TL;DR: 96% of security leaders see critical visibility gaps, 77% report higher alert volume, and 67% still lack identity and access behavior visibility, even as 87% evaluate or deploy AI-powered SOC tools, according to Gurucul's 2025 Pulse of AI-Powered SOC Transformation report. AI can speed triage and investigation, but SOC modernisation fails if identity data remains a blind spot.
At a glance
What this is: This report shows that AI-powered SOC adoption is accelerating while identity and access visibility remains one of the biggest operational blind spots.
Why it matters: It matters because SOC teams cannot govern identity-driven threats, cloud activity, or access abuse if they still cannot see who is doing what across their environment.
By the numbers:
- 96% of respondents acknowledged critical blind spots, most notably in cloud infrastructure and identity and access behavior.
- 67% of organizations still lack visibility into identity and access behavior.
- 77% of organizations have seen an increase in alert volume.
- 87% of organizations have deployed, are deploying or are evaluating AI-powered SOC tools.
Context
The core governance gap in this report is not just alert overload. It is the mismatch between modern SOC automation and the poor quality of identity, entitlement, and access telemetry that feeds it. When the most exploited threat vector remains weakly monitored, faster tooling only accelerates decisions made on incomplete evidence.
In identity terms, this is a visibility problem across human and non-human activity, because access behaviour is now part of the detection surface. The report also shows that organisations are pushing AI into core SOC workflows while still struggling to ingest and correlate the data needed to make those workflows reliable.
Key questions
Q: How should security teams implement AI-driven SOC coverage without losing identity visibility?
A: Start by mapping every alert source the AI can actually see, then verify that identity provider logs, privilege changes, cloud authentication events, and workload telemetry are included. If those sources are missing, the SOC may automate triage while still missing the access paths attackers use most. Coverage should be measured by decision reach, not just by ticket volume.
Q: Why do identity-driven threats become harder to contain when SOC tools are fragmented?
A: Fragmented tooling slows correlation, especially when identity abuse moves across cloud, access, and investigation layers. If new data feeds take weeks to onboard, or analysts must jump across many consoles, the SOC loses the continuity needed to connect access misuse to downstream impact. The result is slower response and weaker confidence in decisions.
Q: What are the warning signs that AI SOC automation is becoming unsafe?
A: Look for actions taken without a linked case, approvals that happen after execution, investigation summaries that cannot be traced back to source evidence, and workflow changes that only one team member understands. Those signals show the SOC has moved from governed orchestration to opaque automation.
Q: What should teams do when AI adoption outpaces SOC visibility maturity?
A: Treat AI as an amplifier of existing governance, not a substitute for it. Before expanding agentic or automated workflows, teams should verify that the SOC can ingest identity data reliably, correlate it across cloud and access systems, and explain why an alert was prioritised over others.
Technical breakdown
Why identity telemetry is the missing layer in AI-powered SOCs
AI-powered SOCs improve throughput by correlating events, enriching alerts, and prioritising work, but those functions depend on clean identity context. Identity telemetry includes authentication activity, entitlement changes, role usage, and access behaviour across systems. When that context is missing, the SOC may detect that something happened but not whether the actor had a legitimate path to perform it. In practice, this weakens investigation quality and makes automation less trustworthy, because the model is optimising around incomplete behavioural evidence rather than authoritative identity state.
Practical implication: feed identity, entitlement, and access data into SOC workflows before expanding AI-driven automation.
Why alert volume and tooling sprawl slow identity-driven detection
The report links alert fatigue to tool sprawl, fragmented telemetry, and slow data onboarding. That combination matters because identity-based attacks often unfold across systems, where one signal alone is not enough. If a SIEM takes weeks to ingest a new feed, or if analysts must swivel across 20 or more tools, the SOC loses the continuity needed to connect access misuse to later impact. AI can compress triage, but it cannot compensate for broken telemetry pipelines and fragmented governance over the data sources themselves.
Practical implication: reduce data onboarding latency and consolidate the telemetry paths that carry identity signals into detection workflows.
How AI changes SOC operations without fixing the governance gap
AI is being used most successfully for alert triage, alert enrichment, false-positive suppression, and threat-intelligence correlation. That is useful, but it does not eliminate the underlying governance issue if access behaviour is still invisible. In other words, AI can process more of what the SOC already sees, but it cannot infer trustworthy identity context that was never captured. This is why the report’s results should be read as an execution story, not a control-completion story: operational speed improved faster than identity governance maturity.
Practical implication: treat AI as an accelerant for existing visibility, not as a substitute for identity governance.
NHI Mgmt Group analysis
Identity visibility is now a SOC control plane issue, not a logging issue. The report shows that AI adoption is rising while identity and access behaviour remain among the least visible parts of the environment. That means the SOC is modernising its processing layer without closing the governance gap in its input layer. Practitioners should treat identity telemetry as core detection infrastructure, not supplementary context.
