AI SOC investigations need full context, not more tab switching

At a glance

What this is: This is a Panther blog post arguing that AI-assisted SOC investigations improve when analysts can access live context from multiple systems inside one workflow.

Why it matters: It matters because SOC teams, IAM teams, and identity owners need investigations that connect authentication, privilege, and incident context without forcing analysts to stitch it together manually.

By the numbers:

• By the time analysts assemble enough context to make a call, 20 to 30 minutes have passed on a routine alert.
• Infoblox saw 50% faster alert triage and investigation after using Panther AI.
• At HealthEquity, mean time to triage dropped from 30 to 45 minutes to under 5 minutes for Tier 1 and Tier 2 alerts.
• Tealium grew its monitored log sources by nearly 30% after getting Panther's AI into its workflow.

👉 Read Panther's analysis of AI SOC investigations with full context

Context

AI SOC investigation suffers when analysts must reconstruct context by moving between identity, ticketing, endpoint, and documentation systems. In practice, the bottleneck is not detection alone but the time it takes to understand whether an alert is real, what related activity exists, and which identity signals matter. For IAM and SOC teams, that creates a direct link between investigation quality and the availability of current identity context inside the tool.

Panther's argument is that investigation work changes when the platform can query live sources such as Okta, GitHub, PagerDuty, and runbooks during the alert itself. That is relevant to identity governance because authentication history, MFA state, group membership, and open incidents are often the evidence that determines whether access is benign or suspicious. The typical manual workflow is common, not exceptional, across many security operations teams.

Key questions

Q: How should security teams reduce context switching in AI SOC investigations?

A: Security teams should expose the systems analysts already use for identity, incident, and code context inside the investigation workflow. The goal is not just fewer tabs, but faster access to live evidence such as authentication history, open incidents, and runbook guidance. If analysts still have to reconstruct the story manually, the AI has not solved the real problem.

Q: Why do identity signals matter so much in alert triage?

A: Identity signals often determine whether an alert is ordinary or dangerous. A login failure, privilege change, or token use can look harmless until it is joined with recent access changes, asset importance, and known account behaviour. Without that context, triage becomes guesswork rather than governance.

Q: What breaks when investigation knowledge lives only in analysts' heads?

A: The same alert can receive different treatment depending on who is on shift, how familiar they are with the environment, and whether they know which sources to check. That creates inconsistent triage, weaker handoffs, and slower escalation. Encoding that knowledge into runbooks and profiles makes the investigation process repeatable.

Q: How should teams govern AI systems that query identity and incident tools?

A: Teams should treat those integrations as part of the control surface, not just a convenience feature. Access should be least-privilege, auditable, and limited to approved investigative queries. Governance also needs to cover what the AI can see, what it can do, and how its reasoning is preserved for review.

Technical breakdown

Why context fragmentation slows AI SOC investigations

Context fragmentation happens when the evidence needed to resolve an alert is distributed across multiple tools and tribal knowledge. Analysts have to pivot from an alert into identity systems, cloud logs, ticketing platforms, and documentation before they can decide whether the event is benign. That slows triage, but it also creates inconsistent outcomes because different analysts know different shortcuts. AI can reduce that friction only if it can query the same sources a senior analyst would, in real time, rather than relying on the original alert payload alone.

Practical implication: build investigation paths that expose live identity, ticketing, and cloud evidence in one place.

How MCP changes the investigation model for identity context

Model Context Protocol, or MCP, lets an AI system connect to external tools in a structured way so it can retrieve live context during an investigation. In security operations, that means the AI can pull identity history from Okta, incident state from PagerDuty, code activity from GitHub, and documentation from knowledge bases without copying data into a separate environment. The architectural shift is important: the AI is not just summarising an alert, it is assembling evidence across systems and preserving reasoning in the same thread.

Practical implication: connect only the systems that hold decision-grade evidence and define which queries the AI is allowed to run.

Why investigation quality depends on encoded runbooks and profiles

Organization profiles and detection runbooks turn institutional knowledge into machine-readable guidance. Without that layer, an AI can retrieve context but still miss how your team defines normal behaviour, sensitive assets, or alert-specific escalation criteria. With it, the same investigation can apply the same standards regardless of who is on shift, which reduces variance between senior and junior analysts. This is where identity and SOC governance intersect most directly: the quality of alert handling depends on whether the rules for interpreting identity and access signals are explicit in the system.

Practical implication: codify alert-specific identity criteria in runbooks before you expect AI to triage consistently.

NHI Mgmt Group analysis

Context-aware SOC automation is becoming an identity governance problem as much as an operations problem. Once an investigation engine can query authentication history, group membership, incident state, and code activity in one workflow, the question is no longer just speed. The real issue is whether identity evidence is trusted, current, and sufficiently scoped for machine-led decision support. Practitioners should treat AI investigation design as a control plane for evidence, not a convenience layer.

