Torq and Criminal IP Partner to Deliver Decision-Ready Threat Intelligence for Autonomous SOC Operations

Criminal IP, the cyber threat intelligence search engine and attack surface management platform, announced a new partnership and integration with Torq, the established agentic security operations leader. The partnership integrates Criminal IP’s decision-ready threat intelligence with the Torq AI SOC Platform that helps security teams triage, investigate, and respond to threats faster.

Modern SOCs face an overwhelming volume of alerts, often requiring analysts to manually pivot across multiple threat intelligence platforms to determine whether an IP address, domain, or internet-facing asset poses a genuine risk. By integrating Criminal IP with the Torq AI SOC Platform, organizations can automatically enrich indicators with comprehensive threat intelligence and accelerate security operations without leaving their existing workflows.

“Our platform was built to make internet-scale threat intelligence searchable and actionable in real time,” said Byungtak Kang, CEO at Criminal IP. “Partnering with Torq means that intelligence doesn’t just inform a decision, but it executes one. Every IP, domain, and exposed asset Criminal IP analyzes can now drive automated responses the moment it’s identified.”

“Torq partners include some of the most prestigious cybersecurity companies in the world and we are excited to welcome Criminal IP to the fold,” said Eldad Livni, CINO and Co-Founder, Torq. “Criminal IP is an example of an innovative vendor that delivers solutions with maximum impact as we realize the potential of the AI SOC, together. And that means joint offerings that combine cutting edge threat intelligence drawing from the deepest data pools with blazing fast AI-driven response, remediation, and mitigation. Together, Torq and Criminal IP will protect organizations from the ever-expanding spectrum of threats they’re confronted with every second of every day.”

Also Read: CIO Influence Interview with Hugo Dozois-Caouette, CTO and Co-founder at MaintainX

How It Works

When an indicator is delivered, the Torq AI SOC Platform automatically routes the indicator to the appropriate Criminal IP intelligence service and receives a decision-ready verdict and supporting context in real time, whether an IP is malicious, suspicious, or anonymized; whether a domain resolves to a malicious or phishing site; what’s exposed on a scanned asset; and any associated exploits. The Torq AI SOC Platform reasons over that enriched intelligence to determine severity and the appropriate response path.

Key Capabilities

The integration gives the Torq AI SOC Platform direct access to Criminal IP’s full intelligence surface, including:

• IP reputation, malicious activity, and suspicious activity lookups
• VPN, hosting, and privacy threat detection for any IP address
• DNS server safety assessments
• Domain scanning, scan status checks, and full domain intelligence reports
• Asset search across internet-exposed infrastructure
• Service banner search across internet-facing assets
• Exploit search tied to exposed services and known vulnerabilities
• Full and summarized IP and domain reports for deep investigation

Use Cases

• Automated indicator enrichment: Every incoming IP, domain, or asset is scored and contextualized with Criminal IP intelligence before it ever reaches an analyst.
• Threat-informed response: Confirmed-malicious indicators trigger automated blocking and containment across the security stack.
• Attack surface investigation: Analysts open cases pre-populated with exposure, banner, and exploit context for every asset in scope.