Contents
Get a Personalized Demo
See how Torq harnesses AI in your SOC to investigate, prioritize, and respond to threats faster.
Chris Kissel, Vice President of IDC Security & Trust, just drew a line in the sand for the AI SOC category with one simple sentence:
“Vendors that can show their agents reason transparently, act within defined guardrails, and improve with each investigation will define this category. The rest will be measured against them.”
We couldn’t agree more. That is the new bar for any AI SOC vendor to meet, and it is the bar that Torq has been building on top of since before anyone called the AI SOC a category:
Transparent reasoning. Agentic action. Defined guardrails. Continuous learning.
Building a platform based on these four essential pillars has already earned Torq leadership recognition in the AI SOC market. In April 2026, Torq was named a leader in all four categories in the KuppingerCole Analysts Leadership Compass for the Emerging AI SOC. In the May 2026 Gartner® report, AI Vendor Race: Torq Is the Company to Beat in AI SOC Agents for Threat Investigation, Gartner named Torq the Company to Beat, then doubled down with a report update in August 2026. And in July 2026, Software Analyst Cyber Research (SACR) named Torq a Leading Innovator in its 2026 AI SOC Market Report.
Most recently, in the IDC MarketScape: Worldwide Standalone AI SOC Platforms 2026 Vendor Assessment (Doc #US54127026), Torq was named a Leader.
This IDC MarketScape study assesses vendors offering standalone AI security operations center (SOC) platforms that meet the inclusion criteria of this study, scored against strategy and capability criteria built from vendor RFI responses, product demonstrations, and customer reference interviews. Let’s break down what the IDC MarketScape team evaluated regarding Torq AI SOC Platform in the report.
Transparent Reasoning an Analyst Can Follow
The IDC MarketScape notes, “Torq delivers its AI SOC Platform as SaaS, built around named modules, Torq Auto Triage, Torq HyperAgents, Torq Socrates, and Torq Case Management, that together handle ingestion, normalization, triage, enrichment, verdict, and response rather than centering on a dedicated detection data lake.”
Alerts come in and are normalized to the Open Cybersecurity Schema Framework (OCSF). An alert-family classifier routes each alert to either a specialist pipeline for known types, such as EDR, phishing, identity, cloud, network, etc., or a generalist semantic chain-of-thought pipeline for anything that doesn’t fit a known category for the organization. Then, entity, IOC, and business-context enrichment run in parallel before a dual-verdict mechanism, Torq Reflex and Torq Recall, helps inform a final verdict.
Policy-based routing dismisses false positives and creates comprehensive security cases, mapped to the MITRE ATT&CK® framework, for true positives. Every agentic decision is recorded and logged, viewable in real time, and audit-ready for analyst confirmation or correction.
Each stage of this verdict pipeline is inspectable, giving analysts a traceable path from raw alert to conclusion, rather than an opaque black-box scoring system, on any given alert. According to the report, “Rather than a single black-box model, verdicts move through a structured, multistage pipeline: ingestion and OCSF normalization, alert-family classification into either a specialist pipeline for known types, EDR, phishing, identity, cloud, network, or a generalist semantic chain-of-thought pipeline for anything else, parallel entity, IOC, and business-context enrichment, and a dual ML-and-RAG verdict mechanism, Reflex plus Recall, before MITRE ATT&CK mapping and policy-based routing produce a final call. Each stage is inspectable, giving analysts a traceable path from raw alert to conclusion rather than an opaque score, and the same pipeline underlies the storyboard view an analyst sees on any given alert.”
End-to-end Threat Lifecycle Coverage
An AI SOC is a platform that applies agentic reasoning to triage, investigation, and response, compressing multi-console work into a largely automated workflow. Not triage and prioritization alone, but end-to-end SecOps.
“Agentic technologies are compressing detection and response from hours to minutes, and speed is no longer optional.”
– Chris Kissel, Vice President, IDC Security & Trust
Torq’s AI SOC platform handles ingestion, normalization, triage, enrichment, verdict, and response rather than centering on a dedicated detection data lake. Instead of being locked into a single provider, security teams can consolidate autonomous triage, agentic investigation, case management, and response action (both deterministic and agentic) into one system with Torq.
The platform’s central agentic capabilities, Torq SocratesTM and Torq HyperAgents®, handle both autonomous and semi-autonomous response actions in the platform, including incident containment and case closure end-to-end.
Enterprise-Ready, With the Receipts to Prove It
While agentic action is of the utmost importance in battling adversaries that have already begun using AI to discover vulnerabilities and chain exploits, the report makes it clear that agents that act within defined guardrails are equally crucial for enterprise security operations centers.
Most Torq customers build agents and automations through natural-language prompts via the Socrates Agentic Builder, which can generate a new integration in minutes. The Torq Socrates Agentic Builder builds production-grade AI agents, turning human intent into agentic outcomes in minutes.
According to the report, “Customers build automation through visual no-code workflows, natural-language prompts via the Socrates Agentic Builder, full “as code” API and SDK access, or by bringing their own coding or reasoning agent through MCP and A2A protocols, a wider range of extensibility paths than a single-paradigm approach offers. The Agentic Builder can reportedly generate a new integration from vendor documentation in minutes, and the vendor cites hundreds of customer-built long-tail integrations created this way. Custom agent creation, Torq HyperAgents, extends this further with configurable tools, guardrails, and skills.”
Transparent reasoning and this custom configuration are what give security teams the confidence to allow Torq HyperAgents to take action on behalf of their SOC, but for the largest enterprise buyers, it matters even more how the platform runs and who has certified it. Torq’s AI SOC platform runs on a multi-region, multi-availability-zone architecture spanning the U.S., EU, and APAC.
