Contact Us
A Founding Member of the Agentic SOC Alliance
The Agentic SOC Alliance is an independent industry coalition defining an open reference architecture for AI-driven security operations. Founded in 2026, Dr. Edward Amoroso, CEO of TAG Infosphere and NYU Research Professor, coordinates CISO-led working groups developing the frameworks, principles and practical guidance to move agentic SOC pilots into enterprise production.
AGENTIC SOC ALLIANCE MEMBERS
Solving the SOC’s Biggest Problem
AI-Speed Attackers, Human-Speed Operations
AI-powered adversaries find a vulnerability, weaponize it, and move laterally in minutes.
Security teams are deploying autonomous defenses of their own, but early AI tools aren't delivering: most flood analysts with false positives, send investigations down the wrong path, and let real threats slip through the noise.
To close that gap, the Agentic SOC Alliance is building the framework security teams need to adopt AI in the SOC
with confidence
Agentic SOC Outcomes for Security Teams
- Fewer false positives
- Defensible investigations
- Machine-speed response
- More strategy, less triage
- AI economics that scale
- No model lock-in
The SOC Needs a New Operating Model
Read ExtraHop CEO Greg Clark’s full perspective on rebuilding the SOC for the agentic
...Our target state is machine speed detection, containment, response, and recovery. Our traditional SIEM model, while necessary, will not be able to keep up. Agentic assisted SOC is the only answer in our opinion.
Jason Dewez
CISO
Building the Operating Model
AI-Powered Security Operations
The Agentic SOC Alliance defines a three-layer operating model for autonomous security operations: Context, harness, and model.
Context
The foundation
Everything downstream depends on it. Context is a continuously updated operational knowledge graph of every device, identity, workload, connection, and behavior, assembled in real time and semantically rich enough for agents to reason over directly.
Harness
The control layer
Harness is the runtime that governs how agents operate, orchestrating workflows, tools, state, and memory with guardrails, permissions, human approval routing, and a complete audit trail throughout.
Model
The reasoning layer
Specialized, multi-model AI performs triage, investigation, and response; interchangeable by design, each new generation of models can be adopted without re-architecting anything.
“The shift to autonomous security operations is happening now, and enterprises need an architecture they can trust as agents begin taking actions with significant consequences. The winning architecture will be open, governed and designed for a world where the agents, models and security technologies continue to evolve.”
Dr. Edward G. Amoroso
CEO, TAG Infosphere, and Coordinator, Agentic SOC Alliance