How Agentic SOCs Could Use Shared Context and Governance to Speed Security Operations
Summary
An ExtraHop executive describes an agentic SOC model that combines real-time security context, governed AI agents, and shared architecture to accelerate threat investigation and response.
Key points
- The proposed agentic SOC shifts from batch alert triage to real-time telemetry, behavioral detection, investigation, and response.
- AI agents would draw on a shared context layer combining network, endpoint, identity, cloud, and threat intelligence.
- A governance harness would control agent permissions and tool calls, orchestrate agents, and provide observability.
- Structured, correlated context can improve agent accuracy and token efficiency compared with analyzing raw packet captures.
- The Agentic SOC Alliance, launched by ExtraHop with more than a dozen partners, aims to develop a common architecture; customers are also seeking input.
- The interview argues that behavioral detection will become increasingly important as AI-assisted attackers can exploit vulnerabilities quickly.
Article Details
- Topic
- Agentic SOC architecture, including the shared context layer, agent governance harness, and Agentic SOC Alliance.
People
Vendors
CrowdStrikean initiative that ExtraHop launched in July with more than a dozen partners, including ReversingLabs, CrowdStrike, and LangChain. The Alliance seeks to define a common architecture the industry can rally aroundExtraHopover from existing enterprise SOCs? To get answers, I caught up with Kanaiya Vasani, CPO and CMO at ExtraHop, on the sidelines of Black Hat to talk about the transformation agentic AI is prompting in the infosecKindoVasani, ExtraHop: There are many very broad-based horizontal players working on harnesses: LangChain, Kindo, and some of the other players out there. We think those are the folks who are going to own the harnessLangChainExtraHop launched in July with more than a dozen partners, including ReversingLabs, CrowdStrike, and LangChain. The Alliance seeks to define a common architecture the industry can rally around instead of everyReversingLabsSOC Alliance, an initiative that ExtraHop launched in July with more than a dozen partners, including ReversingLabs, CrowdStrike, and LangChain. The Alliance seeks to define a common architecture the industry can rally
Products
RevealXthe speed and accuracy of their technologies to counter AI-powered threats. (ExtraHop just unveiled RevealX™ an NDR platform capable of 400 Gbps "line rate" analysis of enterprise data center traffic.) AI is alsoSpectra CoreRL: At ReversingLabs, this is one of the things we've been talking about for a long time, and our Spectra Core technology makes fine-grained detection of these types of threats possible. I know ExtraHop and RL