Agentic SOC Alliance addresses AI-era security operations challenges

The newly announced Agentic SOC Alliance aims to transform security operations centers that have operated for decades on a traditional workflow: collect, queue, triage, investigate, escalate. Modern attackers now operate at machine speed, with a recent breach compromising 3,600 repositories in just 87 seconds, far outpacing traditional SOC response capabilities. ExtraHop proposes a three-layer architectural stack for agentic security: context, providing historical and real-time data for threat reasoning; harness, a governance layer controlling agent actions and auditing; and model, the large language model performing threat analysis. The alliance benchmarks approximately 100 models, finding that models from Chinese origins like Qwen demonstrate superior performance on complex breach-reasoning tasks compared to other frontier models.