Torq SOC Brain

Torq SOC Brain is a learning layer inside the Torq AI SOC Platform that trains dedicated models on a security team's own closed investigations, analyst verdicts and corrections, so triage decisions reflect how that specific SOC judges risk. It targets security operations leaders drowning in alerts who want autonomous triage that improves with use rather than a static playbook.

Torq SOC Brain, announced July 28, 2026, is a new layer of the Torq AI SOC Platform that makes autonomous investigation learn from an organisation's own history instead of a generic model. It has three named parts. Torq Recall retrieves relevant historical cases using deterministic matching on security observables — IPs, file hashes, URLs, hostnames — ranks them by relevance, reads the analyst notes attached to them, identifies conflicting precedent and adjusts its confidence accordingly, with no manual tagging required. Torq Reflex continuously trains dedicated models on confirmed verdicts and analyst corrections, learning how a particular SOC weighs risk; Torq reports it matches analyst-corrected verdicts 85% of the time immediately, auto-closing the confident cases and escalating the rest. Torq Retrospect imports resolved incidents from tools the team already runs, so the system starts with years of institutional knowledge rather than earning it over months. CEO Ofer Smadari frames the distinction bluntly: most vendors claiming self-learning ship retrieval-augmented memory that hands old cases to an LLM at decision time, whereas SOC Brain trains on the customer's operational data to reach new conclusions from it. Each customer gets a private SOC Brain; Torq states it never pools customer data, shares model parameters or trains one customer's models on another's incidents, and describes that isolation as architectural rather than a setting. It sits on the wider Torq platform — Auto Triage, Case Management, HyperAgents, the Socrates agentic assistant and roughly 300 prebuilt integrations with 4,000+ steps. Torq, founded 2020, raised a $140M Series D in January 2026 at a $1.2B valuation, bringing total funding to $332M.

Category

Governance & Security

Pricing

Contact for pricing, Subscription

Target Market

CISOs, SOC Managers, Security Engineers, CIOs, MSSPs

Deployment

Cloud-only

Founded

2020

Team Size

201-500

• ✓
  Torq Recall

  Deterministic matching on observables such as IPs, hashes, URLs and hostnames surfaces relevant past cases, ranks them and weighs conflicting precedent without manual tagging.

• ✓
  Torq Reflex

  Trains dedicated per-customer models on confirmed verdicts and analyst corrections, reported to match analyst-corrected verdicts 85% of the time immediately.

• ✓
  Torq Retrospect

  Imports resolved incidents from existing security tools before go-live so the system reasons from years of organisational history on day one.

• ✓
  Per-customer model isolation

  Each tenant gets a private SOC Brain; Torq states it never pools data, shares parameters or trains one customer's model on another's incidents.

• ✓
  Agentic SOC platform underneath

  Auto Triage, Case Management, HyperAgents and the Socrates assistant cover triage, investigation, response, threat hunting and reporting end to end.

• ✓
  Broad integration surface

  Around 300 prebuilt integrations and 4,000+ steps across EDR, SIEM, identity, cloud, email and SaaS security tools reduce custom connector work.

• ✓
  Enterprise compliance posture

  SOC 2 Type II, HIPAA with BAAs available, GDPR with a DPA, BSI C5:2020, plus SSO via Okta, Entra ID, Ping, OneLogin, Google and Duo.

• •
  Recurring false-positive suppression

  Alerts matching observables from previously dismissed cases are auto-closed with reference to the earlier analyst decision, removing repetitive tier-1 work.

• •
  Cold-start triage for a new deployment

  Retrospect ingests historical resolved incidents so autonomous triage is useful from week one rather than after months of accumulated verdicts.

• •
  Encoding analyst judgement before attrition

  Reflex captures how senior analysts weigh risk, preserving institutional knowledge that would otherwise leave with departing staff.

• •
  Phishing and identity alert investigation

  Native connectors to Okta, Entra ID, Proofpoint and major EDR tools let agents gather evidence and reach a verdict without analyst pivoting.

• •
  Reducing analyst hours on high-volume queues

  Torq cites a Valvoline deployment saving roughly seven analyst hours daily through automated handling of routine security cases.

Torq publishes no list pricing — there is no public rate card page, and every deal is quoted by sales. SOC Brain is a layer of the AI SOC Platform rather than a separately priced SKU, so it arrives as part of a platform subscription rather than as an add-on line item. Third-party writeups describe subscription tiers scaled by workflows, integrations and automation actions, which means execution volume is the variable to model: a high-alert-volume SOC should get per-execution assumptions in writing before signing, since that is where cost scales rather than seats.

This page was written from 7 sources, 4 on domains other than torq.io.

1. 1.torq.io — soc brainvendor
2. 2.torq.io — ai soc platformvendor
3. 3.torq.io — security compliancevendor
4. 4.siliconangle.com — torq unveils soc brain self learning layer ai soc platform
5. 5.helpnetsecurity.com — torq soc brain
6. 6.peerspot.com — torq reviews
7. 7.siliconangle.com — torq raises 140m 1 2b valuation scale ai driven security hyp