The SOC wasn’t built for this

Security operations centers have run on the same playbook for decades — collect, queue, triage, investigate, escalate. But attackers now move at machine speed: one recent breach that cost a company 3,600 repos got underway in roughly 87 seconds, far outpacing even a fast 10-minute log-enrichment pipeline. This week, host Greg Otto talks with ExtraHop CEO Greg Clark about the newly announced Agentic SOC Alliance and why he believes traditional SOC architecture can’t keep up. Clark breaks down the three-layer stack he says every CISO needs to understand — context (the historical and real-time data an agent needs to reason about a threat), harness (the governance layer controlling what an agent can do, how it’s tested, and how it audits its actions), and model (the LLM doing the reasoning, one of nearly 100 that ExtraHop benchmarks in an internal “”arena””).

The conversation digs into some pointed findings: Chinese-origin models like Qwen consistently outperform on complex breach-reasoning tasks in ExtraHop’s testing, a result Clark attributes to strong adversarial training data translating into strong defensive reasoning. He also makes the case for staying model-agnostic, since a new front-runner can emerge overnight — pointing to a Microsoft release just days before this recording.

Much of the discussion centers on where humans still fit in. Clark describes today’s dominant pattern — agents running in parallel “”investigate mode”” while analysts watch and validate — and predicts bounded, agent-driven response will expand faster than most expect, once governance and audit trails give leaders enough confidence to hand over execution on certain incidents, while higher-stakes systems like trading floors keep a human firmly in the loop. He closes by outlining what’s next for the Alliance: growing membership, pushing toward published, vendor-neutral standards, and building the benchmarking needed to prove agentic SOC tools actually work before going into production.