They miss abuse that happens through legitimate identities, because endpoint and network telemetry can look normal while access is being misused. Identity threats often show up in authentication context, privilege use, and session behaviour, so the detection model has to include identity signals. Without that layer, the SOC sees activity but not the control-plane misuse behind it.
Why EDR and NDR Miss Identity Abuse
EDR and NDR are excellent at telling you what happened on an endpoint or across the network, but identity abuse often happens inside normal-looking sessions. When an attacker or insider uses valid credentials, the telemetry can resemble routine work, so the real question becomes whether the access was legitimate, expected, and appropriately privileged.
This is where identity context changes the detection model. Authentication events, privilege changes, token use, and session behaviour can reveal misuse that endpoint and network tools cannot attribute on their own. A SOC that stops at host and packet evidence may see activity, but not the control-plane decision behind it.
That gap is why Identity Threat Detection and Response (ITDR) matters as a complement to EDR and NDR. It focuses the analyst on identity-native signals such as authentication anomalies, privilege abuse, and suspicious session patterns that often define the compromise more clearly than the endpoint event trail.
What Breaks in the SOC Detection Model
The first thing that breaks is attribution. EDR and NDR can show a process launch, a connection, or a data transfer, but those observations do not always answer who had authority to do it, whether the access path was expected, or whether the action exceeded normal privilege.
The second break is detection depth. Identity threats frequently use valid accounts, delegated access, token replay, or unusual but permitted sessions, which means the activity may not trip classic malicious-code or known-bad-network indicators. If the SOC has no identity layer, it can miss the difference between normal execution and abuse of legitimate access.
That is also why the definition of non-human identities is useful here: many identity threats involve service accounts, API keys, tokens, and workload identities rather than human logins. Those identities often behave differently from people, so the detection logic has to account for lifecycle, purpose, and privilege rather than just endpoint activity.
The third break is response quality. If the SOC cannot distinguish identity misuse from ordinary technical activity, it may isolate the wrong device, block the wrong connection, or miss the real blast radius. In practice, the investigation needs identity ownership, auth history, and privilege context before it can decide whether the incident is a credential issue, a session issue, or a broader account compromise.
How to Rebuild Detection Around Identity Signals
A useful detection model starts by treating identity telemetry as a first-class source, not an enrichment afterthought. That means correlating authentication events, role changes, token issuance, admin actions, and session behaviour with endpoint and network alerts so the SOC can ask whether the access itself was suspicious.
It also means making identity hygiene observable. NHI lifecycle management is especially relevant because stale, overprivileged, or poorly inventoried identities create the exact conditions where misuse blends into normal operations. If ownership, rotation, offboarding, and access review are weak, the SOC has less context to separate expected activity from abuse.
For threat-led teams, it helps to align monitoring with attack patterns that use valid accounts, stolen sessions, or privilege escalation rather than only malware. MITRE ATLAS adversarial AI threat matrix is useful for AI-related abuse patterns, while broader identity-centric threat modelling should look for valid-account misuse, token theft, lateral movement, and privilege escalation paths that do not depend on obvious endpoint compromise.
Risk and Threat Considerations
When a SOC relies on EDR and NDR alone, the main risk is silent control-plane abuse: the activity looks operationally normal while the identity behind it is compromised, overprivileged, or misused. That creates delayed detection, weak scoping, and a higher chance that the attacker keeps operating under legitimate access.
Failure mechanism: The defender is watching device and network behaviour, but the attacker is abusing valid identity context, so the malicious action inherits trusted telemetry and blends in with routine admin or application activity.
Impact: The SOC can miss account takeover, privileged misuse, session hijack, or non-human identity abuse until the intruder has already moved laterally, exfiltrated data, or changed access state.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Identity abuse is found by correlating auth and session evidence with host and network telemetry. |
| IA-9 — Service Identification and Authentication | Valid non-human credentials can drive the identity abuse this question is about. | |
| AC-6 — Least Privilege | Overprivilege is a core reason identity abuse bypasses EDR and NDR. | |
| Recommendation — Correlate authentication, privilege, and session events to surface misuse hidden by normal endpoint activity. Enforce strong service authentication and monitor for anomalous token or workload use. Reduce standing privilege so valid-account abuse has less room to move laterally. | ||
| NIST CSF 2.0 | DE.CM-03 — Detection Processes | The question is about what detection coverage is missing when identity signals are absent. |
| Recommendation — Add identity telemetry to detection processes so misuse is visible beyond endpoint and network alerts. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Valid-account abuse is the core technique behind identity threats that look normal to EDR/NDR. |
| Recommendation — Hunt for valid-account abuse, especially unusual privilege use and session behavior. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Overprivileged non-human identities are a common identity-threat condition in SOC blind spots. |
| NHI-07 — Long-Lived Secrets | Long-lived credentials make identity misuse harder to distinguish from routine use. | |
| Recommendation — Inventory and trim excessive NHI privilege before relying on telemetry to catch misuse. Shorten secret lifetimes and rotate exposed credentials to reduce silent abuse windows. | ||
Practitioner Guidance
What to verify: Confirm that each high-value alert can be tied back to an authenticated identity, not just a host or IP address. If the team cannot answer who authenticated, what privilege they had, and whether the session was expected, the detection model is incomplete.
What good looks like: A mature SOC correlates EDR and NDR with identity events so an analyst can see the same incident through access, privilege, and session context. That does not replace endpoint and network telemetry, but it prevents those feeds from becoming blind to legitimate-access abuse.
Practitioner takeaway: The key shift is from detecting suspicious activity to detecting suspicious authority, because identity abuse often preserves normal-looking infrastructure signals while corrupting the access decision itself.
Related resources from NHI Mgmt Group
- What breaks when SOC teams rely on SIEM alone for identity abuse detection?
- What breaks when teams rely only on SOC alerts to spot threats in software delivery?
- What breaks when SOC teams rely only on SIEM, EDR, XDR, or SOAR for investigations?
- What breaks when cloud security teams rely on SIEM, EDR, or NDR alone to stop internal attacks?