A SecOps operating model that assigns clear roles to different tools and teams, then connects them through shared data and coordinated decision-making. The goal is to create a unified response capability instead of isolated detections, manual handoffs, and duplicated effort.
Expanded Definition
Combined Arms Security Operations describes a security operating model in which detection, triage, containment, investigation, and recovery are deliberately distributed across multiple tools and teams, then coordinated through shared telemetry and decision rules. Rather than treating SIEM, XDR, SOAR, EDR, identity platforms, and human analysts as separate layers, the model uses each for the stage where it adds the most value. That makes it different from simple tool integration, which only forwards alerts, and from fully centralised operations, which can create bottlenecks and blind spots.
The concept is still evolving across the industry, so definitions vary across vendors and practitioners. At NHI Management Group, the most useful interpretation is operational: the point is not to own every action in one console, but to ensure every response step has a clear owner, a reliable handoff, and a shared source of truth. That aligns closely with the intent of the NIST Cybersecurity Framework 2.0, which emphasises coordinated governance and outcome-based security practice.
The most common misapplication is calling a loosely connected tool stack “combined arms” when alerts still bounce between teams with no agreed decision path or escalation threshold.
Examples and Use Cases
Implementing combined arms security operations rigorously often introduces coordination overhead, requiring organisations to weigh faster, more reliable response against the cost of clearer process design, data normalisation, and role discipline.
- A SIEM correlates identity anomalies, while EDR contains the endpoint and an analyst validates whether the event is a true compromise or a benign change.
- A SOAR playbook enriches an alert with threat intelligence, then routes the case to the right responder based on asset criticality and business impact.
- An identity team revokes suspicious sessions and resets access paths while cloud defenders isolate the workload that was using the compromised credential.
- In NHI-heavy environments, a secrets platform detects abnormal token use, and an application owner rotates the credential while security confirms blast radius and persistence risk.
- In agentic AI deployments, an operations team limits tool access for an autonomous agent while monitoring for unsafe actions through logging and policy enforcement.
For organisations building around identity and machine access, the model often benefits from guidance in OWASP Non-Human Identity guidance because compromise paths often move through service accounts, API keys, and automation tokens rather than interactive logins.
Why It Matters for Security Teams
Security teams need this model because modern incidents rarely stay inside one control domain. An intrusion may begin with a stolen credential, move through cloud control planes, trigger endpoint activity, and culminate in data access or agent misuse. If those signals are owned by separate teams with no shared playbook, containment slows and root cause analysis becomes fragmented. Combined arms thinking reduces that friction by assigning each layer a role that matches its strength: machines detect, automate, and enrich; humans interpret context, make exception decisions, and manage business tradeoffs.
This is especially important where NHI and agentic AI are involved, because non-interactive identities and autonomous software can continue acting after a compromise unless access paths are quickly understood and revoked. The model also supports zero trust and least privilege by making response decisions depend on verified context rather than assumptions about trust. For a broader governance lens, NIST Cybersecurity Framework 2.0 remains a useful anchor for coordinated outcomes across detection, response, and recovery.
Organisations typically encounter the full cost of poor coordination only after a real incident exposes gaps between telemetry, authority, and action, at which point combined arms security operations becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | RS.RP-1 | Response planning fits coordinated, multi-team security operations. |
| OWASP Non-Human Identity Top 10 | NHI guidance addresses the identity and secret paths often central to this operating model. | |
| OWASP Agentic AI Top 10 | Agentic AI security covers autonomous software actions that require coordinated containment. | |
| NIST Zero Trust (SP 800-207) | Zero Trust requires coordinated decisions based on context, not implicit trust boundaries. | |
| NIST AI RMF | AI RMF supports governance around autonomous and AI-assisted security operations. |
Treat service accounts, tokens, and API keys as first-class response targets with clear ownership.
Related resources from NHI Mgmt Group
- How should NHS security teams reduce privileged access risk without disrupting clinical operations?
- How should security teams reduce AWS data security risk without slowing cloud operations?
- What is the difference between advisory AI and agentic AI in security operations?
- How should security teams phase out password-based authentication without disrupting operations?
