Building an AI That Learns Like an Analyst

About this episode

Most AI-driven security tools lean on retrieval-augmented generation: pull relevant precedent, drop it into the context window, let the model reason over it. It works, but it has a cost problem and a consistency problem. The more data you feed a large language model to improve its answer, the more expensive that answer gets — and the more room there is for the model to produce inconsistent results, independent of hallucination.

Torq built its "SOC brain" to get around that tradeoff. On the latest episode of the TechSpective Podcast, I sat down with Torq Co-Founder and CTO Leonid Belkind to talk about how it works. Belkind says he was skeptical of the term when Torq's marketing team first coined it — he's a technologist, not prone to warming up to superlatives — but changed his mind once he mapped out what the system was actually doing. Reflex, recall, and retrospect Belkind frames the problem around cognitive load. Security analysts are buried under a growing volume of alerts as attack surfaces expand, and the goal isn't just automation — it's shifting judgment itself onto the machine, confidently enough to act on it.

System one is instinct: fast, cheap, mostly right, and not something you can trace back to a specific lesson. System two is deliberate: pulling precedent, weighing relevance, reasoning it through. Torq builds both.

The instinctive layer comes from a per-organization encoder model trained on an organization's own alert history — the sources, the entities involved, the actions taken, the outcomes. That model doesn't generate language; it produces a feature vector, a numerical fingerprint of what a given alert resembles. A classifier neural network then places new alerts relative to clusters of confirmed true positives, false positives, and benign activity, producing something close to a gut check.

The deliberate layer works more like memory retrieval: alerts get indexed by attack pattern and technique so the system can pull the most relevant past cases and reason about how closely they match. When the instinct and the recall — plus a third, independent verdict — all agree, confidence to act autonomously goes up. When they diverge, that's the trigger for a closer look. Grading the data that trains it Not every past decision teaches the system the same amount. Torq scores outcomes as bronze, silver, or gold data points, based on how much signal they carry. A confirmed true positive is useful but modest. A verdict that gets overturned on deeper investigation is more valuable. And a reversal that comes with documented evidence explaining why is the most valuable of all.

Training also isn't neutral about the cost of being wrong. Torq uses weighted cross entropy so that missing a real threat is penalized far more heavily than over-flagging a benign one — a deliberate bias toward caution that mirrors how people weigh irreversible risk against wasted effort. The accountability question We also got into where this leaves human expertise. If organizations lean on AI to do more of the judgment work, do people lose the ability to recognize when it's wrong? Belkind's answer: that risk isn't unique to security operations, and it isn't really about the tool. It's about whether the people using it stay curious enough to understand what's happening underneath — the same distinction between someone who can drive an automatic transmission and someone who understands how it shifts.

That shift doesn't change accountability, though. When the data involved is healthcare records, financial information, or critical infrastructure, "we just trusted the AI model with it" isn't an answer anyone accepts after the fact. The tolerance for a wrong guess on a security alert is nothing like the tolerance for a bad restaurant recommendation. What we didn't get to here There's more in the full conversation than fits in a write-up — including why Belkind thinks survivorship bias applies to machine learning the same way it applies to human judgment, how Torq imports an organization's incident history so the system starts learning before day one, and the line he draws between AI built to look intelligent and AI built to actually get better over time.

Listen to the full episode of the TechSpective Podcast, out now.