much fewer alerts. It is becoming really easy for me to handle an alert.
We have seen a return on investment, targeting a $600,000 ROI for the year.
By the time we officially bought Torq, we already had two workflows that were very helpful to us.
We have reduced manual analyst effort by thirty to forty percent.
This trust has led to an increase in sales because customers are confident we can protect their data.
I can speak for fewer employees needed because we used to require many analysts to deal with all the alerts that we were generating, but now we have about 90 to 95% of the alerts already automated through Tines, which requires tremendous time saved and a ton of reduction in the number of analysts required.
In some domains, we were in a position to actually let go of people, meaning at least two people have been reduced from one team, which saves a lot of cost for the organization.
We did not see proper value in it, whereas other platforms would have given much higher value for us.
My impression of their technical support during the initial setup was that they were helpful, responded within a reasonable timeframe, and provided exactly what we needed.
The speed and quality of their answers have been pretty good, as I usually get a response within 24 hours, and they follow up well.
We can always get an answer, and the support team are experts in their own system.
They have been responsive, knowledgeable, and helpful.
I just like their customer support because, within a short period of contacting them, they are able to help navigate issues.
Whenever we hit roadblocks or issues with the platform or story, even if it was our mistake, the people from the most senior engineering team of Tines immediately were willing to get on call with us.
I would rate the customer support a ten on a scale of one to ten.
The support and engineering team is quick to resolve bugs and respond promptly.
Our case management is super scalable.
In terms of scalability, you can do as long as you can build it, and they can support it.
Regarding the ability of the solution to grow in your work environment, if it is scalable, if it fits your business requirements, and if there is room to scale up, the answer is yes, for sure.
ThreatConnect supports scalability by allowing us to identify threats and share information within our team networks.
It is built for growing teams and has more complex automation capacity.
Whenever this became insufficient, we could easily reach out to the Tines team where they immediately gave us a remedy or fixed the issue.
From the workloads we have, it can scale for different workflows and add more workflows.
We have been using Torq for one and a half years, but we have experienced no downtime.
Most of the time, the system is stable as long as the components that they integrate with are stable.
I have never faced any downtime or issues.
Sometimes, when using the solution, it slows down, affecting our ability to mitigate threats.
The tool is stable up to ninety-nine point nine percent.
Tines is very stable.
Torq should offer default templates that can directly scan firewall data and automate actions.
The AI value depends on maturity. Real value depends heavily on telemetry, integration depth, and workflow design, all of which rely on how mature customers are in their SOC department.
It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet.
The pricing is high for smaller organizations, so it would be beneficial to have tiered pricing.
ThreatConnect Threat Intelligence Platform (TIP) could be improved by simplifying the user interface to better fit day-to-day analyst workflow.
Reporting and dashboards could be more advanced for deeper analysis.
The issue with the Implode action is that once we get a certain number of events into the Implode action, we lose context of all the events except the last one that came in, so it is a bit difficult to send data back once it goes through the Implode action.
I think they need to add more intelligence to the workflow layer because, depending upon what they have right now, it could be possible for Claude or Copilot or ChatGPT to have that feature quickly.
When they bring more and more value into the platform, it makes more sense to pay that price, but still, it is expensive.
Before deciding to implement Torq, I considered that compared to our old case management platform, Torq was a much better price and had a lot better value for what you get out of the platform, which was a key consideration for the company.
It is an expensive solution, not an inexpensive solution, but we get through the flexibility.
The pricing seems a bit high for smaller companies.
Generally, the pricing and setup cost are on the higher side.
Tines required no setup cost since we just used their cloud tier and built everything with internal engineering resources.
My experience with pricing, setup cost, and licensing is very good.
I did not handle the purchasing side, so I did not actually know the exact pricing or the licensing details.
Torq's unified platform approach to AI SOC automation and case management has significantly benefited us by integrating the case management platform with the automation, which saves time compared to managing multiple point solutions across our security stack.
