2026-10-03 –, WORKSHOP 1 (Neon Genesis Exploitation) Language: English
Why is security operations know-how trapped inside proprietary vendor platforms and siloed team wikis? Traditional SOCs operate at human speed against machine-speed adversaries, while commercial "AI SOC" tools hide behind opaque black boxes and prohibitive costs. Meanwhile, attempting to automate without common operational grammar leads to alert chaos, hallucinations, and inconsistent response actions that either disrupt business operations or leave incidents partially unresolved.
The ZeroSOC initiative (zerosoc.org) is an early-stage open project (Apache-2.0, v0.1 working draft) democratizing autonomous cyberdefense. Centered on the ZeroSOC Framework, it explores Executor Neutrality — the principle that the same human-readable playbook can be executed interchangeably by a human analyst, deterministic automation, or an AI agent —, OCSF-aligned taxonomy, and verifiable measurement gates.
This 1-hour interactive working session aims to bring together SOC analysts, detection engineers, incident responders, and researchers at RomHack Camp to co-design and shape this emerging standard. Following a 15-minute introduction to the architecture (no prerequisites required), we will open the floor for a working group focused on the framework's foundational building blocks: Definitions & Taxonomy, 4-Phase Processes, Operational Metrics, Agentic Guardrails, and Playbooks. Come ready to challenge assumptions, debate edge cases, and help architect the open foundation for modern SecOps!
Berghem-in-the-Middle (BITM) is a non-profit founded by information security enthusiasts and professionals in northern Italy, in an open and friendly environment fostering technical development and knowledge sharing. Since 2019 it hosts No Hat, an international security conference gathering researchers and specialists in Bergamo.
You can find BITM in the Community Area.