New Torq AI SOC Platform layer’s innovative capabilities learn from every security decision and historical incident, drawing conclusions from precedents and team judgments from day zero
New York, NY, July 28, 2026 – Torq, the established agentic security operations leader, today introduced Torq SOC Brain™, a new layer of the Torq AI SOC Platform that continuously learns from historical investigations, analyst decisions, and organization-specific security operations to create a unified, self-learning AI SOC. While most autonomous investigation systems claim to be self-learning, they are, in reality, memory systems—they simply retrieve past cases and pass them to a language model at decision time. Torq SOC Brain is fundamentally different. It reasons from precedent, adapts to how each SOC evaluates risk, and continuously refines its judgment with every completed investigation. The result is an AI SOC that grows more accurate over time—not a thin wrapper around a generic AI model.
Torq SOC Brain demos are available for qualified Black Hat USA 2026 attendees at the Torq booth at the Mandalay Bay Convention Center in Las Vegas, Nevada, August 3-6.
“Every cybersecurity vendor claims their AI is self-learning, but virtually none are,” said Ofer Smadari, CEO and Co-Founder of Torq. “What the majority do is simply pass cases and hand them to an LLM at the point of decision. That’s nothing more than executing based on memory. Self-learning means reaching new conclusions from that history, and that’s much harder to build. With Torq SOC Brain and its Torq Recall, Torq Reflex, and Torq Retrospect capabilities, the Torq AI SOC Platform truly learns how a SOC thinks, even from the years of history that predate a Torq deployment. That’s the difference between automation that treats every investigation as if it were on its own and the industry’s first SOC that actually gets smarter and more accurate with each completed investigation.”
How Torq SOC Brain Learns: Torq Recall, Torq Reflex, and Torq Retrospect
Torq Recall: Learning From Precedent—Torq Recall transforms memory into reasoning. It retrieves relevant historical cases using deterministic matching on security observables such as IPs, file hashes, URLs, and hostnames, ranks them by relevance, and analyzes how past analyst decisions should influence the current verdict. It understands analyst notes, identifies conflicting precedent, and adjusts confidence based on evidence strength. Torq Recall turns tribal knowledge into institutional intelligence without requiring analysts to create tags, rules, or additional workflows.
Torq Reflex: Learning From SOC Team Judgment—Torq Reflex continuously trains dedicated AI models based on a SOC team’s confirmed verdicts and corrections, learning the organization’s unique approach to risk, evidence, and decision-making. Unlike stateless AI triage, Torq Reflex improves over time, matching analyst-corrected verdicts 85% of the time immediately and delivering significant accuracy gains across real customer environments. High-confidence alerts are automated, while uncertain cases are escalated to analysts.
Torq Retrospect: Learning From Organizational History—Torq Retrospect enables Torq SOC Brain to learn from historical security cases before deployment. It imports resolved incidents from existing security tools, making years of organizational knowledge immediately available to Torq Recall and Torq Reflex. The result is an AI SOC that arrives on day one informed by your organization’s past, accelerating accurate decisions from the first alert.
Your SOC Brain. Your Model. Your Data. Your Intelligence.
Every Torq customer gets a private Torq SOC Brain built exclusively for their organization. Their Torq SOC Brain exclusively learns from their analysts, their incidents, their policies, and their history. Torq never pools customer data, shares model parameters, or trains one customer’s AI on another customer’s experience. Their security expertise remains their competitive advantage.
This secure isolation is built into Torq architecture—not enabled through a configuration setting. Every Torq SOC Brain continuously evolves around each organization’s unique risk tolerance, operational practices, and analyst judgment while remaining completely private and under their control.
Designed for enterprise trust from day one, the Torq SOC Brain drives explainable decisions, confidence-based automation with human oversight, and fully auditable outcomes. Its architecture aligns with the transparency, governance, and human-control principles security leaders demand while supporting emerging regulatory requirements, including the EU AI Act.
“The difference with Torq SOC Brain is that it doesn’t just automate a customer’s SOC—it continuously learns how that organization operates,” said Smadari. “It understands analysts’ decisions, incorporates years of historical investigations, and becomes increasingly aligned with each organization’s unique approach to risk. That means fewer repetitive reviews, more consistent decisions, and greater confidence that the AI is making decisions the same way their security team would. Just as importantly, all of that learning stays within the customer’s environment. Their data, their judgment, and their operational expertise remain exclusively theirs while the platform continues to get smarter every day. That’s what a truly self-learning AI SOC looks like.”
About Torq
Torq is transforming cybersecurity with the Torq AI SOC Platform. Torq empowers enterprises to instantly and precisely triage, investigate, and respond to security events at scale. Torq’s customer base includes major multinational enterprise customers, including Check Point Security, Chipotle Mexican Grill, Inditex (Zara, Bershka, and Pull & Bear), Informatica, Kyocera, Lego, Procter & Gamble, Prudential, Siemens, Telefónica, Uber, Valvoline, Virgin Atlantic, and Wiz.
