ExtraHop has introduced the Agentic SOC Alliance, a new industry initiative designed to establish a standardized operating model for autonomous security operations centers (SOCs). The alliance aims to define best practices and implementation blueprints centered on a three-layer architecture consisting of Context, Harness and Model.

According to ExtraHop, traditional SOC workflows built around queueing, enrichment, triage, investigation and escalation were designed for threats that progressed at human speed. The company says advances in AI now enable adversaries to identify vulnerabilities, weaponize them and move laterally within minutes, creating the need for a new security operations model built for autonomous defense.

Greg Clark, CEO of ExtraHop, said AI has fundamentally changed cyber defense by enabling adversaries to operate at machine speed while many security operations remain based on architectures designed for human-paced environments.

"The industry needs a blueprint for how autonomous security should operate that combines real-time context, intelligent orchestration, and specialized AI agents into a new operating model," Clark said. "The Agentic SOC Alliance is bringing that blueprint together, giving organizations a foundation to detect, decide, and respond with the speed and accuracy that modern threats demand."

Clark added that the initiative is intended as a starting point and invited additional organizations to join the alliance to further develop the operating model.

Jason Dewez, CISO at Fiserv, said modern AI systems require real-time network and endpoint telemetry as the primary source of information for autonomous operations rather than relying on slower batch-oriented processes.

"Our target state is machine speed detection, containment, response, and recovery," Dewez said. "Our traditional SIEM model, while necessary, will not be able to keep up. Agentic assisted SOC is the only answer in our opinion."

The Agentic SOC Alliance was founded by AuthMind, Armadin, Command Zero, CrowdStrike, Dropzone AI, Exaforce, ExtraHop, Fig, Intezer, Kindo, LangChain, Prophet Security, ReversingLabs, TENEX.AI and Torq. The coalition includes companies focused on network detection, endpoint security, AI-native SOC platforms, orchestration and agent frameworks with the goal of developing an open architecture for autonomous security operations.

The alliance's proposed architecture consists of three core layers. The Context layer is designed to provide a continuously updated operational knowledge graph of enterprise assets, identities, workloads, connections and behaviors using data from network, endpoint, identity and threat intelligence sources. ExtraHop says this structured approach enables AI agents to reason over organized information rather than fragmented logs.

The Harness layer governs how AI agents operate by managing workflows, tool execution, state, memory, permissions, human approval processes and audit trails. The Model layer serves as the interchangeable reasoning engine responsible for triage, investigation and response, allowing organizations to adopt new AI models without redesigning the underlying architecture.

Dr. Edward G. Amoroso, CEO of TAG Infosphere and research professor at NYU, said autonomous security operations are becoming increasingly necessary as organizations face machine-speed attacks.

"The Agentic SOC Alliance represents one of the industry's first serious efforts to define an open operational architecture for autonomous security operations, bringing together trusted context, governed AI, and coordinated response so enterprises can finally begin defending at the speed of their adversaries," Amoroso said.

ExtraHop said it contributes the real-time operational knowledge graph within the alliance ecosystem, combining decrypted protocol-level network visibility with identity and endpoint data to provide structured context for autonomous security agents. The company said this approach is intended to improve the accuracy and efficiency of AI-driven detection, investigation and response at enterprise scale.