TL;DR: Locked Shields 2026 showed that rich network evidence helped blue teams move faster from anomaly to investigation and response across critical infrastructure scenarios, according to Corelight, while passive monitoring and log enrichment gave defenders the context they needed without adding risky agents. When visibility is fragmented, SecOps speed depends on correlation at the network layer, not on more alerts.
At a glance
What this is: Locked Shields 2026 is a live-fire cyber defence exercise that highlighted how passive network monitoring, enriched logs, and threat hunting can turn noisy defensive conditions into faster investigation and response.
Why it matters: It matters to IAM and security teams because the exercise shows how operational context and network evidence shorten the path from detection to containment when critical systems, cloud services, and identity-linked activity must be defended at speed.
Context
Locked Shields is a multinational live-fire cyber defence exercise built to stress defenders with realistic operational pressure, incomplete context, and simultaneous attacks on critical services. In this environment, the practical problem is not a lack of alerts but a lack of connective evidence that explains what happened across systems, segments, and services.
The article frames network evidence as the bridge between anomaly and action because many defensive environments cannot rely on endpoint visibility alone. That intersects with identity governance when teams need to understand which service, segment, or delegated access path generated suspicious traffic, and when a MITRE ATT&CK guide for defenders lens helps map the activity to adversary behaviour.
Key questions
Q: What breaks when endpoint agents cannot be used in critical infrastructure?
A: When endpoint agents are too risky, defenders lose direct host telemetry and have to rely on passive network evidence instead. The main failure is not total blindness, but slower attribution and weaker context unless traffic is enriched with asset, segment, and ownership data. That is why monitoring design matters as much as alerting design in ICS and SCADA environments.
Q: Why does network context matter so much during live incident response?
A: Network context reduces the time spent reconstructing where an event happened and who is responsible for it. In a fast-moving incident, analysts need to know the segment, service, host, and likely owner immediately. Without that context, teams waste time pivoting between tools and risk containing the wrong system or missing the real one.
A: Weak visibility shows up when teams cannot tell which devices are online, which connections are blocked, or which traffic spikes are normal. It also appears when engineers spend hours digging through logs to identify slow APIs or unexpected device-to-device communication. If the network can only be understood after the fact, the monitoring model is not giving actionable insight.
Q: When should teams prefer passive monitoring over agent-based visibility?
A: Teams should prefer passive monitoring when the systems involved are fragile, legacy, safety-sensitive, or operationally constrained. In those cases, the goal is to preserve system stability while still collecting enough evidence for detection and hunting. Passive visibility is especially appropriate in industrial environments where endpoint tooling could create new operational risk.
Technical breakdown
Why passive monitoring still matters in critical infrastructure
Passive network monitoring collects traffic and protocol evidence without installing an agent on the system being watched. That matters in ICS and SCADA environments because endpoint tooling can disrupt fragile controllers, legacy devices, or tightly managed operational segments. The value is not only visibility, but non-intrusive visibility that preserves system stability while still surfacing suspicious protocol use, unusual flows, and command patterns. In the article, custom detections for Modbus illustrate how protocol-aware monitoring turns raw packets into meaningful security signals. Practical implication: use passive monitoring where endpoint instrumentation would create operational risk. See the OT Security Guide.
Practical implication: place passive sensors where endpoint agents are too risky and build protocol-specific detections for those segments.
How log enrichment turns traffic into investigative context
Enrichment adds asset, identity, and network metadata to logs so analysts do not have to pivot across multiple consoles during an incident. Fields such as VLAN tags, hostnames, operating system details, and segment ownership let defenders answer basic questions faster: where did the event occur, what system generated it, and who owns the path? This does not replace detection engineering, but it sharply reduces the time lost reconstructing context after an alert fires. In high-pressure operations, enriched telemetry is often what separates a noisy packet stream from a usable investigative record. Practical implication: enrich network logs with the context analysts need before the next incident begins. See the SIEM Guide.
Practical implication: enrich logs with ownership and segment context before an incident so analysts can triage without manual pivots.
Why network evidence strengthens threat hunting and response
Threat hunting depends on evidence that is detailed enough to confirm or reject a hypothesis quickly. In the exercise, the combination of enriched telemetry and hunt workflows helped analysts spot anomalous metadata, identify DNS exfiltration, and trace the activity back to the responsible segment. That is a classic detection-to-response loop: anomaly identification, validation, scoping, and containment. The architecture matters because hunting becomes far more useful when the data already contains port, service, and ownership context. Practical implication: make network telemetry huntable, not just searchable. See the Threat Hunting Guide.
Practical implication: design hunt workflows around network telemetry that includes port, service, and ownership context.
Threat narrative
Attacker objective: The adversary objective was to disrupt critical services and move data or control signals out of protected operational segments.
- Entry began as a live-fire defence scenario in which adversary activity targeted critical infrastructure and cloud-linked services under time pressure.
- Escalation occurred when defenders used enriched telemetry and hunt workflows to identify anomalous DNS exfiltration inside SCADA network segments.
