Define requirements
Establish and validate the architectural requirements for the AI-native SOC across the Context, Harness, and Model layers.
About the Agentic SOC Alliance
An industry coalition of security leaders, technology providers, systems integrators and researchers working together to define an open and interoperable architecture and implementation guidance that rebuilds the SOC for autonomous security operations.
Mission
The Agentic SOC Alliance's mission is to unite the industry around a common approach to open, interoperable agentic security operations and provide guidance for adopting reliable, safe and auditable agentic AI at enterprise-scale.
What is the Agentic SOC Alliance?
The Agentic SOC Alliance is an independent, industry coalition dedicated to accelerating the adoption of trusted, interoperable AI-powered security operations. The Alliance is a neutral forum where technology vendors, cloud providers, systems integrators, AI platform providers, researchers, and security leaders at global enterprises collaborate to define an architectural reference, establish trust, validate interoperability, and advance best practices for autonomous security operations as both threats and defenses evolve.
Coordination and governance
Dr. Edward G. Amoroso
Alliance Coordinator · CEO, TAG Infosphere · Research Professor, NYU
The Alliance is coordinated by Dr. Edward G. Amoroso, a former senior vice president and chief information security officer at AT&T who spent 31 years at the company. TAG Infosphere, which he leads, will coordinate the Alliance working groups as they publish practical, independent guidance for enterprises to move agentic SOC pilots into production.
Why autonomous security operations require ecosystem collaboration
Adversaries using frontier AI now automate reconnaissance, exploit development, and lateral movement at machine speed. A SOC organized around a human at the center of every decision — collect, queue, triage, investigate, escalate — cannot move fast enough to stop AI-powered attacks. Bolting AI onto the existing pipeline relocates the bottleneck rather than removing it.
An operating model built for autonomy depends on three things fitting together: trustworthy, structured context for agents to reason on; a governed harness that controls what agents are allowed to do; and interchangeable models that do the reasoning. No single vendor supplies all three, and enterprises will not replace a decade of security investment with one closed platform. The only path to a trustworthy agentic SOC is an open architecture in which the best context sources, harnesses, and models interoperate — and that requires the ecosystem to agree on how.
Human-speed defense is no longer sufficient against machine-speed attacks. The Alliance is one of the industry's first serious efforts to define an open operational architecture that brings together trusted context, governed AI, and coordinated response.
Real-time ingest from network and endpoint telemetry has to become the primary substrate for how AI agents operate. The target state is machine-speed detection, containment, response, and recovery; a traditional SIEM model alone will not keep up.
What the Alliance is working to achieve
Publish a unified reference architecture
Integrate the outputs of the working groups into a single SOC reference architecture and accompanying guidance for industry adoption.
Enable interoperability
Document the interfaces — APIs, MCP, shared context — that let agents, harnesses, and data sources from different providers work together.
Validate against real adversaries
Test the architecture continuously against realistic attacker behavior so that it withstands attacks in practice rather than only on paper.
Keep humans in control
Set out the human-AI operating model: oversight, approval routing, audit, and the governance security leaders need to deploy autonomy and defend it to regulators.
Educate the market
Publish maturity models, migration paths, and economics so organizations can adopt the model deliberately, on their own timeline.
Shape the future of autonomous security
Join the ecosystem defining how the agentic SOC should operate.
info@agenticsocalliance.orgDrag gently to tilt the logo. Arrow keys adjust the tilt; Escape resets it.Loading the 3D Alliance logo.