Downloadable Version

The ARSOC's nerve center on the Tech Port campus. 

That effort—now known as the Alamo Regional Security Operations Center (ARSOC), which is headquartered at the Port and operates around-the-clock—has since evolved into a national model for collaborative cybersecurity. 

Last spring, members of the ARSOC’s growing team hosted their latest annual gathering with partners from across the state. 

Their two-day gathering at the Boeing Center at Tech Port was an important opportunity to reaffirm the collaboration among all stakeholders in an in-person setting where they participated in additional training, were presented some of the latest tools and, of particular importance, compared notes and learned about emerging threats and techniques to combat them. 

“Cybersecurity is a team sport,” said Sunchai “Sunny” Khemalap, senior IT manager for the city and manager of the ARSOC. “It has to be. The threat is so wide-ranging.” 

“Collaborating remotely is very difficult,” said David Sharp, a cybersecurity engineer who is also part of the ARSOC team, explaining the need to regularly have in-person gatherings. “Bringing people together, along with vendors and other presenters, allows not just information sharing and collective training, but it also forges relationships. “Then when something serious happens, you have those relationships and understandings built ahead of time.” 

Sharp and others said users—the human beings working on networked computers—remain the weakest link. The recent conference at the Boeing Center was especially helpful in discussing the rapid growth of AI deepfakes that are making social engineering attempts even more realistic to extract passwords, account numbers and other sensitive information from unsuspecting users. But AI also offers the good guys opportunities as well, “which a lot of our presenters are talking about here today,” he added. 

ARSOC’s collaborative model, both the in-person gatherings and the 24/7 lines of communication between the partners throughout the year, was born out of necessity. 

As cyberattacks on public critical infrastructure became more frequent and sophisticated, it’s also clear to leaders who run municipal operations, utilities and other public assets that there is strength by banding together. With support from Port San Antonio, they developed a shared cybersecurity operations center that pools resources and intelligence while building expertise. 

The result was the first cybersecurity mutual aid organization of its kind in the United States. 

Unlike traditional Security Operations Centers (SOCs), which have historically operated in isolation, ARSOC’s model enables real-time threat intelligence sharing, coordinated incident response, and joint training exercises. This approach strengthens individual organizations and enhances the resilience of the entire region. 

Information sharing can be as straightforward as issuing an alert to employees about a phishing email with a malicious attachment to discussing unusual activities that could signal that an external party is trying to hack into the system. 

Wastewater treatment plant. 

Shawna Arroyo, director of information technology at the San Antonio River Authority, which manages the region’s watershed, including flood management and wastewater treatment, said being part of ARSOC gives her organization access to tools and expertise they might not otherwise have. 

“We had a huge gap, and the ARSOC has allowed us to fill it,” she said. 

In addition to the city, CPS Energy and the river authority, ARSOC members include SAWS, VIA Metropolitan Transit, Bexar County and an array of smaller municipalities, utilities, and nonprofits across much of Central and South Texas. 

Locating ARSOC at Port San Antonio was a natural fit, as the growing innovation campus is already home to one of the nation’s largest and fastest-growing cybersecurity clusters, along with aerospace, robotics, and national defense operations that similarly demand the highest standards in information security. 

Khemalap said one of the most significant recent partnerships is the formal addition of the 273rd Cyber Operations Squadron of the Texas Air National Guard. As the Texas Department of Emergency Management’s cyber response team, the 273rd is deployed when a Texas city comes under cyberattack. In addition to bringing its statewide perspective and deep operational expertise, the 273rd will also support the development of a cyber range at ARSOC—a controlled environment for conducting live-fire training and simulations. 

ARSOC’s mutual aid model has now expanded well beyond Texas. In 2024, the center was a significant participant in the NATO Cyber Coalition Exercise, one of the world’s largest cyber defense simulations. ARSOC has also engaged with delegations from South Korea, Jordan, Canada, and Chile. During its recent annual meeting, ARSOC leadership also welcomed a delegation from India. 

National agencies such as the Department of Homeland Security (DHS), FEMA, the FBI, and the White House Deputy Director of IT have also visited the center. Closer to home, representatives with the Texas Department of Transportation, the Public Utility Commission (PUC), Harris County and mayors with the South Texas Coalition of Cities attended this year's annual meeting, signaling growing regional momentum for this collaborative approach. 

“The ARSOC as an entity is truly a nationally unique model because it combines as physical facility, here on the Port’s campus, where people can sit side-by-side and respond to real incidents or train for potential future threats and vulnerabilities,” said Will Garrett, the Port’s vice president of talent, technology development and integration.

“But just as important is the virtual network that exists across the state, that allows for even the smallest of cities to have access to resources, information, and intelligence they’d never get if they weren’t part of this partnership."

Image credits: Samuel Fernandez; Port San Antonio; San Antonio River Authority.