Black Hat 2026: AI SOC with a Brain, Tattoos, and Hot Dogs

Torq rolled into Black Hat 2026 with a 20-foot inflatable skeleton, free tattoos, hot dogs, the Wizard of Oz, and a live news desk. That’s a lot of conversation starters right there. 

But the real talking point was Torq’s AI SOC demo: in-production AI SOC capabilities that reason with organizational context, learn from analyst decisions, get smarter with every case the platform handles, and take action across the full threat lifecycle.

Here’s what really happened in Vegas.

Pre-Show Buzz: Torq SOC Brain™ and a SACR AI SOC Innovator

Days before Black Hat, Torq unveiled Torq SOC Brain™, the self-learning layer of the Torq AI SOC Platform. The SOC Brain brings together Recall, Reflex, and Retrospect to help Torq reason from past cases, learn from analyst decisions, and apply that judgment to future triage and investigations.

The launch drew coverage from SiliconANGLE, Channel Insider, MSSP Alert, and more.

“The end goal is to shift as much as possible of a cognitive load required to investigate incoming security alerts.”

Leonid Belkind, Torq CTO and Co-Founder in Channel Insider

Torq also entered Black Hat with fresh analyst recognition: Software Analyst Cyber Research named Torq a leading Innovator in its AI SOC Market Report, as an “as an AI SOC operating layer that can ingest alerts, classify triage outcomes, construct cases, assign work to Socrates, and route remediation through deterministic or agentic workflows depending on the use case.”

Then we took it to Vegas.

The AI SOC Demo

Torq’s demo stations stayed busy as attendees saw hands-on how Torq moves from alerts through investigation and response with context and agentic reasoning built in. Here’s what landed most:

• Torq Context Graph drew a strong reaction. It’s a live model of your environment (identities, assets, policies, and the reasoning behind past decisions) so every verdict is grounded in the full picture, not a single alert in isolation. The blast-radius and pivot-point views hit hardest, showing how far one compromised identity could reach and why organizational context changes what an alert actually means.
• Torq Auto Triage classifies every alert as false positive, benign, or malicious with explainable reasoning, turning real threats into cases automatically and cutting noise before an analyst engages. The most common question was what it weighs to reach a call, and showing that reasoning is the difference between a black box and a platform a SOC will trust to act.
• Recall and Reflex were where the conversation moved past triage. Recall brings your own case history to every new alert, and Reflex learns your team’s judgment, so the platform gets more accurate the longer it runs instead of resetting to zero each shift.
• Torq Socrates lets teams prompt workflows. Describe the outcome you want in plain language, and Socrates plans, builds, and orchestrates the automation across your stack, deciding what runs agentically versus deterministically and coordinating the right HyperAgents to carry it out.

On Stage: Context, Memory, and Learning in the AI SOC

John White, Field CISO EMEA, and Rick Bosworth, Sr. Director of Product Marketing, took the stage to go a level deeper on why those capabilities matter. Together, the Context Graph, Recall, and Reflex form the Torq SOC Brain, the layer beneath the agents that lets the platform reason about your environment, remember your decisions, and learn your team’s judgment.

John and Rick kept coming back to two points:

1. First, autonomy is a dial you widen as trust builds, not an all-or-nothing switch.
2. Second, every customer’s SOC Brain stays isolated, so what one team’s platform learns is never shared with another.

They also shared advice on how best to get started with an AI SOC platform: Pick the repeatable Tier 1 work that eats the most analyst time, prove it out, then expand. On timing, they were blunt. Waiting is its own risk when attacks already move at machine speed.

TTVN, Live from Las Vegas

Our Junior Media Intern Trevor has traded in his TorqTV van for a news desk.

Trevor and Tony went live from the TTVN desk with boots-on-the-ground Black Hat coverage of the week’s biggest stories: Skelly, Torq Dogs, real (yes, real, actual, permanent) tattoos and piercings, Channimals in the Wild, AMP’d partner highlights, and an exclusive Wizard of Oz screening at the Sphere, co-hosted by Snyk.

Didn’t Catch Us in Vegas?

The hot dogs were tasty. The tattoos were permanent. But the bigger story was what Torq showed in the booth and on stage: an AI SOC platform that reasons on your environment, remembers your decisions, and learns your team’s judgment across the full threat lifecycle.

Missed the Torq demo at Black Hat, or want a closer look without the show-floor crowd? Watch our live Auto Triage demo webinar.