Skip to content
Menu

An industry coalition · Founded 2026

Building an Agentic SOC is a team sport.

The Agentic SOC Alliance brings together security industry leaders and technology providers to define the requirements, best practices, and implementation blueprints for a SOC built to combat AI-powered adversaries with machine-speed defense that is accurate, governable, verifiable and durable.

Model, Context, HarnessA blue Alliance circle encloses three connected rings. Dark offset edges suggest depth, a complete connected wireframe sits slightly above and to the left of the filled rings in the foreground, and orange callouts identify Model on the left, Context at the upper right, and Harness below.MODELCONTEXTHARNESS

15 Founding Members

View all members →
  • Armadin
  • AuthMind
  • Command Zero
  • CrowdStrike
  • Dropzone AI
  • Exaforce
  • ExtraHop
  • Fig
  • Intezer
  • Kindo
  • LangChain
  • Prophet Security
  • ReversingLabs
  • TENEX.AI
  • Torq
+ New members

Why the Alliance exists

Uniting the Industry for Trusted Agentic SOC

Enterprises are rebuilding security operations around autonomous agents that investigate and respond to AI-powered attacks at machine speed. But fundamental questions remain about trusting AI agents in the SOC, how much authority to grant, and verifying agent actions. Agents need access to models, context and telemetry, tooling and orchestration, security controls, governance and trust. Yet without a common approach to ensure those interconnected security layers can interoperate, reason together and operate safely, autonomy can become a liability.

Why trusting agents in the SOC requires ecosystem collaboration →

Target outcomes for security teams

  • Fewer false positives
  • Defensible investigations
  • Machine-speed response
  • More strategy, less triage
  • AI economics that scale
  • No model lock-in

The Alliance architecture

Context, Harness, and Model

At the core of the Agentic SOC Alliance is the founding principle that a common, open and interoperable three-layer (Context, Harness, Model) architecture is needed for autonomous security operations to endure as the industry advances.

The three-layer Alliance architectureThree connected isometric planes show Context at the foundation, Harness in the middle, and Model above. Context provides real-time, structured evidence. The Harness governs the models through governance, permissions, and audit. The Model is the interchangeable reasoning layer. Read from the bottom up.ContextHarnessModel
The foundation

Context

Context gives agents real-time evidence to reason on, and the Harness applies governance, guardrails and human approval.

The control layer

Harness

The harness governs how agents operate: orchestrating workflows, tools, state, and memory, with guardrails, permissions, human-approval routing, and a complete audit trail throughout.

The reasoning layer

Model

The Model layer is interchangeable, so enterprises can adopt new models as they improve without rebuilding the layers beneath.

Explore the Alliance

Learn About the Alliance

Mission, purpose, what we are working to achieve, and how the Alliance is governed.

About the Alliance →

Explore the Working Groups

Working groups producing a unified SOC reference architecture and guidance.

Working Groups →

Read the Latest Articles

Alliance publications, working-group outputs, member perspectives, and press coverage.

Resources →

Working groups

From architecture to action

Working groups with CISO leadership will guide enterprise migration, align vendor integrations and inform investments to safely deploy agentic security operations at scale.

  1. 1Reference Architecture
  2. 2Humans
  3. 3Agents
  4. 4Infrastructure
  5. 5Data and Context
  6. 6Validation
  7. 7Industry Engagement
  8. See all working groups

Resources

Latest articles and press

All resources →

AGENTIC SOC ALLIANCE

Contact the Alliance

General enquiries, membership, and working-group questions.

General & membership
info@agenticsocalliance.org