TL;DR: More than 40% of security alerts go uninvestigated, according to Query, because analysts and AI tools still spend most of their time reconciling fragmented data across many consoles and inconsistent schemas. Normalization and access to complete context determine whether AI investigations produce reliable findings or confident mistakes.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Query's blog post: AI SOC teams are constrained less by model capability than by fragmented data, inconsistent schemas and incomplete context.
Why it matters: SOC and identity practitioners need to treat data normalization, access and completeness as core controls if they want AI-assisted investigations to be reliable.
By the numbers:
- More than 40% of security alerts go uninvestigated, according to Query.
Context
Security operations becomes harder when the evidence needed to explain an alert is scattered across systems that do not share a common data model. When analysts and AI tools must pivot through identity, endpoint, cloud and network platforms to reconstruct one event, investigation cost rises and confidence falls. Initial Access Techniques Guide
AI-assisted investigation also depends on semantic consistency, not just connectivity. If the same user or IP appears under different field names across platforms, an agent may resolve those fields probabilistically and produce a coherent but wrong answer.
That pattern is now typical in modern SOC environments, not an edge case, because the tooling stack has grown faster than the data layer underneath it.
Key questions
Q: How do I normalize SOC data for AI investigation workflows?
A: Normalize SOC data by mapping alerts, logs, cases, and enrichment into a common schema with consistent timestamps, entity identifiers, event types, and severity fields. Use parsers, field dictionaries, and deduplication rules so AI investigation workflows can correlate endpoints, identities, and network activity without mismatched labels or duplicate records.
Q: Why do fragmented logs make AI security tools less reliable?
A: AI systems depend on structured, correlated data. If logs use different schemas, stale asset records, and inconsistent identity fields, the system may correlate the wrong entities or miss the attack path entirely. That creates false confidence, because the output looks analytical while the underlying evidence is incomplete. Data quality is therefore a prerequisite for trustworthy SOC automation.
Q: What is the difference between SIEM data and investigation data?
A: SIEM data is the raw or semi-processed security telemetry collected for detection and alerting, such as logs, events, and alerts. Investigation data is the curated subset prepared for case work, with normalised fields, entity context, enrichment, and provenance so analysts or AI can trace a hypothesis across sources.
Q: What happens when AI agents infer identity fields incorrectly?
A: Incorrectly inferred identity fields can cause an agent to act on the wrong person, service account, or device, which can misroute approvals, overextend access, or block the real owner from essential actions. Controls include strict schema validation, confidence thresholds, human review for ambiguous matches, and revocation of the agent’s delegated access when errors repeat.
Technical breakdown
Why alert investigation becomes expensive across separate consoles
Alert handling slows down when each stage of an investigation lives in a different platform. Endpoint telemetry, identity logs, cloud records and network evidence often use different field names, timestamps and entity models, so the analyst spends time translating data before any judgment can happen. AI does not remove that work if the underlying sources remain disconnected. It only accelerates the part that follows access, which means fragmented data still sets the ceiling on investigation speed.
Practical implication: Model the investigation path as a data workflow, not a console workflow, and reduce the number of manual pivots required to resolve one alert.
How schema mismatch breaks AI reasoning in SOC workflows
Schema mismatch is not just an integration annoyance. When the same identity or IP address appears as different field names in different systems, an AI agent must infer equivalence before it can correlate events. That inference is probabilistic unless the data layer normalizes the fields first. Research on inconsistent inputs shows that models can still answer confidently even when the mapping is wrong, which creates a quiet reliability problem in security operations.
Practical implication: Normalize identity, device and address fields before routing them to AI workflows so correlation happens on deterministic mappings, not best guesses.
Why completeness matters more than dashboard coverage
A SIEM only improves investigation quality when it contains the context needed to prove or disprove an alert. Data that exists elsewhere but is not available at investigation time behaves like missing evidence, even if it is visible in another tool. That creates blind spots in both human-led and AI-assisted triage. In practice, completeness is the difference between a threat being explainable and a threat being treated as noise. See the AI SOC Guide.
Practical implication: Prioritise data coverage for high-value identity and endpoint events before expanding detection content or adding more automation layers.
Threat narrative
Attacker objective: The attacker aims to move faster from initial access to lateral movement while defenders are slowed by fragmented context and unreliable correlation.
- Entry begins with reconnaissance and initial access acceleration supported by AI-generated phishing, which increases the volume and realism of first-contact attempts.
- Escalation and lateral movement then benefit when defenders cannot rapidly correlate identity, endpoint and cloud context across fragmented data sources.
- Impact appears as missed or delayed investigations, where real threats are misread as benign activity because the analysis layer had to guess at inconsistent fields.
Breaches seen in the wild
- Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Data normalization is now an investigation control, not an engineering preference. AI-assisted SOC work depends on a shared semantic layer for users, devices, IPs and event time. Without that layer, the system can produce fluent answers that are operationally unreliable, which makes normalization a governance issue as much as a technical one.
