What is a security context graph? How AI SOC vendors use the term in 2026

An alert on its own rarely settles anything. A sign-in from a new country is benign for a travelling salesperson and serious for a service account. Analysts settle it with context: who owns the account, what is normal for them, and how the team decided similar cases before. A playbook encodes some of that context in advance, as branches. An AI agent needs to look it up at run time. A context graph is the place it looks.

Mate Security puts the problem this way in its February 2026 announcement: AI agents need "more than the 'what'", they need "the 'why': the operational context".

This matters most for teams leaving a SOAR. Years of playbook branches are, in effect, stored context: the exceptions, the known-good service accounts, the hosts that always trip a rule. When playbooks are retired, that knowledge has to live somewhere the agent can reach, or it is lost. A context graph is one answer to where it goes. It is also why the question "what goes in, and who maintains it" belongs in every evaluation, alongside integrations and autonomy controls.

Mate introduced the Security Context Graph on 19 February 2026 and describes it as "a graph of memories, capturing SOC knowledge just like an experienced analyst sees it". On its platform page, Mate lists what the graph holds: memories (with source, confidence and freshness), decision traces, guardrails and architecture, and says it is built within 24 hours of integration. Mate's Gamebooks, introduced on 27 August 2026, use the graph as the shared investigation state and organisational memory.

Torq announced on 18 May 2026 that it had acquired Jit, a Boston-based company, to bring AI context graphs into the Torq AI SOC Platform so that agentic investigations are informed by organisation-specific context. On 27 July 2026 Torq added SOC Brain, a layer with three parts (Recall, Reflex and Retrospect) that learns from past investigations and analyst verdicts. Torq says each customer gets a private model trained only on its own data, and that Retrospect imports resolved incidents from existing tools.

7AI's 27 July 2026 release, which launched 7AI Federated SIEM and 7AI Build, quotes its chief executive saying agents can "reason against how the organization works". Conifers says CognitiveSOC learns the environment and analyst feedback. Each describes a way of giving agents organisational context; none of the descriptions is interchangeable, and the public material does not let us compare them in depth.

• What goes in: asset inventory, identity data, past tickets, analyst notes, chat, documentation? Which of your tools feed it?
• How is it built and kept current, and how does the platform mark information that is stale or low confidence?
• Can your team see and correct what it holds? A wrong memory repeated across investigations is worse than no memory.
• Is it isolated per customer, and is any of it used to train shared models?
• What happens to it when you change a tool, or if you leave the vendor? Can you export it?
• How does it show up in a verdict: does the evidence trail cite which piece of context changed the outcome?

Not directly. Our method scores investigation depth and explainability of verdicts, and context is one input to both. Mate Security scores 9 on investigation depth and 9 on explainability, partly because its public material describes the graph and its decision traces in detail. Public descriptions are not proof of performance: a proof of value on your own alerts is the way to find out whether the context helps.