01
A shared blueprint
Reference Architecture
How people, agents, data, and infrastructure fit together in an open, interoperable architecture for security operations.
Working groups
Alliance Working Groups
Working groups, each led by a group lead working with expert members, produce the requirements and guidance that come together as the unified SOC reference architecture.
Working group directory
02
People and oversight
Humans
The roles, skills, and decision points that help security teams guide autonomous systems and retain meaningful human oversight.
03
Autonomous operations
Agents
How agents reason, coordinate, and act across security workflows, with clear boundaries for authority and accountability.
04
The operating foundation
Infrastructure
The platforms, tools, and integrations needed to run agentic security workflows reliably and connect them to existing environments.
05
Evidence for decisions
Data and Context
The telemetry, context, and data quality agents need to investigate threats, make informed decisions, and explain their actions.
06
Confidence through evidence
Validation
How to evaluate agent behavior and security outcomes, test safeguards, and verify that systems operate as intended.
07
A broader conversation
Industry Engagement
Connecting practitioners, researchers, and technology providers to share perspectives and inform the adoption of agentic security operations.
Contribute to a working group
Members, practitioners, and researchers can bring requirements, expertise, and review to any group.