The real SOC bottleneck is context access, not model intelligence. Security teams keep buying better analysis tools, but the limiting factor remains whether the right context is reachable at decision time. The organisation that can assemble complete evidence fastest will outperform the organisation with the most capable model but the weakest data estate.
Security operations now needs a named discipline: investigation data architecture. That concept captures the idea that detection quality, triage speed and AI reliability all depend on how security data is modeled, governed and exposed. Practitioners should treat this as a foundational operating capability, not a convenience layer.
Identity data is the bridge where this problem becomes visible first. Authentication records are among the hardest signals to correlate because they move across identity providers, endpoint tools and cloud logs with different field conventions. That is why lateral movement visibility depends on more than one product view; it depends on coherent identity data.
AI does not forgive incomplete telemetry. When a beacon or suspicious authentication event never reaches the investigation layer, the absence can look like normal behaviour. Security leaders should assume that any automation built on partial data will understate risk, and they should measure completeness with the same seriousness they apply to detection coverage.
What this signals
Investigation data architecture will become a procurement criterion. Security teams will increasingly judge SOC platforms by how well they expose normalized, queryable evidence across identity, endpoint and cloud sources. The buying question shifts from how much the tool can automate to how reliably it can reason over complete context.
AI adoption will expose data quality debt faster than rule-based tooling did. Traditional alerting could tolerate some inconsistency because humans patched the gaps during triage. Agentic investigation will not be as forgiving, so organisations with weak data models will see their automation ceiling much sooner.
Security leaders should expect the next wave of SOC maturity conversations to focus on completeness, schema consistency and data access latency rather than on model selection. The programmes that prepare for that shift will be the ones that can prove both detection coverage and evidence quality.
For practitioners
- Build a normalized security data model Define canonical entities for users, devices, IPs, sessions and alerts so investigations do not depend on ad hoc field mapping at query time.
- Reduce manual pivots across investigation tools Measure how many system switches, logins and lookups are required to resolve a single alert, then remove the highest-friction pivots first.
- Prioritise high-value identity and endpoint feeds Ensure the identity provider, endpoint platform and cloud logs that most often establish first access are available in the investigation layer without delay.
- Validate AI outputs against ground truth Test whether the investigation layer reaches the same conclusion when field names, source order or log schemas change, and treat drift as a reliability defect.
Key takeaways
- AI-assisted SOC performance depends on the quality and accessibility of the data layer, not just on the sophistication of the model.
- Fragmented schemas turn every investigation into a translation exercise, which slows triage and creates room for wrong but plausible conclusions.
- Security teams should treat normalized, complete investigation data as a core operating control if they want automation to improve reliability rather than amplify noise.
Related NHI Mgmt Group resources: Initial Access Techniques Guide · T1190 Exploit Public-Facing Application Defensive Guide · Top 10 NHI Issues · Lateral Movement Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, NIST AI RMF and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001; TA0008 — Initial Access; Lateral Movement | AI speeds reconnaissance, phishing and movement across security environments. |
| Recommendation — Map AI-enabled intrusion chains to initial access and lateral movement detections. | ||
| NIST CSF 2.0 | DE.AE-01 — Anomalies and Events | Investigation quality depends on correlating anomalous activity across multiple data sources. |
| DE.CM-01 — Continuous Monitoring | Continuous monitoring fails when critical telemetry is inaccessible or fragmented across tools. | |
| Recommendation — Correlate alerts across identity, endpoint and cloud telemetry before closing anomalous events. Prioritise coverage gaps that prevent continuous monitoring from seeing high-value events. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | SOC triage depends on reviewing and analysing logs from multiple systems. |
| AU-12 — Audit Record Generation | Complete investigations require the right records to be generated and retained across sources. | |
| Recommendation — Use AU-6 to standardise log review and reduce manual data chasing during investigations. Ensure audit records are generated for the identity and endpoint events your SOC must explain. | ||
| NIST AI RMF | MEASURE — Measurement and Management | AI reliability hinges on measuring data quality, not just model performance. |
| Recommendation — Measure data completeness and schema consistency before relying on AI for security decisions. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Investigations fail when logs are fragmented, incomplete or hard to access. |
| Recommendation — Centralise and protect audit logs so analysts can reconstruct incidents without excessive pivoting. | ||
Key terms
- Schema Normalization: Schema normalization is the process of converting inconsistent raw log fields into a stable structure that downstream systems can reliably use. It reduces parsing drift, improves correlation accuracy, and prevents each tool from having to solve vendor-specific formatting problems on its own.
- Security Information and Event Management (SIEM): SIEM is a security control that centralises event collection, correlation, and alerting so analysts can monitor suspicious activity. It is useful for visibility and detection, but it often produces large volumes of alerts and usually needs enrichment and response automation to become operationally effective.
- Agentic Security Tooling: Security software that can reason over goals, use tools, and take multi-step actions within defined boundaries. These systems are useful for scale and consistency, but they must be governed like privileged identities because they can affect live environments and generate real operational risk.
- Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course if your programme needs a practical foundation in machine identity, secrets management, and agentic AI governance.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org