Cybersecurity experts have warned that security operations centres (SOCs) could struggle to respond effectively to cyberattacks when they lack adequate information about the identities behind suspicious activities and the level of access those identities possess.
The warning comes as organisations increasingly depend on digital identities, automated systems, service accounts, API keys and artificial intelligence (AI) agents to manage critical operations.
According to a cybersecurity industry webinar announcement published by The Hacker News on November 12, 2026, security teams now have access to more monitoring tools, security alerts and system logs than ever before. However, identifying the source of suspicious activity and determining what an attacker could access remain significant challenges.
The report explained that security tools such as Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms can detect unusual activities, including suspicious logins and abnormal API requests. However, detecting an incident does not necessarily provide enough information to determine the identity responsible, its permissions or the systems it can potentially compromise.
For instance, a suspicious login could originate from an employee’s account, a machine identity or an AI agent operating with permissions that have not been properly reviewed.
Without this additional information, security analysts may find it difficult to assess the seriousness of an incident and determine the most appropriate response.
The cybersecurity discussion highlights the growing disconnect between Identity and Access Management (IAM) teams and security operations departments.
While IAM teams are responsible for managing digital identities and determining who or what can access organisational resources, SOC teams concentrate on monitoring suspicious activities, detecting threats and responding to security incidents.
However, both departments frequently operate with separate tools, information systems and priorities, creating gaps that can slow down investigations.
A compromised service account, for example, may trigger security alerts, but analysts still need to establish which applications and systems the account can access, whether an attacker could exploit its privileges to move deeper into the network and how much damage could result from the compromise.
Security teams must also determine whether disabling the affected account would interrupt important business operations.
The report noted that blocking the wrong identity could disrupt critical production processes, while delaying action could provide attackers with additional opportunities to move across an organisation‘s network.
The situation is becoming more complicated as organisations expand their use of non-human identities and autonomous AI agents.
Traditional cybersecurity monitoring systems were largely designed to track human users, devices and network activities. However, modern enterprise environments now include service accounts, API keys, automated workloads and AI agents capable of performing tasks without direct human supervision.
These identities may possess permissions to access sensitive information, applications and essential infrastructure.
Consequently, when one of them is compromised, security teams must go beyond identifying the suspicious activity. They also need to understand the identity’s privileges, connections and potential impact across the organisation.
The webinar announcement explained that incorporating identity intelligence into security investigations could help analysts connect suspicious activities to the identities responsible, establish the extent of their access and determine how far an attacker could potentially move.
It also highlighted several ways organisations could improve their security operations by combining identity intelligence with existing SIEM and EDR systems.
These include identifying whether a suspicious activity involves a human user, machine account or AI identity, understanding the permissions and connected systems associated with the identity, and detecting possible lateral movement by attackers.
The approach could also help security teams contain compromised credentials without unnecessarily disrupting critical automated processes.
Improved collaboration between IAM and SOC departments was identified as another important requirement, with shared workflows, clearly defined escalation procedures and coordinated incident response strategies expected to strengthen organisational security.
The discussion forms part of an upcoming expert-led webinar titled “Fuel the SOC with Identity Context: Securing Humans, Machines, and AI Agents.”
The session will examine how organisations can bridge the gap between identity management and security operations, drawing on practical experiences from enterprise deployments.
Participants are expected to learn how to enrich security alerts with identity information, investigate potential lateral movement, assess the possible damage associated with compromised accounts and improve incident response without disrupting production environments.
The webinar will also discuss how organisations can establish shared security metrics, escalation processes and response playbooks to improve coordination between their security and identity management teams.
According to the organisers, the objective is to help security professionals move beyond simply detecting suspicious activities to understanding the identities involved, the resources they can access and the potential consequences of an attack.
The central message is that detecting a cybersecurity threat is only one part of an effective defence strategy. Understanding the identity behind the activity and the level of access it possesses could make the difference between containing an incident quickly and allowing it to develop into a much larger security breach.