Investigation quality now depends on whether identity signals are operationalised inside the SOC workflow. A ticket that lacks current MFA status, recent login history, or incident linkage forces the analyst back into manual reconstruction. That is a governance failure because access and authentication evidence is available in the environment but not made decision-ready. Teams should measure whether their alert triage process still requires human context assembly as a default.

Full-stack context reduces the variance introduced by analyst experience, which is the hidden risk in many SOC programmes. Senior analysts often compensate for missing tooling by knowing where to look, while junior analysts surface weaker evidence and slower decisions. When that knowledge is embedded into runbooks and profiles, the programme becomes less dependent on individual memory. The practical conclusion is that AI triage should be judged on consistency as well as speed.

Named concept: context fragmentation. This post describes the gap between the evidence security teams need and the evidence their tools expose at decision time. In identity-heavy investigations, fragmentation creates longer triage cycles, weaker handoffs, and inconsistent conclusions across shifts. Practitioners should treat context fragmentation as a measurable control gap, not an efficiency complaint.

MCP makes the SOC more dependent on identity-adjacent integrations, so governance must expand accordingly. Once the AI can reach into Okta, PagerDuty, GitHub, and documentation systems, those integrations become part of the investigative control surface. That means access scoping, auditability, and response traceability matter as much as alert content itself. Teams should govern the integration layer with the same care they apply to privileged access.

What this signals

Context fragmentation will increasingly be measured as an identity governance weakness, not just a SOC inconvenience. If alert triage still depends on people stitching together authentication, incident, and documentation evidence by hand, the programme is carrying avoidable decision latency. For teams aligning to NIST SP 800-53 Rev 5 Security and Privacy Controls, the practical lesson is to make identity evidence queryable at the point of investigation rather than after escalation.

Identity-heavy investigations are moving toward evidence orchestration, where the quality of the response depends on the quality of the integration layer. That means access to systems like Okta, incident platforms, and documentation stores should be governed as carefully as privileged administrative access. As a concept, context fragmentation describes the gap between what the analyst needs to know and what the platform can surface in time. The more that gap narrows, the more consistent the SOC becomes across shifts and experience levels.

For practitioners

• Map investigation-critical identity sources Identify which systems provide decision-grade context for alert triage, including authentication logs, group membership, incident records, and runbooks. Prioritise the sources analysts already use during manual investigations so the AI can mirror established practice, not invent a new one.
• Codify alert-specific runbooks and profiles Convert environment knowledge into detection runbooks and organization profiles that define normal behaviour, sensitive assets, and escalation criteria. This reduces the risk that two analysts will reach different conclusions from the same evidence.
• Limit MCP access to approved investigative queries Restrict which systems the AI can query and document the purpose of each integration. Live access to identity and incident systems should be auditable, least-privilege, and tied to specific investigation use cases.
• Measure triage consistency, not only triage speed Track how often analysts reach the same conclusion for the same alert type across shifts and experience levels. Pair that with time-to-triage so you can see whether automation is improving decision quality as well as reducing effort.
• Use identity context to close the loop on alert response When a suspicious login or access pattern appears, make sure the investigation flow can connect identity evidence to the response action without manual handoff. That is where enriched investigations become operationally useful.

Key takeaways

• AI SOC investigations improve when the platform can surface identity, incident, and documentation context without forcing analysts to switch tools.
• The core risk is context fragmentation, which turns alert triage into a manual reconstruction exercise and makes outcomes depend on who is on shift.
• Teams should govern investigation integrations, codify runbooks, and measure consistency as closely as they measure triage speed.

Key terms

• Visibility Fragmentation: Visibility fragmentation is the condition where security telemetry exists, but only inside separate provider consoles or tools. In multi-cloud estates, it prevents teams from correlating one provider’s event with another’s and leaves lateral movement or drift hidden in plain sight.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Organizational Profile: A scoped view of cybersecurity outcomes for a business unit, system, or enterprise, showing current and target posture. It becomes useful when based on real control evidence, not generic policy language. In identity programmes, Profiles should reflect actual entitlements, sessions, and account scope.
• Detection Runbook: A detection runbook is a documented decision path that tells analysts how to evaluate a specific alert type. When encoded well, it turns informal team knowledge into repeatable investigation steps and reduces variation when AI or junior analysts handle the alert.

What's in the full article

Panther's full blog post covers the operational detail this post intentionally leaves for the source:

• Live examples of how Panther queries Okta, PagerDuty, GitHub, and documentation systems during a single investigation
• Customer-reported workflow outcomes and implementation context behind faster triage and broader log-source coverage
• How natural language investigation behaves inside open alerts, threat hunts, and detection-building workflows
• Examples of scheduled runs for IAM checks, false-positive analysis, and post-termination monitoring

👉 Panther's full post covers the MCP workflow, live identity lookups, and investigation examples in detail

Deepen your knowledge

NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to operational security programmes that depend on them.