Identity stitching is the real problem behind AI-powered SOC data

At a glance

What this is: NHI Mgmt Group's analysis, drawing on DataBahn's blog post: AI SOC tools fail less because the model is weak than because identity data is fragmented across systems, so one attacker can look like multiple unrelated users.

Why it matters: For IAM, NHI, and SOC teams, the governance problem is entity resolution before analytics, because correlation and investigation quality depend on a single trusted identity across telemetry sources.

Context

Identity stitching is the process of resolving different identifiers back to the same real actor or workload. In security operations, that matters because cloud consoles, SaaS apps, collaboration tools, and endpoint systems rarely describe the same user or service account in the same way. When the data layer does not preserve that relationship, analytics and AI inherit the fragmentation instead of correcting it.

The governance gap is not just a SOC problem. It is an identity problem that affects investigation quality, access review confidence, and the ability to understand movement across human and non-human identities. Where telemetry arrives without durable entity context, even strong detection logic can only reason over fragments, not actors.

Key questions

Q: What breaks when identity resolution is left to the SIEM?

A: When identity resolution is left to the SIEM, schema drift, custom parsers, and inconsistent source fields create silent failures. Analysts end up maintaining mappings instead of investigating threats, and the same session may never be reconstructed as a single incident. The result is slower response and weaker trust in automated detections.

Q: Why does fragmented telemetry create risk for AI-enabled SOC operations?

A: Fragmented telemetry weakens AI because models inherit the quality and consistency of their inputs. When schemas differ, context is missing, or lineage is unclear, AI produces less reliable recommendations and analysts spend more time validating outputs. Good automation depends on governed, observable data, not just more data.

Q: How can teams tell whether identity enrichment is working in the SOC?

A: Look for shorter investigation paths for high-risk identities, fewer false positives on low-risk accounts, and more consistent escalation decisions across analysts. If enriched alerts still require manual reconstruction of who had access, the programme is not truly integrated. Effective identity enrichment changes both analyst confidence and case outcome.

Q: Should security teams normalise identity data in the SIEM or upstream?

A: Upstream is the better choice when identity fragmentation is widespread. Normalising at query time pushes correlation cost into investigations, while upstream resolution lets routing, detection, and retention decisions use the same verified identity context from the start.

Technical breakdown

Why identity stitching breaks correlation in the SOC

Security tools often ingest events as source-specific records rather than as actor-centric histories. One platform sees an IAM ARN, another sees an email address, another shows a Slack user token, and each format is valid inside its own system. The problem is that correlation engines and AI copilots depend on stable entity resolution to connect those records into a single timeline. If that mapping is delayed until query time, analysts pay with latency, cost, and missed context. If it never happens, the platform can only describe activity per log source, not per identity.

Practical implication: Build entity resolution at ingestion so correlation works on verified identity, not on brittle source-specific labels.

Why AI security tools amplify data quality errors

AI does not create visibility where the data model is already broken. It can summarise, cluster, and correlate what it receives, but it cannot reliably infer that jsmith, John Smith, and a cloud principal represent the same actor unless the pipeline has already stitched them together. That is especially risky in hybrid estates where human and non-human identities overlap across SaaS, cloud, and collaboration services. In that setting, confident output can mask incomplete evidence rather than improve it.

Practical implication: Treat AI copilots as consumers of identity-grounded telemetry, not as a substitute for identity governance in the data layer.

Why pre-ingestion routing depends on trusted identity context

Routing telemetry by value only works when the pipeline knows which events belong to which identity, asset, or environment. Without that context, clean activity can be over-retained and high-value activity under-prioritised, which distorts both cost and detection. Identity stitching lets pipelines classify events before they reach the SIEM, so compliance logs, investigative data, and high-fidelity alerts follow different paths for good reason. That is why the article frames the SIEM as a consumer, not the place where data quality gets fixed.

Practical implication: Use enrichment and routing decisions upstream so the SIEM receives higher-value evidence instead of acting as a data cleanup layer.

Threat narrative

Attacker objective: Move through multiple enterprise systems under fragmented identity records and exfiltrate sensitive data without triggering end-to-end attribution.

