How FICO and Other Financial Institutions Run an AI SOC with Torq

Financial institutions are some of the hardest environments to secure. They hold the data attackers want most, they run payment rails that a breach can freeze, and they answer to the most overlapping set of regulations in any industry. When one is breached, the damage runs past exposed records into systemic risk and lost customer trust.

The average financial-sector data breach reached $5.56 million in 2025, second only to healthcare and well above the $4.44 million global average. The attacks keep climbing. Nation-state groups tripled their pace against the sector and stole more than $2 billion in crypto over the past year. Over a third of financial services incidents now start with social engineering, and confirmed ransomware in the sector rose about 30% from 2024 to 2025, with the first quarter of 2026 up 76% year-over-year. AI is in the mix now too, showing up in 16% of breaches through automated phishing and deepfake impersonation.

The threat is obvious. Keeping up with it is where the traditional SOC model falls short, and where AI-driven financial services SOC automation earns its place.

Why Financial Services SOCs Are Under Pressure

Most financial institutions run more security tools and get more alerts than any team can work through by hand, and the compliance load only adds to it. Analysts wake up to a flood of alerts, interpret them manually, gather context across disconnected systems, and run response steps one tool at a time. That worked until the volume outpaced the team, which in finance it already has.

Slow response is what makes the gap between alerts and capacity expensive. Across industries in 2025, organizations took an average of 241 days to identify and contain a breach, and the ones that ran past the 200-day mark cost $5.01 million on average versus $3.87 million for those caught sooner. For a bank, the longer an attacker goes undetected, the higher the odds of a frozen payment rail or a fraudulent wire.

Plenty of institutions turned to legacy SOAR to close the gap and found it added work instead of removing it. Playbooks pile up, each one tied to a couple of integrations, and the maintenance load lands on the detection engineering team. The platform ends up recording manual effort rather than reducing it. That’s a big part of why 85% of security leaders now say they want a single, unified platform they can trust. AI-driven financial services SOC automation, done right, is how they get there without adding headcount.

What Torq Does Differently

The Torq AI SOC Platform uses agentic AI and Hyperautomation to run the entire threat lifecycle (triage, investigation, response, and remediation) under your team’s direction, with every decision grounded in context, logged, and reversible. For financial institutions, Torq does three things that matter most.

1. Torq acts across the full lifecycle. Most tools marketed as an “AI SOC” stop at prioritizing an alert and hand the real work back to a human. A true AI SOC carries the alert through to resolution and only escalates to a person when human judgment is needed. In finance, that shortens the time between when an attack starts and when it’s stopped, and it leaves a defensible record of every move.
2. Compliance and auditability are built in. Financial services operate under PCI DSS, SOX, GLBA, FFIEC guidance, and SEC cybersecurity disclosure rules, with the EU’s Digital Operational Resilience Act (DORA) now fully applicable to financial entities and the EU AI Act’s high-risk requirements taking effect in August 2026. Torq builds audit-ready evidence into every agentic action. Torq HyperAgents™ log their full reasoning chain, and native case management keeps a full chain of custody, so daily operations become a running compliance record instead of a pre-audit scramble.
3. It layers onto the stack you already run. With more than 400 integrations across tools like CrowdStrike, Microsoft Sentinel, SentinelOne, ServiceNow, and Wiz, Torq unifies response without a rip-and-replace. Where an integration doesn’t exist, teams prompt the Torq Socrates™ Agentic Builder in natural language to quickly build it.

Together, that lets financial institutions automate their most critical, highest-volume work: fraud and wire-transfer defense, phishing triage and containment, ransomware response, and identity and access management, all with the transparency and control a regulated environment demands.

What It Looks Like in Practice: FICO

FICO, the global analytics and financial services company, shows what happens when a financial institution moves to a real AI SOC. Its 24/7 global SOC had been running on a legacy SOAR where 95% of the work inside its playbooks was still done by hand. The team needed integration depth, automation reach, and a real support partnership, and moved to the Torq AI SOC Platform to get all three.

The migration was scoped at 90 days and delivered in about half that time, with more than 100 playbooks moved and consolidated, many collapsing from 10 steps down to a single automation that produced the same output. Today, FICO’s SOC runs on Torq end-to-end, from autonomous phishing investigation to 24/7 monitoring across teams in North America and Asia, with compliance evidence packaged for every workflow.

The results line up with what most financial institutions are after:

• A 99.4% reduction in MTTR, from more than 150 hours to under an hour in nine months.
• 75% of cases closed by automation, 15 percentage points past FICO’s internal target, with analyst time concentrated on the cases that need human judgment.
• Phishing response from about three days to under 30 minutes, as phishing workflow automation went from 60% to 95%.
• A clean audit record across PCI DSS and country-specific cycles since the migration, with no case where Torq lacked the documentation an auditor asked for.

“When another security leader asks me whether the move from XSOAR to Torq was worth it, I tell them three things. We have the integrations we need, and when we don’t, we build them. We can run our own AI models inside our own workflows. And the support. The Torq team is in our standup every single week.”

– Ernesto Ugalde, Senior Manager of Detection Engineering at FICO

The Takeaway on AI-Driven SOC Automation for Financial Services

Financial institutions everywhere face the same squeeze: machine-speed attacks, rising regulatory pressure, and SOC teams that can’t scale by hiring.

What actually helps is an AI SOC that acts across the full threat lifecycle, works with the stack you already own, and can prove every decision to a regulator or a board. Another point tool or a repackaged SOAR won’t get there. That’s what Torq built, and it’s already running in production across some of the most demanding financial environments.

FICO is one of them, and its results show what that looks like in practice.