Security operations faces a scaling crisis driven by workforce shortages, analyst burnout, and alert overload. While AI and automation have improved parts of detection, triage, and response, the industry still lacks a broadly adopted, vendor-neutral framework for classifying degrees of SOC autonomy — leading to vendor confusion, misaligned buyer expectations, and unfocused research investment. This paper introduces the SOC Autonomy Framework (SAF), defining six levels of security operations autonomy (L0 through L5), analogous to the SAE J3016 standard for automated driving.

The Framework

SOC Autonomy Framework

Level

Name

AI DECISION SCOPE

HUMAN ROLE

ACTION RATE

Manual SOC

None

Everything

Assisted Detection

Surface, prioritize alerts

Investigate, decide

Automated Triage

Triage, enrich, correlate, filter FPs

Validate, investigate, respond

0-10%

Conditional Autonomy

Investigate, recommend, execute low-risk

Approve high-impact, supervise

20-50%

High Autonomy

Full lifecycle within governed boundaries

Monitor, exceptions, policy updates

70-90%

Full Autonomy

Entire SOC lifecycle

Set policy only

99-100%

Key Insights

THE TRUST THRESHOLD

L2 to L3 Transition

The transition from automated triage to conditional autonomy requires the system to reason about novel situations, not just follow playbooks. This is the hardest architectural leap.

THE TRUST THRESHOLD

L3 to L4 Transition

Moving from human approves to system acts autonomously is primarily a trust challenge requiring calibrated confidence, governed boundaries, and auditable decision traces.

THE TRUST THRESHOLD

Full Autonomy

Full autonomy may be technically achievable but ethically undesirable. The value of human judgment in security is not processing speed, it's moral reasoning about proportional response.

Cite This Paper

Shuja, F. (2026).

"The Autonomous SOC Manifesto: A Framework for Classifying Levels of Security Operations Autonomy."

SIRP Labs. April 2026. Available at: https://sirp.io/manifesto

ORCID: 0009-0008-3106-2972

About The Author

Faiz Shuja is the Co-Founder and CEO of SIRP Labs, where he created the OmniSense Autonomous SOC platform.
A system designed to autonomously understand signals, reason in real-time, and take action based on evolving context. His career in cybersecurity spans two decades.

He founded Rewterz in 2006 from a small room on a rooftop in Karachi, Pakistan, with a single goal: build something meaningful in cybersecurity.
That company grew into one of the Middle East's leading cybersecurity firms, now protecting 50+ enterprises across the globe with a 200-member team and a state-of-the-art SOC in Riyadh. He served as CEO of The Honeynet Project (2016-2021), the international non-profit dedicated to investigating cyber attacks and developing open-source security tools. He holds CISSP, GCIH, and GSEC certifications.

Faiz Shuja is the Co-Founder and CEO of SIRP Labs, where he created the OmniSense Autonomous SOC platform. A system designed to autonomously understand signals, reason in real-time, and take action based on evolving context. His career in cybersecurity spans two decades.

He founded Rewterz in 2006 from a small room on a rooftop in Karachi, Pakistan, with a single goal: build something meaningful in cybersecurity. That company grew into one of the Middle East's leading cybersecurity firms, now protecting 50+ enterprises across the globe with a 200-member team and a state-of-the-art SOC in Riyadh. He served as CEO of The Honeynet Project (2016-2021), the international non-profit dedicated to investigating cyber attacks and developing open-source security tools. He holds CISSP, GCIH, and GSEC certifications.

Faiz Shuja is the Co-Founder and CEO of SIRP Labs, where he created the OmniSense Autonomous SOC platform. A system designed to autonomously understand signals, reason in real-time, and take action based on evolving context. His career in cybersecurity spans two decades.

He founded Rewterz in 2006 from a small room on a rooftop in Karachi, Pakistan, with a single goal: build something meaningful in cybersecurity. That company grew into one of the Middle East's leading cybersecurity firms, now protecting 50+ enterprises across the globe with a 200-member team and a state-of-the-art SOC in Riyadh. He served as CEO of The Honeynet Project (2016-2021), the international non-profit dedicated to investigating cyber attacks and developing open-source security tools. He holds CISSP, GCIH, and GSEC certifications.