Context
Context gives agents real-time evidence to reason on, and the Harness applies governance, guardrails and human approval.
An industry coalition · Founded 2026
The Agentic SOC Alliance brings together security industry leaders and technology providers to define the requirements, best practices, and implementation blueprints for a SOC built to combat AI-powered adversaries with machine-speed defense that is accurate, governable, verifiable and durable.












Why the Alliance exists
Enterprises are rebuilding security operations around autonomous agents that investigate and respond to AI-powered attacks at machine speed. But fundamental questions remain about trusting AI agents in the SOC, how much authority to grant, and verifying agent actions. Agents need access to models, context and telemetry, tooling and orchestration, security controls, governance and trust. Yet without a common approach to ensure those interconnected security layers can interoperate, reason together and operate safely, autonomy can become a liability.
Why trusting agents in the SOC requires ecosystem collaboration →The Alliance architecture
At the core of the Agentic SOC Alliance is the founding principle that a common, open and interoperable three-layer (Context, Harness, Model) architecture is needed for autonomous security operations to endure as the industry advances.
Context gives agents real-time evidence to reason on, and the Harness applies governance, guardrails and human approval.
The harness governs how agents operate: orchestrating workflows, tools, state, and memory, with guardrails, permissions, human-approval routing, and a complete audit trail throughout.
The Model layer is interchangeable, so enterprises can adopt new models as they improve without rebuilding the layers beneath.
Mission, purpose, what we are working to achieve, and how the Alliance is governed.
About the Alliance →Working groups producing a unified SOC reference architecture and guidance.
Working Groups →Alliance publications, working-group outputs, member perspectives, and press coverage.
Resources →Working groups
Working groups with CISO leadership will guide enterprise migration, align vendor integrations and inform investments to safely deploy agentic security operations at scale.
Resources
Greg Clark, CEO, ExtraHop · July 22, 2026

Press release · November 12, 2026
August 10, 2026

AGENTIC SOC ALLIANCE
General enquiries, membership, and working-group questions.