Ex-AT&T Security Chief Amoroso to Standardize Autonomous SOCs

The Agentic SOC Alliance has named Dr. Edward G. Amoroso — CEO of TAG Infosphere, research professor at New York University, and a 31-year AT&T security veteran — as coordinator of its effort to standardize trusted, interoperable autonomous security operations.

ExtraHop founded the Alliance in July 2026 to build an open, interoperable operating architecture for AI-driven security operations. The coalition now spans enterprise security executives, researchers, academics, technology providers, systems integrators and government agencies.

Amoroso's job: turn experimental AI agents that investigate threats and respond to cyberattacks at machine speed into something enterprises can run in production. TAG Infosphere will coordinate the Alliance's working groups as they translate proposed technical architectures into implementation guidance.

"The shift to autonomous security operations is happening now, and enterprises need an architecture they can trust as agents begin taking actions with significant consequences," Amoroso said. "The winning architecture will be open, governed and designed for a world where the agents, models and security technologies continue to evolve."

What does the framework actually look like?

The proposed architecture rests on three components:

• Context — real-time security telemetry, intelligence and other evidence agents need to assess threats and make decisions.
• Harness — governance mechanisms, operational guardrails and human approval controls governing agent behavior.
• Model — the AI systems executing security tasks, designed to be interchangeable.

That separation matters commercially. Enterprises could swap AI models per workload without rebuilding their underlying security infrastructure or governance systems — and without locking into a single vendor.

The design also tackles a question security executives keep asking: how much authority autonomous systems should have when investigating incidents, modifying configurations or initiating defensive actions.

Who is building it?

CISO-led working groups will produce practical guidance on SOC architecture, system interfaces, information flows, automation requirements and human oversight. The objective is to move enterprises away from fragmented, tool-by-tool security environments toward integrated operations run with autonomous agents.

Members are examining how existing security technologies — SIEM, EDR, NDR and identity and access management — function inside an autonomous SOC architecture. The initiative also wants consistent approaches for evaluating AI models, measuring security outcomes, validating agent actions and comparing implementation results across organizations.

Saviynt, GuidePoint Security and World Wide Technology are contributing perspectives on governance, integration and enterprise deployment requirements.

"Agents need access to models, context and telemetry, tooling and orchestration, security controls, governance and trust," said Jim Routh, Chief Trust Officer at Saviynt. "Without a common approach to ensure those interconnected security layers can interoperate, reason together, and operate safely, autonomy can become a liability."

Mark Thornberry, Chief Business Officer at GuidePoint Security, framed the deliverable: "Their output will come together in one Agentic SOC framework, so leaders can plan upgrades and investments against a shared standard."

Chris Konrad, Vice President Global Cyber at World Wide Technology, added: "Agentic SOC will reach production across enterprises when vendors and integrators build from one framework."

Seven working groups, one standard

The Alliance has split its work into seven areas:

• SOC Reference Architecture — coordinates the overall framework and publishes technical documents, resources and implementation tools.
• Human Layer — defines what stays with security professionals: detection engineering, incident ownership, threat hunting and SOC management.
• Agentic AI Layer — defines how autonomous agents participate in detection, incident analysis, response and analyst assistance.
• Infrastructure — covers orchestration platforms, workflow management, business and IT integration, and vendor coordination.
• Data and Context — sets principles for managing real-time telemetry, threat intelligence, contextual information and security data.
• Validation — develops testing for defensive capabilities and compliance via penetration testing, red teaming, vulnerability management and continuous compliance assessments.
• Industry Engagement — coordinates education, outreach, training and resources to drive broader adoption.

Together, the groups are expected to produce an integrated reference framework that security organizations can use to evaluate technologies, plan upgrades and set operational requirements.

What happens next?

The Alliance will present reference architectures, recommendations and migration guidance at RSA Conference in San Francisco in April 2027. The materials aim to help enterprises assess their existing SOC environments and plan how to add autonomous capabilities while keeping governance and human oversight intact.

The founding members: AuthMind, Armadin, Command Zero, CrowdStrike, Dropzone AI, Exaforce, ExtraHop, Fig, Intezer, Kindo, LangChain, Prophet Security, ReversingLabs, TENEX.AI and Torq.

ExtraHop CEO Greg Clark said demand moved faster than expected. "Within days, security leaders wanted to know more about the proposed architecture and bring their vendors and teams together to create operational prototypes," he said, adding that trusted autonomy is "the foundation we as an industry need to build together first."

The broader stake: shared industry practices that let organizations adopt AI-driven security operations without giving up accountability, interoperability or control over consequential decisions. April 2027 is when we find out whether the industry can agree on what that looks like.