AI-powered SOCs expose a visibility debt that conventional SIEM thinking never resolved. SIEM tuning assumes the telemetry exists and that analysts can stitch it together in time. The report shows that 96% of leaders still see critical blind spots, which means the real constraint is not only analysis speed but the completeness of the security data model. The practitioner conclusion is that AI amplifies whatever governance the SOC already has, good or bad.
Identity and access behavior is the named concept this report makes impossible to ignore. Once attackers move through valid accounts, cloud access, and entitlement misuse, event-based monitoring alone loses explanatory power. That is why SOC programmes need a behavioural identity layer that ties access, privilege, and usage together across human and non-human activity. The field is shifting toward identity-informed detection whether governance teams are ready or not.
Alert fatigue is a governance symptom, not just an operational nuisance. The report ties burnout to manual triage, fragmented tooling, and slow onboarding of new feeds. Those are control-plane symptoms of a SOC that cannot normalise data fast enough to support trusted automation. The practical conclusion is that response quality will remain inconsistent until identity-linked telemetry is governed as a first-class operational asset.
Trust in AI will remain limited until the SOC can explain identity-driven decisions. Only 9% of respondents are very confident in AI-generated alerts, which is unsurprising when the underlying identity picture is incomplete. Explainability matters, but so does provenance of the identity data that fed the decision. Practitioners should view trust as an outcome of governed inputs, not a feature toggle in the analyst console.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Identity visibility debt is the real constraint behind AI-powered SOC adoption. SOC teams are adding automation faster than they are fixing the quality of the identity data those automations depend on. That means the next governance milestone is not simply more AI, but better control over entitlement, access, and behavioural telemetry across the detection stack.
5.7% of organisations have full visibility into their service accounts. That figure, from the Ultimate Guide to NHIs, captures why identity-driven detection remains fragile even in mature security teams. Service accounts and related machine identities now participate in the same operational environment as human users, so SOC programmes that cannot see them cannot govern them effectively.
For practitioners
- Prioritise identity telemetry ingestion Bring identity, entitlement, and access behaviour data into SOC pipelines before broadening AI use cases, so prioritisation and enrichment have reliable context.
- Reduce telemetry fragmentation Map which sources are delayed, duplicated, or absent across SIEM, cloud, and identity workflows, then remove the handoffs that force analysts to reconstruct the same event chain in multiple tools.
- Use AI first for high-volume triage Apply automation to alert triage, enrichment, and false-positive suppression before trusting AI with higher-risk decision paths, because those are the areas where adoption has already shown the strongest operational gain.
- Measure identity visibility as a SOC control Track whether analysts can answer who accessed what, under which entitlement, and from which system without manual data hunting, because that is the operational test that matters here.
Key takeaways
- AI-powered SOC programmes do not solve the visibility problem if identity and access behaviour remain under-monitored.
- The report shows that alert growth, tool sprawl, and delayed data onboarding are directly slowing investigation and response.
- Practitioners should treat identity telemetry as a prerequisite for trustworthy automation, not as an optional enhancement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Identity visibility gaps matter most where machine and service accounts carry unseen access scope. |
| NHI-10 — Human Use of NHI | The report's identity blind spots affect both human and non-human access paths inside SOC workflows. | |
| Recommendation — Audit non-human access scope and remove overprivilege that SOC telemetry cannot currently explain. Separate human and non-human activity in detection logic so analysts can attribute access correctly. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on missing visibility into entitlements and access behaviour. |
| DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | The report is fundamentally about monitoring gaps that weaken detection and response. | |
| Recommendation — Map identity telemetry gaps against PR.AA-05 and verify that authorisation data is observable in the SOC. Extend monitoring coverage to identity activity so detection is not limited to network and endpoint signals. | ||
| MITRE ATT&CK | TA0001;TA0006;TA0008 — Initial Access; Credential Access; Lateral Movement | The article highlights phishing, identity threats, and the movement patterns SOCs must detect. |
| Recommendation — Map identity-driven attack paths to TA0001, TA0006, and TA0008 when tuning detection logic. | ||
Key terms
- Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.
- Identity Visibility: Identity visibility is the ability to see which identities exist, what they can access, and how those access paths relate across systems. In NHI programmes, it means correlating service accounts, tokens, certificates, and agents into one operational view so governance decisions are based on evidence, not assumptions.
- Alert Fatigue: Alert fatigue is the condition where a security team receives so many low-value alerts that important events become harder to notice. In monitoring programs, it usually signals poor rule tuning, weak prioritisation, or a mismatch between detection logic and operational reality.
- Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org