Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

John White is the Field CISO for EMEA at Torq. A respected security executive with more than 20 years of leadership experience, John previously served as CISO at Virgin Atlantic, where he led a multi-year transformation deploying the Torq AI SOC Platform to modernize cyber operations. Prior to that, he built and transformed security functions for global organizations, including ASOS, Liberty Global, AEG Europe, and KPMG.

The average adversary breakout time is now 29 minutes, with the fastest recorded at 27 seconds, according to the CrowdStrike 2026 Global Threat Report. AI is supercharging the adversary playbook, empowering many to move faster across multiple domains. Defenders must match that speed with AI-driven security operations that investigate and respond across every domain, in real time.

Odysseus left Troy with a fleet and reached Ithaca with nothing, having lost every ship to the sea. While the war was won by force, the journey home was won by wits, and ultimately the fleet barely mattered. Most security operations centers are still running their SecOps voyage the way Odysseus ran the war: more tools, more force, more signal. It is the wrong instinct, because the SOC bottleneck was never how much you can see. It is how fast you can decide.

Most agentic triage solutions hand you a verdict and stop right there. Maybe you get an alert ranking, maybe a severity score, maybe some light investigation, but you, as the analyst, still have to do the cleanup manually. There is still a mountain of evidence that needs to be gathered by hand, and a mountain of cases to dig through on your own.

A security operations center is a centralized function that continuously monitors, detects, investigates, and responds to cyber threats across an organization's environment. The global SOC market was valued at USD 42.85 billion in 2024 in one estimate and is projected to reach USD 91.88 billion by 2034, while another estimate places it at USD 52.3 billion in 2025 with a projection of USD 130.2 billion by 2034 (market estimate).

Twenty-two seconds. That’s the median time it now takes for one attacker to hand freshly compromised access to the next team in the chain, the group that drives toward ransomware. In 2022, that hand-off took more than eight hours. In 2025, it took twenty-two seconds. Now consider how the average security operations center (SOC) is structured to respond. An alert fires, lands in a queue, and waits for a Tier 1 analyst to triage it. It escalates to Tier 2 for investigation.

Security teams don't have a shortage of data. They have a shortage of time, repeatability, and senior expertise available at the exact moment an analyst needs it. That's the problem Atlas slash commands are designed to solve. With /hunt, /investigate, and /signal, Atlas turns a simple chat interaction into a guided SecOps workflow grounded in live endpoint state.