AI SOC vendor moves in 2026, sorted by the model they change

Why sort news by model?

Product news is usually read vendor by vendor. For a team choosing an operating model, the more useful question is which way each announcement pushes: toward agents doing more of the queue, toward deterministic automation, toward a provider's people, or toward helping analysts who stay in charge. This post sorts the dated announcements we collected from the profiled vendors' own pages. It covers January to August 2026; nothing here is newer than our read date of 27 September 2026.

Which announcements push toward agents that learn your environment?

• 19 February: Mate Security introduced the Security Context Graph, which it describes as "a graph of memories, capturing SOC knowledge just like an experienced analyst sees it".
• 18 March: Conifers added visible reasoning on verdicts, an interactive Ask Conifers mode and governed AI operations, and described CognitiveSOC as a layer above existing SIEM, SOAR and XDR.
• 18 May: Torq announced the acquisition of Jit. The amount was not disclosed in Torq's release.
• 27 July: Torq added SOC Brain, with three parts (Recall, Reflex and Retrospect) that learn from past investigations and analyst verdicts. Torq says each customer gets a private model trained only on its own data.

The pattern is clear: several vendors now sell learning from your own team's decisions as the core of the product. For buyers, that raises the exit question covered in the primer: what of that learned context can leave with you.

Which push the agent beyond triage?

• 25 May: Conifers described an end-to-end agentic SOC covering threat intelligence, hunting, detection engineering, investigation and remediation within set limits, with 60+ integrations and 2–4 hour onboarding in that release.
• 27 July: 7AI launched Federated SIEM and 7AI Build, which lets customers and partners create their own agentic workflows and skills. Both were announced at Black Hat USA 2026. 7AI states its Federated SIEM brings security data into the platform so it can be searched and correlated across sources.
• 29 July: Dropzone AI made its AI Threat Hunter generally available, with 270+ prebuilt hunt packs mapped to MITRE ATT&CK across Splunk, Microsoft Sentinel, CrowdStrike NG-SIEM, Elastic and Panther.
• 30 July: Prophet Security launched an AI Detection Engineer that builds an ATT&CK coverage map from a team's own detections and writes, tunes and backtests rules for SIEMs including Splunk, Sumo Logic and Microsoft Sentinel.

In work strip terms, these move the "Tune" stage from your analysts toward software, with people reviewing.

Which push toward deterministic automation?

• 18 March: Torq launched Agentic Builder, which turns a natural-language description into a tested agent or workflow.
• 27 August: Mate Security introduced Gamebooks as an alternative to SOAR playbooks, described as "deterministic about intent, dynamic about execution". Mate says one customer moved 711 playbooks into 10 Gamebooks; that is Mate's figure.

Both keep a deterministic layer inside an agent product, which is a signal that vendors expect buyers to want fixed, auditable steps alongside agents.

Which were about money and buying?

• 5 January: Mate Security joined the 2026 CrowdStrike, AWS and NVIDIA startup accelerator, which ran to 3 March.
• 12 January: Torq raised a $140M Series D at a $1.2B valuation, led by Merlin Ventures.
• 15 January: Mate Security became available on AWS Marketplace; Mate says purchases there can count toward AWS commitments. The same day, Dropzone AI reported a $37M Series B led by Theory Ventures in its review of 2025.
• 30 July: Mate Security announced its Series A; its newsroom lists the round as $35M.
• 3 June: Dropzone AI co-founded the AI Proving Grounds Consortium with Corelight, SCYTHE, SimSpace and Sondera, to test AI defenses and agentic workflows before production.
• 8 July: Conifers opened a Singapore data region with in-country inference and processing.

What moved toward MDR or copilots?

Little, in our source set. The managed options in our profiles, Prophet Security's Watchtower and 7AI's PLAID ELITE, did not come with a dated announcement in the sources we read. Outside the vendors, NIST released on 18 August an initial public draft of SP 1353, a quick-start guide on using AI to analyse and report on Cybersecurity Framework 2.0 outcomes, with comments due 15 October 2026. A separate dispatch covers it.

What should a buyer take from this?

If your choice is between models, the 2026 news mostly strengthens the agent side and blurs its edges with SOAR. It does not make an agent product a substitute for people at night. Read each vendor's profile for the stage it actually carries.