In conjunction with

Technology Forum15 founding vendors

AgenticSOCAlliance

The Agentic SOC Alliance closes that gap by uniting three foundational layers into a single post-Mythos architecture designed so autonomous agents can act with precision and be trusted to do it. Two of those layers, Context and the Harness, are durable. The third, the Model, is interchangeable by design.

01Contextthe shared foundationdurable02Harnessgoverned AI runtimedurable03Modelinterchangeable by designswappable
Continuous Adversarial ValidationRuns adaptive kill chains against all three layers, then feeds every missed path back into the Harness.

Read bottom-up. That is execution order.

The Operating Model

Three layers. Read bottom-up.

Federated sources feed a real-time context graph. Agents query the graph instead of raw logs. A governed runtime decides what those agents are actually allowed to do. The model on top is the part you can swap.

Context and Harness are durable. The Model is interchangeable.

Modelinterchangeable by design

Platform Pilots

  • Proprietary Models

AI SOC Platforms

  • Proprietary Models
  • Open Source

AI-Native Tools

  • Proprietary Models
  • Open Source

Custom Agents

  • Open Weight
  • Proprietary Models
  • Open Source
Harnessgoverned AI runtime
OrchestrationWorkflow ExecutionMemoryHuman ApprovalsGovernance
Contextthe shared foundation

The integration point

Graph API + MCP

Real-Time Context Graph

A semantic map of every entity, identity, and connection — and how they all relate. The single surface agents query to reason about a detection and plan a response, instead of stitching together raw logs themselves.

Sources federate inGraph resolves relationshipsAgents query for context

Federated sources the graph is built from these

ExtraHopNetwork · WireAPIMCP
CrowdStrikeEndpointAPIMCP
AuthMindIdentityAPIMCP
+ ExtensibleAny alliance data lakeAPIMCP
Wire Ground TruthThe unfiltered source, federated across every member's own lake

The Sessions

One interview and three panels. Each panel maps to a layer of the Alliance architecture, in execution order — Context, then Harness, then Model.

FILTERS
DATE
HOST
TOPIC
PANELISTS
INTERVIEW
LIVE NOW

INTERVIEW: The SOC Needs a New Operating Model

Panelists
  • Jim Rutt
  • Richard Bird
INTERVIEW :

The SOC Needs a New Operating Model

The security operations center was designed around an assumption that no longer holds: that a human analyst can sit at the center of every decision. When an attack moves at machine speed, accelerating one step in a chain built for a slower era does not close the gap — it just relocates the bottleneck. This opening conversation sets up the thesis behind the Agentic SOC Alliance: that the question facing security leaders is not which AI product to buy, but what the SOC should be organized around now. That is an architecture question, and it deserves an architecture answer — one built on three layers, Context, Harness, and Model, where no single vendor can deliver the whole operating model alone.

Jim Rutt
Jim Rutt
CISO
The Dana Foundation
Richard Bird
Richard Bird
Chief Security Officer
Singulr AI
PANEL
LIVE NOW

PANEL: Context — The Shared Foundation

Panelists
  • Sounil Yu
  • John Bruggeman
  • Ziv Karliner
  • Gidi Cohen
PANEL :

Context — The Shared Foundation

Context is the evidence an agent reasons on, and it is the layer the entire model lives or dies on. Not yesterday's logs shipped to cold storage, but a real-time, ground-truth view of what is actually happening across network, endpoint, identity, and cloud — assembled the instant the wire produces it. An autonomous agent fed fragmented logs will reach fragile conclusions confidently and at scale, which is exactly how an AI SOC ends up flooding analysts with false positives while missing the one thing that mattered. This panel examines the real-time context graph as the integration point: a semantic map of every entity, identity, and connection that agents query through a Graph API and MCP rather than stitching together raw feeds themselves. Federated sources plug in, the graph resolves relationships, and agents query for context. The through-line: no model is good enough to reason its way out of missing evidence.

Sounil Yu
Sounil Yu
Chief AI Officer
Knostic
John Bruggeman
John Bruggeman
Consulting CISO
CBTS
Ziv Karliner
Ziv Karliner
Co-Founder & CEO
Pillar Security
Gidi Cohen
Gidi Cohen
CEO & Co-Founder
Bonfy
PANEL
LIVE NOW

PANEL: Harness — The Governed AI Runtime

Panelists
  • Kevin Jackson
  • Neha Garg
  • Jonathan Litchman
  • David Greene
PANEL :

Harness — The Governed AI Runtime

The Harness is the layer most people underestimate. Context tells an agent what is happening. A model decides what it thinks that means. Neither one decides what the agent is actually allowed to do about it. That is the harness: the governed control plane that mediates every action an agent takes, scopes what it can read and what it can execute, enforces guardrails and permissions, and keeps a complete audit trail. It covers orchestration, workflow execution, memory, and human approvals. This panel gets practical about how a CISO grants an autonomous agent real authority without re-earning trust every time the underlying model changes — and why, without a harness, an agent with production access is a liability rather than an operator.

Kevin Jackson
Kevin Jackson
CEO
LEVEL 6 Cybersecurity
Neha Garg
Neha Garg
Co-Founder and CEO
Arambh Labs
Jonathan Litchman
Jonathan Litchman
Co-Founder and CEO
The Providence Group
David Greene
David Greene
Chief Growth Officer
Simbian
PANEL
LIVE NOW

PANEL: Model — Interchangeable by Design

Panelists
  • Alex Polyakov
  • Evgeny Khaskelberg
  • Sounil Yu
  • Richard Bird
PANEL :

Model — Interchangeable by Design

Models are the fastest-moving part of the stack and the part least worth betting an architecture on. The Alliance treats the model layer as deliberately interchangeable: proprietary and open-source weights, called by platform pilots, AI SOC platforms, AI-native tools, and custom agents alike. The strategic argument is that Context and Harness are durable while the Model is not — so an operating model that hard-codes one vendor's model caps its own defense at whatever that vendor ships next. This panel debates open versus proprietary, what model independence costs to build and what it buys, and how continuous adversarial validation keeps the question honest by running adaptive kill chains against the live stack and feeding every missed path back into the Harness.

Alex Polyakov
Alex Polyakov
Co-Founder, CTO
Adversa AI
Evgeny Khaskelberg
Evgeny Khaskelberg
CEO and Founder
SDefender LTD
Sounil Yu
Sounil Yu
Chief AI Officer
Knostic
Richard Bird
Richard Bird
Chief Security Officer
Singulr AI

Founding Members

15 vendors

The Alliance brings together network detection, endpoint, identity, threat intelligence, AI-native SOC platforms, orchestration frameworks, and adversarial validation. Members with a Guardians profile link through to it.