The fact that I can build whatever I want within my own imagination and skills without relying on code is the best thing about Torq.
You can copy and paste a cURL command. If you have documentation or APIs, you usually have an example on the side. You basically have all the information on how the API call should be. You can just copy that and paste it into a step, and it will just build the step for you.
The features are simple to use, and the interface is user-friendly, making it easy to navigate and apply the solutions.
The API-first architecture that enables us to perform custom integration with other products and real-time distribution.
It helps in streamlining our security operations effectively and efficiently without requiring coding knowledge.
What stands out mostly about Tines's features is the integrations. It connects easily with tools such as Slack, emails, and spreadsheets, and it makes data moves automatically without much work.
Tines caught the failure and queued them automatically. We did not lose a single student log.
| Product | Mindshare (%) |
|---|---|
| Torq | 3.8% |
| Tines | 4.5% |
| ThreatConnect Threat Intelligence Platform (TIP) | 3.2% |
| Other | 88.5% |


| Company Size | Count |
|---|---|
| Small Business | 2 |
| Midsize Enterprise | 5 |
| Large Enterprise | 5 |
| Company Size | Count |
|---|---|
| Small Business | 8 |
| Midsize Enterprise | 23 |
| Large Enterprise | 5 |
| Company Size | Count |
|---|---|
| Small Business | 2 |
| Midsize Enterprise | 1 |
| Large Enterprise | 4 |
Torq is the enterprise AI SOC solution that effectively combines adaptive insights and automation to handle critical threats efficiently. It manages threat lifecycles, swiftly moving from triage to response, ensuring effective risk management.
Torq is designed to streamline security operations by aggregating telemetry across your security stack. It investigates significant risks and manages threats from triage to containment and remediation. This AI-driven tool enhances the capabilities of your SecOps team, allowing them to achieve more impactful results without introducing complicated processes.
What are the key features of Torq?In industries like finance and healthcare, Torq shows effectiveness by adapting to specific risk scenarios often encountered in these fields. Its integration with existing infrastructures makes it a valuable asset for maintaining stringent security standards, essential for protecting critical data and operations in diverse high-stakes environments.
ThreatConnect Threat Intelligence Platform provides a comprehensive solution for operational threat intelligence. It effectively ingests and enriches data, aligning with intelligence requirements for seamless application across security operations.
ThreatConnect TIP stands out by integrating threat intelligence with orchestration for streamlined threat management. It simplifies the user experience with a customizable interface assisting security teams in operationalizing insights across multiple teams without disruption. The platform automates threat scoring and optimizes threat correlation and response, ensuring timely threat detection and protection. Collaboration with Polarity and Risk Quantifier accelerates actionable intelligence, while support and patch management enhance overall user experience. Although improvements in integration processes and training accessibility are necessary, the platform aggregates threat data for efficient threat mitigation.
What are the key features of ThreatConnect TIP?In industries focusing on security, ThreatConnect TIP supports teams in identifying and mitigating security threats through automation. Integrated with cybersecurity networks, it assists in endpoint protection, SOC management, and vulnerability management, being pivotal in threat investigation and intelligence dissemination.
Tines offers no-code and low-code automation for users to automate tasks without coding expertise, integrating seamlessly with APIs to enhance incident management and security operations.
Known for a vendor-neutral approach, Tines provides detailed documentation and live chat support, allowing for effective integration with other tools, scheduling capabilities, and streamlined processes that save time and effort. Users find it intuitive for efficient task handling, making manual intervention unnecessary. Challenges include the need for more comprehensive documentation and instructional videos, as well as improvements in AI integration and reporting aesthetics. Pricing is also noted as higher compared to alternatives.
What are the most important features of Tines?Tines primarily serves organizations in the security sector, automating security operations such as alert detection and managed detection and response. It's utilized extensively in security operation centers for tasks like phishing email processing, ticket creation, IOC investigations, and ticket assignments within enterprise security frameworks, with multiple teams delivering Tines services to enhance task handling efficiency.
We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.