- Impact was limited when the responsible segment was identified and the malicious service was shut down before the activity could spread further.
Breaches seen in the wild
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Network evidence has become a governance control, not just a visibility layer. The article shows that defenders did not merely collect packets, they used traffic evidence to decide what was happening, where it occurred, and which segment owner needed to act. That is a governance function because operational decisions depend on trustworthy telemetry, not on alert volume. For identity and access teams, the lesson is that segmentation, ownership, and service context are part of the evidence model, not separate concerns.
Passive visibility is the right control pattern when endpoint coverage is unsafe. Critical infrastructure and tightly constrained environments cannot always tolerate agents, which makes passive monitoring the safer control boundary. That does not weaken detection, it changes where control is enforced. The identity angle is important because delegated access paths, service ownership, and segment trust must be inferred from network behaviour when host-level tooling is not viable.
Investigative speed depends on correlation quality, not just tool count. The exercise demonstrated that multiple tools only help when they share enough context to support one coherent workflow. This is where SIEM guide thinking matters: telemetry has to be normalised and enriched before the incident, not reconstructed during it. Practitioners should treat context-rich logging as a design requirement for response, not an optional enhancement.
Named concept: evidence-to-response continuity. The article’s core lesson is that defenders need a continuous chain from raw network activity to scoped investigation to containment decision. Break that chain and teams fall back into manual correlation, which slows response and increases uncertainty. In modern SecOps, the control objective is not more data but better continuity across detection, hunting, and action. Practitioners should build for that continuity explicitly.
What this signals
Evidence-to-response continuity: security programmes should treat enriched telemetry as part of response architecture, not as a post-incident convenience. When logs carry segment, service, and ownership context, detection and containment become operationally continuous rather than manually stitched together.
The practical question for defenders is whether their current stack can preserve context from first alert through containment decision. If investigations still depend on console hopping and tribal knowledge, then visibility exists, but operational evidence continuity does not.
For practitioners
- Build passive monitoring into fragile segments Place sensors where endpoint agents would create risk, especially in ICS, SCADA, and other constrained environments, so visibility does not compromise operations.
- Enrich logs before the next incident Add VLAN, host, operating system, segment, and ownership context to network telemetry so analysts can triage without pivoting through separate consoles.
- Make hunt workflows network-aware Tune investigations to use port, service, and segment data as first-class hunt inputs so anomalies can be validated and scoped quickly.
- Test tool interoperability under pressure Verify that your detection stack can stream usable evidence into the SOC tools already in use, and confirm that integrations preserve the context analysts need.
- Review control placement in critical infrastructure Check whether the environments that matter most still rely on blind spots because host-based visibility is unavailable or too risky to deploy.
Key takeaways
- Critical infrastructure defence often depends on passive visibility because endpoint agents can be too risky for fragile operational systems.
- The exercise showed that enriched network evidence can turn noisy activity into faster scoping, hunting, and containment decisions.
- Practitioners should treat telemetry enrichment and tool interoperability as response controls, not optional visibility enhancements.
Related NHI Mgmt Group resources: OT Security Guide · SIEM Guide · Threat Hunting Guide · MITRE ATT&CK Guide for Defenders
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | The article includes hunting for anomalous activity and DNS exfiltration in defended segments. |
| Recommendation — Map suspicious network behaviour to ATT&CK techniques and prioritise detections that expose exfiltration paths. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and Physical Environments Monitored | The piece is fundamentally about monitoring critical environments with usable network evidence. |
| Recommendation — Expand monitoring coverage so network telemetry supports timely detection in constrained environments. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The article stresses enriched logs and investigative usability during defence operations. |
| Recommendation — Centralise and enrich logs so analysts can investigate incidents without manual context reconstruction. | ||
| CSA Cloud Controls Matrix | SEF — Security Event and Incident Management | The scenario focuses on detection, investigation, and response coordination across tools. |
| Recommendation — Use SEF-aligned controls to ensure telemetry supports detection, correlation, and response workflows. | ||
Key terms
- Passive Monitoring: A monitoring approach that observes traffic, events, or system behavior without installing intrusive agents or performing active scans. It is common in industrial environments because many legacy assets cannot tolerate modern IT security tooling without reliability or compatibility problems.
- Log Enrichment: Log enrichment adds context to raw telemetry so alerts are easier to interpret and investigate. Common enrichment includes asset ownership, user mappings, human-readable labels, or threat intelligence lookups. It improves fidelity by making security findings more actionable without changing the original event source.
- Threat Hunting: Threat hunting is the proactive search for signs of compromise that bypassed normal detection controls. It combines logs, telemetry, and investigator judgement to find hidden attacker behaviour before it becomes a larger incident or disrupts recovery.
- Industrial Control Systems: Industrial control systems are the components that directly automate and supervise industrial processes, including controllers, sensors, and supervisory software. They are a subset of operational technology, but they often carry the most sensitive control paths and therefore demand specialised access and monitoring controls.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and agentic AI identity for practitioners who need a stronger control foundation. It helps security and identity teams connect governance decisions to the systems and access paths they manage every day.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org