Sign In
The Agentic SOC Alliance
The Agentic SOC Alliance is an industry coalition defining the open operating model for autonomous security operations. Founded in 2026, the Alliance establishes the requirements, best practices, and implementation blueprints that make agentic security operations fast, accurate, and governable.
AGENTIC SOC ALLIANCE MEMBERS
Solving the SOC’s Biggest Problem
AI-Speed Attackers, Human-Speed Operations
AI-powered adversaries find a vulnerability, weaponize it, and move laterally in minutes.
Security teams are deploying autonomous defenses of their own, but early AI tools aren't delivering: most flood analysts with false positives, send investigations down the wrong path, and let real threats slip through the noise."
To close that gap, the Agentic SOC Alliance is building the framework security teams need to adopt AI in the SOC
with confidence
Agentic SOC Outcomes for Security Teams
- Fewer false positives
- Defensible investigations
- Machine-speed response
- More strategy, less triage
- AI economics that scale
- No model lock-in
...Our target state is machine speed detection, containment, response, and recovery. Our traditional SIEM model, while necessary, will not be able to keep up. Agentic assisted SOC is the only answer in our opinion.
Jason Dewez
CISO
Building the Operating Model
AI-Powered Security Operations
The Agentic SOC Alliance defines a three-layer operating model for autonomous security operations: Context, harness, and model.
Context
The foundation
Everything downstream depends on it. Context is a continuously updated operational knowledge graph of every device, identity, workload, connection, and behavior, assembled in real time and semantically rich enough for agents to reason over directly.
Harness
The control layer
Harness is the runtime that governs how agents operate, orchestrating workflows, tools, state, and memory with guardrails, permissions, human approval routing, and a complete audit trail throughout.
Model
The reasoning layer
Specialized, multi-model AI performs triage, investigation, and response; interchangeable by design, each new generation of models can be adopted without re-architecting anything.
...The Agentic SOC Alliance represents one of the industry’s first serious efforts to define an open operational architecture for autonomous security operations, bringing together trusted context, governed AI, and coordinated response so enterprises can finally begin defending at the speed of their adversaries…
Dr. Edward G. Amoroso
CEO, TAG Infosphere & Research Professor, NYU