Agentic SOC Alliance Expands as Enterprises Prioritize Autonomous Security

Edward Amoroso to coordinate the Alliance as CISO-led working groups develop industry guidance for enterprises moving agentic SOC from pilot to production 

SEATTLE--(BUSINESS WIRE)--The Agentic SOC Alliance, an industry coalition dedicated to advancing trusted autonomous security operations, today announced that Dr. Edward G. Amoroso, CEO of TAG Infosphere and NYU Research Professor, will coordinate the growing coalition of security leaders, researchers, academics and technology providers defining how an AI-driven SOC should operate. CISO-led working groups will create a practical blueprint for the functional components, interfaces, information flows, automation requirements, and human roles needed to replace today’s fragmented, tool-centric SOC model.

Combatting AI-Enabled Attacks with Machine-Speed Defense

Enterprises are rebuilding security operations around autonomous agents that investigate and respond to AI-powered attacks at machine speed. But fundamental questions that can’t be answered by any single vendor remain about trusting AI agents in the SOC, how much authority to grant, and verifying agent actions. 

“The shift to autonomous security operations is happening now, and enterprises need an architecture they can trust as agents begin taking actions with significant consequences,” said Dr. Edward G. Amoroso, CEO of TAG Infosphere and coordinator of the Agentic SOC Alliance. “The winning architecture will be open, governed and designed for a world where the agents, models and security technologies continue to evolve. The Alliance can make that architecture practical by building it, validating the outcomes alongside industry veteran security leaders and creating a path to trusted production-scale autonomous security operations.”

Amoroso is a former AT&T senior vice president and chief information security officer, and spent 31 years at the company. TAG Infosphere, which he leads, will coordinate the Alliance working groups as they turn the proposed architecture into practical, independent guidance for enterprises to move agentic SOC pilots into production. 

Defining the Operating Architecture for the Agentic SOC

In July, ExtraHop founded the Agentic SOC Alliance to define and standardize a new SOC operating architecture, open and interoperable by design and built around Context, Harness, and Model. Context gives agents real-time evidence to reason on, and the Harness applies governance, guardrails, and human approval. The Model is interchangeable, so that enterprises can select the best models for each workload without rebuilding Context or the Harness.

“AI is finally letting defenders solve problems we've never been able to solve in the history of cyber defense, but trusted autonomy is the foundation we as an industry need to build together first,” said Greg Clark, CEO of ExtraHop. “When we founded the Alliance, we offered an open reference architecture as a starting point. What happened next was remarkable. Within days, security leaders wanted to know more about the proposed architecture and bring their vendors and teams together to create operational prototypes. Now with Ed stepping in to coordinate the Alliance and CISOs helping shape its direction, we can unite as an industry on an open, reliable and interoperable architecture that everyone can build on for years to come.”

Enterprise Security Leaders Shape the Agenda

The Alliance's mission is to define a reference architecture for AI-driven security operations. Guided by Amoroso’s experience leading security at global scale and translating technical goals into operating requirements, the Alliance is expanding participation across enterprise security leaders, technology providers, systems integrators, academics, government agencies, and researchers. 

“Agents need access to models, context and telemetry, tooling and orchestration, security controls, governance and trust. Without a common approach to ensure those interconnected security layers can interoperate, reason together, and operate safely, autonomy can become a liability,” said Jim Routh, Chief Trust Officer at Saviynt. 

“Security leaders are being asked to bring AI into the SOC alongside the security functions they already run. The Alliance’s working groups are addressing how SIEM, EDR, NDR and IAM integrate, how to obtain AI models and applications, and how to measure results against industry peers. Their output will come together in one Agentic SOC framework, so leaders can plan upgrades and investments against a shared standard,” said Mark Thornberry, Chief Business Officer, GuidePoint Security.

“Agentic SOC will reach production across enterprises when vendors and integrators build from one framework. We are working with the Alliance’s working groups to design an overall reference architecture that holds across multiple environments and validate it against our experience with how enterprises actually deploy,” said Chris Konrad, Vice President Global Cyber, World Wide Technology (WWT).

From Architecture to Action

Dedicated working groups address specific challenges such as architecture, AI automation, automation, telemetry, interoperability, detection, and response, with members contributing practical principles and policies to safely deploy agentic security operations at scale. 

Agentic SOC Alliance Working groups: 

• SOC Reference Architecture: coordinates the Agentic SOC Alliance reference architecture and publishes the documents, resources and tools the industry uses to apply it.
• Human Layer: sets the policies and principles for work that stays with SOC analysts: detection engineering, case ownership, threat hunting and SOC management.
• Agentic AI Layer: defines how AI agents work in the SOC across co-pilot support, agentic detection, agentic response and agentic analysis.
• Infrastructure: sets the principles for platform orchestration, workflow management, the IT/business interface and vendor management.
• Data and Context: establishes how the SOC handles real-time telemetry, intelligence feeds, context graphs and data management.
• Validation: defines how SOC teams test their defenses and prove compliance through red team testing, continuous compliance, penetration testing and vulnerability management.
• Industry Engagement: identifies the resources needed to maximize industry engagement, the training and outreach that best support industry use.

At the cybersecurity industry’s largest event, RSA Conference, in April 2027 in San Francisco, the Alliance will share reference architectures, recommendations, and migration guidance that organizations can use to move from today’s fragmented SOC toward a more integrated, AI-driven model.

About the Agentic SOC Alliance

The Agentic SOC Alliance is an independent, industry coalition dedicated to accelerating the adoption of trusted, interoperable AI-powered security operations. The Alliance is a neutral forum where technology vendors, cloud providers, systems integrators, AI platform providers, researchers, and security leaders at global enterprises collaborate to define an architectural reference, establish trust, validate interoperability, and advance best practices for autonomous security operations as both threats and defenses evolve. Founding members include AuthMind, Armadin, Command Zero, CrowdStrike, Dropzone AI, Exaforce, ExtraHop, Fig, Intezer, Kindo, LangChain, Prophet Security, ReversingLabs, TENEX.AI and Torq.

Learn more about the Agentic SOC Alliance and why the SOC needs a new operating model.