AI security needs context to turn agent signals into investigations

At a glance

What this is: This is Zenity’s analysis of why AI security investigations fail without correlated context, and why combining posture, runtime, identity, and graph data changes what analysts can see.

Why it matters: IAM, NHI, and AI security teams need this because isolated alerts hide attack paths, delay triage, and make it harder to separate benign agent activity from real compromise.

Context

AI security investigations become difficult when posture findings, runtime anomalies, identity relationships, and graph data are treated as separate alerts instead of one operational picture. In AI environments, signals arrive quickly and often look similar at first glance, which makes context essential for deciding whether an event is harmless noise or the start of an incident.

Zenity’s article argues that the gap is not data scarcity but data unconnected to meaning. For identity programmes, that matters because agent behaviour, authorization scope, and environment relationships are all part of the same investigation path. Without that correlation layer, teams spend their time reconstructing intent from fragments.

The practical issue is not only detection volume. It is the speed at which AI-driven actions can compound across systems, turning a small configuration issue into a multi-stage investigation before analysts have enough context to respond.

Key questions

Q: What breaks when AI security signals are not correlated?

A: Investigations break down because analysts cannot tell whether a finding is isolated noise or part of a longer attack path. Without context across posture, runtime, identity, and graph data, teams spend their time reconstructing events instead of deciding on containment or response.

Q: Why do AI agent alerts need context before escalation?

A: Because the same alert can represent a harmless runtime anomaly, a configuration issue, or the first stage of manipulation. Context shows whether the signal belongs to a broader chain of decisions, which is what determines priority and response.

Q: How should security teams detect risky AI agent behaviour in production?

A: Security teams should detect risky AI agent behaviour by monitoring runtime decisions, tool selection, action sequences, and deviations from the approved use case. Authentication alone is not enough. The useful signal is whether the agent is still acting within the behavioural envelope defined by its purpose and ownership model, especially when it operates across multiple systems.

Q: What is the difference between isolated alerts and correlated AI incidents?

A: Isolated alerts describe single events, while correlated AI incidents connect those events into a sequence with root cause, affected entities, and likely intent. The practical difference is whether the team is reading notifications or investigating an attack path.

Technical breakdown

Why uncorrelated agent signals look identical

AI security tools can surface posture findings, runtime anomalies, identity relationships, and graph events, but those signals rarely explain each other on their own. A warning about configuration drift, for example, may be benign in isolation yet become meaningful when linked to a prompt sequence, a permission change, or a downstream system action. The technical problem is not that the telemetry is absent. It is that the telemetry lacks a shared causal thread. In practice, this forces analysts to infer intent manually across multiple consoles and event types, which slows triage and increases false positives.

Practical implication: correlate agent telemetry before analysts start case work, or every signal will be treated as a separate investigation.

How Issues converts fragments into an incident narrative

Zenity describes Issues as a way to assemble posture findings, runtime anomalies, identity relationships, graph insights, root cause, involved entities, attack path, and sequence of events into one narrative. That is important because investigations do not fail only at alerting. They fail when evidence is not assembled into a path that shows what happened first, what changed next, and which systems were affected. A correlated incident record reduces the need to rebuild chronology by hand and lets teams focus on whether the event is exploitable, contained, or already impacting business systems.

Practical implication: design your investigation workflow around incident narratives, not individual detections.

Why intent detection is the hard part in AI security

The article’s Correlation Agent is aimed at something traditional detections struggle to express: intent. In AI environments, the same output pattern can reflect routine behaviour, misconfiguration, or manipulation attempts, and the difference often depends on surrounding context. Runtime data alone may show what occurred, but not why it happened or whether the agent was being steered. Correlation across prompts, actions, identities, and affected assets is what makes intent visible enough to investigate. Without that layer, analysts are left interpreting behaviour after the fact instead of seeing the attack narrative as it unfolds.

Practical implication: treat intent as an investigable outcome of context correlation, not as something a single alert can prove.

Threat narrative

Attacker objective: The objective is to move from an isolated AI signal to a broader attack path that can hide manipulation, exposure, or exfiltration behind routine-looking activity.

