Most autonomous SOC vendors describe "self-learning" the same way. Pull up cases that resemble the one in front of you, hand them to an LLM, and let it summarize what happened last time. That's retrieval dressed up as intelligence. It's useful, but it's not judgment.
Torq is drawing a sharper line with SOC Brain, a new layer of its AI SOC Platform launching at Black Hat USA 2026. Rather than fetching precedent and stopping there, the system is built to reason from it — building a case for what a specific customer's SOC would actually decide, based on how that SOC has decided before.
"Every cybersecurity vendor claims their AI is self-learning, but virtually none are," said Ofer Smadari, CEO and co-founder of Torq. "What the majority do is simply pass cases and hand them to an LLM at the point of decision. That's nothing more than executing based on memory. Self-learning means reaching new conclusions from that history, and that's much harder to build."
Three capabilities, one idea
SOC Brain breaks into three pieces, each solving a different part of the same problem: how do you get an AI system to make calls a human analyst would trust, without waiting years for it to learn an environment the slow way?
Torq Recall handles the deterministic side. It retrieves relevant historical cases using matching on security observables — IPs, file hashes, URLs, hostnames — then ranks them by relevance and analyzes how past analyst decisions should shape the current verdict. It reads analyst notes, flags conflicting precedent, and adjusts its confidence based on how strong the evidence actually is.
Torq Reflex is where the reasoning compounds. It continuously trains a dedicated AI model on a SOC team's confirmed verdicts and corrections, learning that organization's specific approach to risk and evidence. Torq says it matches analyst-corrected verdicts 85% of the time immediately, with accuracy improving from there. High-confidence alerts get automated; uncertain ones still go to a human.
Torq Retrospect solves the cold-start problem that trips up most of these systems. It imports resolved incidents from a customer's existing security tools before deployment, so SOC Brain isn't learning an organization's judgment in real time on live alerts. Years of institutional history become available to Recall and Reflex from day one.
Private by architecture, not by setting
Every customer gets their own SOC Brain, trained exclusively on their analysts, their incidents, their policies, their history. Torq says it never pools customer data or trains one organization's model on another's experience — and that this isolation is built into the architecture rather than toggled on through configuration.
"With Torq SOC Brain and its Torq Recall, Torq Reflex, and Torq Retrospect capabilities, the Torq AI SOC Platform truly learns how a SOC thinks, even from the years of history that predate a Torq deployment," Smadari said. "That's the difference between automation that treats every investigation as if it were on its own and the industry's first SOC that actually gets smarter and more accurate with each completed investigation."
Torq is also positioning SOC Brain around auditability and oversight rather than pure autonomy — explainable decisions, confidence-based automation with a human still in the loop, and outcomes built to hold up against regulatory scrutiny like the EU AI Act.
The question worth asking every vendor
The bigger claim underneath all three capabilities is that an autonomous SOC shouldn't behave like a generic model with a search index bolted on. It should behave as it has actually worked at your company. Recall confirms the facts. Reflex learns the judgment. Retrospect makes sure that judgment doesn't start from zero.
For security teams evaluating autonomous SOC platforms, that's the distinction worth pressing on: is the system retrieving cases, or reasoning from them the way your own analysts would? Those are very different products that can sound identical in a demo.
Torq SOC Brain demos will be available to qualified attendees at the Torq booth at Mandalay Bay Convention Center during Black Hat USA, August 3–6.