AI SOC news recap: what vendors announced from January to August 2026

It groups the dated items on our news page, all taken from vendor newsrooms, vendor blogs and NIST, published between 12 January and 27 August 2026. We summarise what each announcement says; we have not tested the products described. Where a figure is the vendor's own, we say so.

Context was the most common theme. On 19 February, Mate Security introduced its Security Context Graph, which it describes as "a graph of memories, capturing SOC knowledge just like an experienced analyst sees it". On 18 May, Torq announced it had acquired Jit to bring AI context graphs into the Torq AI SOC Platform; Torq's release did not disclose the deal amount. On 27 July, Torq added SOC Brain, with three parts (Recall, Reflex and Retrospect) that learn from past investigations and analyst verdicts. Torq says each customer gets a private model trained only on its own data.

Our note What is a security context graph? compares how these vendors use the term.

• 18 March: Torq launched Agentic Builder, which turns a natural-language description into a tested agent or workflow, with testing against real data and monitoring in production.
• 25 May: Conifers extended CognitiveSOC into what it calls an end-to-end agentic SOC, adding threat intelligence, threat hunting, detection engineering, investigation and remediation within set limits.
• 27 July: 7AI launched Federated SIEM, which queries data where it already lives, and 7AI Build, which lets customers and partners create their own agentic workflows and skills. Both were announced at Black Hat USA 2026.
• 29 July: Dropzone AI made its AI Threat Hunter generally available. It runs hypothesis-driven hunts from 270+ prebuilt hunt packs mapped to MITRE ATT&CK.
• 30 July: Prophet Security launched an AI Detection Engineer that builds an ATT&CK coverage map from a team's own detections and investigations, then writes, tunes and backtests rules. It is available to Prophet AI SOC Analyst customers.

On 27 August, Mate Security introduced Gamebooks, which it describes as "deterministic about intent, dynamic about execution", built from an orchestrator, Gamebooks, capabilities, the Security Context Graph and flows. Mate says one customer moved 711 playbooks into 10 Gamebooks; that is Mate's own figure. Mate's platform page says it translates SOAR playbooks into Gamebooks, which is the main reason for its transition-effort score of 9 in our method.

• 18 March: Conifers added transparent investigations with visible reasoning on verdicts, an interactive "Ask Conifers" mode and governed AI operations. Conifers describes CognitiveSOC as a layer above existing SIEM, SOAR and XDR.
• 3 June: Corelight, Dropzone AI, SCYTHE, SimSpace and Sondera launched the AI Proving Grounds Consortium to test and validate AI defences and agentic workflows in realistic environments before production.

On 8 July, Conifers opened a Singapore data region alongside North America and Europe, on Azure-native infrastructure with inference and data processing in-country. For teams in Asia-Pacific that need local processing, that can change a shortlist. Our deployment lesson covers the questions to ask.

• 5 January: Mate Security joined the 2026 CrowdStrike, AWS and NVIDIA cybersecurity startup accelerator, an eight-week programme that ran to 3 March, with a Demo Day on 24 March in San Francisco.
• 12 January: Torq raised a $140M Series D at a $1.2B valuation, led by Merlin Ventures.
• 15 January: Mate Security became available on AWS Marketplace; Mate says purchases there can count toward AWS commitments.
• 15 January: Dropzone AI's year-end release reported a $37 million Series B led by Theory Ventures.
• 30 July: Mate Security announced it had completed its Series A. Mate's newsroom lists the round as $35M, citing Axios on 28 July; Mate's post says Insight Partners and Team8 continued as investors and Canaan Partners and M12 joined.

On 18 August, NIST released the initial public draft of SP 1353, a quick-start guide with AI prompts and use cases for analysing and reporting on Cybersecurity Framework 2.0 outcomes. Comments are due on 15 October 2026. Our lesson on ATT&CK, D3FEND and NIST explains where it fits.

Three things. First, ask every vendor what its agents learn from, where that learning is stored and whether it is isolated to your organisation, because most of the year's launches touch it. Second, expect separate agents for hunting and detection engineering, and ask whether they are priced separately (see AI SOC pricing in 2026). Third, treat an announcement date as the start of the availability question, not the answer: check what is generally available today.