According to the report, “Torq delivers its AI SOC Platform as SaaS, built around named modules, Torq Auto Triage, Torq HyperAgents, Torq Socrates, and Torq Case Management, that together handle ingestion, normalization, triage, enrichment, verdict, and response rather than centering on a dedicated detection data lake. The platform reached general availability March 1, 2026, and runs on a multiregion, multi-availability-zone architecture spanning the U.S., the EU, and APAC, with a track record of 99.99% availability over five-plus years and contractual recovery-time and recovery-point commitments.”
Torq applies safety guardrails not only to individual AI Agents but at the platform level to meet the demands of the individual complexities presented by each Torq customer, spanning some of the largest global enterprises such as Chipotle, Lego, Lowe’s, Macy’s, Marriott, Prudential, Siemens, Uber, Valvoline, and Virgin Atlantic.
The report states the following as a strength for Torq: “Broad, AI-specific compliance posture. Beyond SOC 2 Type II, Torq holds ISO 27001, BSI C5 Type II, CSA STAR, HIPAA, and GDPR coverage, and was an early adopter of ISO/IEC 42001 which is the standard specifically for AI management systems. A named federal partner network, Merlin Cyber, Carahsoft, and BAE Systems, targets FedRAMP Moderate and High, GovRAMP, and DoD IL5 requirements, positioning the platform for regulated and public-sector procurement even while FedRAMP authorization itself remains in process.”
A Platform That Gets Smarter With Every Case
The report noted, “Torq names distinct techniques behind its verdict pipeline rather than describing machine learning generically: per-customer BERT encoder models on dedicated GPUs, a Contrastive-Loss and Weighted-Cross-Entropy-trained classifier, GEPA prompt optimization, and a reinforcement-learning model gym for ongoing calibration.”
This system is powered by the self-learning Torq SOC BrainTM, made up of Retrospect, Recall, and most notably, Reflex. Torq Reflex is the underlying technology responsible for learning a specific team’s judgment from every analyst correction rather than only updating prompts or looking up past cases. This means that when an analyst confirms or corrects a verdict, that judgment becomes part of how the agentic reasoning occurs for that customer, based on that customer’s own encoder model.
As a result, Torq Auto Triage — the agentic engine that applies business context, threat intelligence, and known organizational history to deliver verdicts and suppress noise — matches an analyst’s corrected verdict at least 20% more often than the semantic-search approach more commonly leveraged by vendors in this category.
Your SOC does not think, act, or respond like any other organization’s SOC, and the models making calls in it should not be trained as though they do. The Torq AI SOC Platform is the only AI SOC that is shaped by your analysts’ judgment, informed by your incident history, calibrated to your risk posture, and gets more accurate with every case your team works.
Future-Proofing Your SOC by Design
The IDC MarketScape also includes a challenges section for each vendor profile. Here, the report notes, “Ransomware detection they noted as fully supported, yet the narrative states detection itself is “the primary domain of EDR,” with Torq enriching EDR telemetry with threat intelligence and business context rather than detecting ransomware natively; native DLP and data-anomaly detection is similarly noted as fully supported while the accompanying narrative describes it as dependent on third-party frontier model partnerships (Bedrock, Vertex, Azure AI Foundry, OpenAI, Anthropic) rather than a native engine. Both patterns leave it unclear what native detection signal, if any, the platform contributes absent those integrations.” This is both true and intentional.
Enterprise SOC teams have spent years and a ton of money building out detection systems and a complete security stack. They have gone through cycles of deploying, ripping, and replacing security technologies that target endpoints, email, networks, and the cloud as new best-of-breed solutions emerge from the hundreds of vendors cycling in and out to fill the halls of conferences like Black Hat and RSAC. And most importantly, every enterprise organization has felt the pain of losing a senior analyst to the next chapter of their career, with years of priceless institutional knowledge walking out the door with them.
Torq’s job is not to replace those systems or those humans. Detection does not equal priority or action. Moreover, each detection tool has its own limited worldview of risk: EDR, CNAPP, IAM, etc. Instead, Torq’s value is in taking those signals and finishing the work — across triage, investigation, case management, and response — with agentic velocity to keep up with machine-speed attacks.
At a time when offensive AI is scaling as fast as defensive AI, organizations do not need another solution that generates noise. Instead, they need a platform that is going to ingest, prioritize, and reduce alert overload, false positives, and process limitations. Torq closes that gap and gives analysts the time back they need to focus on critical risk.
Squash the noise. Investigate agentically. Respond quickly. All in a fully controlled fashion, with AI that works with and alongside your team, learns your organization’s standard operating procedures, and future-proofs your security operations.
The Rest Will Be Measured Against Us
In the report, “A consumer products manufacturer’s cybersecurity architect described replacing a costly third-party MSSP and an existing SOAR with Torq, citing roughly $500,000 a year in combined savings, a “council” of models cross-checking severity verdicts, and close to 1,000 AI-generated SIEM tuning recommendations over the past year.” This is what Torq looks like in production.
Kissel is right to say that the urgency around the AI SOC category is no longer theoretical, and the gap between disclosure and exploitation continues to narrow. For organizations evaluating AI SOC platforms, this simply means the buying decision is being narrowed to those vendors whose reasoning you can inspect, with agentic response actions, guardrails you can control, and, most importantly, learning that compounds with every alert.
These are no longer differentiators; they are the entry fee. Torq has been building a platform to meet that standard for years, and we believe being named a Leader in the IDC MarketScape for this category is the confirmation.