1. Entry occurs through phishing that compromises a user credential, giving the attacker a foothold in the first system.
2. Credentialed access then appears under different identifiers as the attacker moves from cloud console to SaaS application to collaboration tool.
3. Lack of identity stitching lets each step look unrelated, which hides the attack path from both analysts and AI.
4. Impact is achieved when the attacker reaches sensitive data and exfiltrates it without the SOC recognising the full chain in time.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Sumo Logic breach 2023: A compromised credential opened a Sumo Logic AWS account; customers were told to rotate API keys and stored credentials. No data impact was found.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity stitching is now a governance control, not a reporting convenience. If the same actor cannot be resolved consistently across cloud, SaaS, endpoint, and collaboration telemetry, the organisation does not have a reliable security picture. That weakness affects human identity and NHI oversight alike, because service accounts, API keys, and user accounts all depend on clean attribution. Practitioners should treat entity resolution as part of the control plane, not as an analytics afterthought.

AI SOC tooling inherits whatever identity quality the pipeline gives it. A copilot that receives fragmented telemetry will still produce fluent answers, but fluency is not fidelity. The real risk is false confidence, because the system can appear decisive while missing the underlying attack path. This is why identity stitching sits between raw telemetry and AI, and why it belongs in the same governance conversation as access control and logging quality.

Fragmented telemetry creates detection debt. Every unresolved identity increases the work needed to reconstruct an incident, and every delayed resolution pushes more cost into the SIEM and more uncertainty into investigations. The field should recognise this as a control gap with operational consequences, not a data-engineering inconvenience. Teams that cannot correlate identity across sources will keep buying more analytics to compensate for a preventable upstream failure.

Verified identity context changes the economics of security data. Once records are stitched, routing can separate high-value security evidence from low-value noise before ingestion, which improves both cost discipline and response quality. That makes identity resolution a prerequisite for scalable AI-assisted operations, especially where human and non-human identities coexist in the same workflow. Practitioners should design for identity-first telemetry pipelines if they want trustworthy SOC automation.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Research and Survey Results

What this signals

Identity stitching will become a core requirement for AI-enabled SOCs. As more organisations ask copilots to explain investigations, the weakest link will be the identity model underneath the telemetry, not the model itself. Teams that cannot preserve actor continuity across sources will keep paying for automation that cannot reliably follow a single path from compromise to impact.

Verified identity context is the difference between detection and expensive data handling. Once records are resolved before ingestion, the SOC can route logs by investigative value rather than by raw volume, which makes both AI output and retention decisions more trustworthy. That is the operating model security leaders should prepare for as human and non-human identities continue to converge.

For practitioners

• Implement identity resolution at ingestion Map cloud, SaaS, endpoint, and collaboration identifiers to a single verified identity before events reach the SIEM or AI layer.
• Preserve cross-system identity context Carry immutable relationships between usernames, email addresses, service principals, and session tokens through the pipeline so investigations can reconstruct one actor’s path.
• Route telemetry by identity value Send high-fidelity, identity-rich events to detection while diverting routine logs to cheaper storage based on enriched context.
• Test AI outputs against source identity records Validate whether copilot conclusions still hold when one user touches several systems under different labels, and reject models that cannot explain the mapping.

Key takeaways

• Fragmented identity data, not weak AI, is what allows one attacker to look like several unrelated events across cloud and SaaS telemetry.
• SOC teams need entity resolution before analytics if they want correlation, investigation, and AI-assisted response to stay trustworthy.
• Identity stitching should be treated as an upstream control that improves detection quality, reduces wasted retention, and supports more reliable AI output.

Key terms

• Identity stitching: Identity stitching is the process of linking multiple identifiers that belong to the same person or workload into one verified subject record. In security operations, it is what allows logs from cloud, SaaS, endpoint, and collaboration systems to be interpreted as one continuous activity stream.
• Entity Resolution: Entity resolution is the process of determining which accounts, wallets, devices, or records belong to the same real-world actor. It is essential for sanctions and AML programmes because transaction data alone often hides related activity unless it is linked back to a trusted identity model.
• Telemetry Enrichment: Telemetry enrichment is the process of adding context to raw security data so it is more useful for investigation and response. That can include asset, identity, geolocation, or threat intelligence context, but enrichment must be controlled so it does not distort the original evidence record.
• Pre-Ingestion Routing: Pre-ingestion routing is the practice of deciding where telemetry should go before it reaches a SIEM or data lake. It uses enriched context to separate high-value security events from low-value noise so cost, storage, and detection are aligned.

Deepen your knowledge

NHI Mgmt Group’s NHI Foundation Level course, the industry’s only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It is designed for practitioners who need to connect identity control to operational security decisions.