1. Entry begins with a prompt or misconfigured connection that starts activity across the AI environment, even when the first signal appears minor.
2. Escalation occurs when runtime anomalies, identity relationships, and graph-linked actions reveal that the initial event is part of a broader path rather than a single alert.
3. Impact follows when the attack path is visible only after multiple systems have already been touched, making manual reconstruction slower than the threat movement.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI security now fails at correlation before it fails at detection: The problem is not the absence of alerts but the absence of shared meaning across alerts. When posture, runtime, identity, and graph data are siloed, analysts are forced into manual reconstruction instead of directed investigation. The practical conclusion is that investigation quality now depends on relationship context, not event count.

Context is the control plane for AI investigations: In AI environments, severity labels move too slowly to be sufficient because the same signal can mean very different things depending on surrounding actions and identity relationships. A context layer changes security from notification triage to path analysis. That shifts the practitioner’s job from reviewing isolated findings to validating a coherent attack narrative.

Agent behaviour creates a new investigation problem that classic SIEM logic cannot solve alone: The article shows that AI systems can generate chains of decisions across environments, which means the analyst needs a narrative of sequence, not just a stack of logs. Runtime context collapse: when the relevant evidence is distributed across prompts, identities, and graph edges, the investigation boundary is no longer the alert. The implication is that teams must treat correlation as a first-class operating model for AI security.

Intent is becoming a security artefact: Security teams increasingly need to know not only what an agent did, but what pattern of action it was following. That is a different governance problem from traditional event review because the risky unit is the sequence, not the single event. Practitioners should expect AI security programmes to measure narrative fidelity, not just detection coverage.

AI security will increasingly converge on identity-linked investigations: When agent actions are tied to identity relationships and graph context, the distinction between posture management and incident response narrows. That does not mean every signal is a breach. It does mean the programme that can explain relationships fastest will outpace the programme that merely collects more telemetry. The field is moving toward investigation readiness as a core control objective.

From our research library:

• 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Correlation is becoming the decisive control for AI security operations: Teams that cannot connect posture, runtime, identity, and graph data will continue to over-invest in alert handling and under-invest in understanding how AI-driven activity unfolds. The operational shift is from chasing anomalies to proving whether a sequence of actions forms an incident.

Identity context now matters inside AI investigations, not just at provisioning time: When agent identities, permissions, and connected assets are visible in the same case, analysts can separate misconfiguration from manipulation much faster. That changes the programme from reactive detection to evidence-based response planning.

More embedded AI agents increase the need for contextual investigation, not less: According to KPMG's 2026 report cited in the research box, 88% of organisations have embedded AI agents in their workflows. That level of adoption makes correlation and narrative-based investigation a core operating requirement, not an advanced feature.

For practitioners

• Correlate posture, runtime, identity, and graph data Build investigation workflows that join posture findings, runtime anomalies, identity relationships, and graph context into one case record so analysts stop stitching evidence together by hand.
• Redesign triage around attack narratives Prioritise case handling based on how events relate over time, not on which alert appears loudest, so prompt-driven chains and exposure paths surface as one incident.
• Track intent as part of investigation Add review steps that ask what the agent was likely doing, what changed in the surrounding context, and which downstream systems were touched before a conclusion is reached.
• Map identity relationships into your case management Link agent identities, permissions, and connected assets inside the investigation view so analysts can see whether a misconfiguration created an actual exposure path.

Key takeaways

• AI security programmes fail when they treat posture findings, runtime alerts, and identity relationships as separate problems instead of one investigative picture.
• The article argues that correlated context helps analysts see attack paths, root cause, and sequence of events before they spend cycles reconstructing them manually.
• For practitioners, the priority is to build investigation workflows that join signals into narratives so response decisions can happen faster and with more confidence.

Key terms

• Context correlation: Context correlation is the practice of joining related security signals so they explain one another. In AI security, it links posture findings, runtime behaviour, identity relationships, and graph data to reveal whether activity is routine, misconfigured, or part of an attack narrative.
• Investigation narrative: An investigation narrative is the ordered explanation of what happened, which identities were involved, and how risk progressed. It turns fragmented telemetry into a decision-ready case that analysts can validate, escalate, or close with confidence.
• Runtime anomaly: A runtime anomaly is behavior that deviates from expected execution patterns while a system is active. For AI agents, the anomaly may be subtle on its own, but when placed in context it can indicate manipulation, misuse, or the start of a broader attack sequence.
• Identity relationships: Identity relationships are the connections that define which accounts, tokens, agents, systems, and permissions interact with each other. They matter because risk often emerges from the path between identities, not from any single event seen in isolation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.