MDR vs in-house SOC: how AI is changing operations

At a glance

What this is: This is an analysis of the trade-offs between MDR and in-house SOC operating models, with the key finding that AI changes the economics of triage, investigation, and coverage.

Why it matters: It matters because security operations still depend on identity, endpoint, cloud, and SIEM signals, and faster triage only helps if teams can preserve control over access, evidence, and response.

By the numbers:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• Only 5.7% of organisations have full visibility into their service accounts.

👉 Read Airmdr's analysis of MDR vs in-house SOC operating models

Context

MDR versus SOC is really a question about operating model, not tooling brand. The pressure points are familiar: too few analysts, too much alert volume, and too much manual work to keep pace with modern attacks, especially where identity, endpoint, cloud, and email signals all converge in the same queue.

For identity-heavy environments, the gap is bigger than detection speed. Security operations increasingly has to correlate human access, service accounts, API keys, and workload activity while preserving evidence for compliance and response. That makes SOC design as much a governance problem as a technical one.

Key questions

Q: What breaks when security teams rely on MDR without clear identity ownership?

A: MDR can speed up monitoring and triage, but it breaks down when the customer has not defined who owns identity evidence, privileged access decisions, and containment authority. In practice, alerts involving service accounts, API keys, or delegated cloud access need internal context to become actionable. Without that, response stays fast but shallow.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.

Q: How can teams tell whether AI threat detection is improving SOC performance?

A: Look at mean time to verdict, analyst rework, and the percentage of alerts resolved with documented reasoning. If alert volume drops but analysts still have to reconstruct context manually, the platform has not changed the operating model enough to matter.

Q: Should organisations choose MDR or an in-house SOC for identity-heavy environments?

A: The better choice depends on whether the organisation can maintain identity context, escalation authority, and evidence governance internally. If not, MDR can provide coverage, but the organisation still needs to own access decisions for service accounts, secrets, and privileged identities. Hybrid models often work best when internal teams keep policy control.

Technical breakdown

How MDR and SOC divide operational responsibility

A SOC is the organisation's own detection and response function, typically built around a SIEM, analysts, threat hunting, incident response, and internal runbooks. MDR shifts part of that burden to an external provider, usually taking over monitoring, triage, and initial response while the customer retains responsibility for assets, permissions, and local context. The real distinction is not ownership of alerts but ownership of operating discipline: who tunes detections, who validates evidence, and who decides when an alert becomes an incident.

Practical implication: define which controls remain internal, especially access governance and incident authority, before signing any MDR service model.

Why AI changes alert triage economics

AI in security operations is best understood as a force multiplier for repetitive investigation work. It can correlate telemetry, enrich alerts, summarise evidence, and route routine events faster than a human queue can, which reduces dwell time on low-value cases. But AI does not remove the need for human decision-making, because escalation thresholds, containment actions, and evidentiary standards still require accountable operators. The strongest use case is not autonomous response, but compressed time-to-context across many data sources.

Practical implication: use AI to reduce queue pressure, then validate where human approval remains mandatory in your response workflow.

Why identity data is central to modern security operations

Security operations now depends on identity telemetry as much as endpoint or network data. Service accounts, tokens, API keys, and cloud roles often explain the path from first alert to root cause, particularly when attackers move through over-permissioned access or exposed secrets. That means the SOC cannot treat identity as a separate admin domain. It is part of detection logic, escalation logic, and post-incident evidence handling, especially in hybrid and cloud-first estates.

Practical implication: integrate identity events into detection content and make access evidence available to analysts during triage.

Threat narrative

Attacker objective: The attacker aims to turn weakly governed identities into a fast path through detection gaps and into broader operational impact.

1. Entry begins when attackers exploit exposed secrets, over-permissioned accounts, or weakly monitored access paths that the SOC must detect in telemetry.
2. Escalation occurs when standing privileges, missing offboarding, or poor credential hygiene let the attacker expand access faster than manual triage can respond.
3. Impact follows when delayed investigation allows data theft, service disruption, or lateral movement to continue without containment.

NHI Mgmt Group analysis

AI has changed security operations, but it has not changed accountability. Automation can compress triage and investigation, yet it does not remove the need for humans to own containment decisions, evidence quality, and response thresholds. That means the operating model question is really about governance of speed, not replacement of analysts. Practitioners should treat AI as a control amplifier, not a substitute for control ownership.

Identity telemetry is now a core SOC input, not a side signal. In cloud and hybrid environments, service accounts, API keys, and delegated access often explain why a detection matters and what the blast radius is. A SOC that cannot see identity context will mis-rank alerts and miss escalation paths. The named concept here is identity-response latency: the delay between a detection and the point at which identity context makes containment possible. Teams should shorten that gap by bringing identity data into the same operational workflow as endpoint and cloud alerts.

MDR and in-house SOC are converging around the same operational problem. The market is moving toward shared detection content, packaged evidence, and managed triage, while internal teams keep higher-order judgment and policy control. That does not eliminate the need for internal capability, but it does change what teams should build versus buy. Practitioners should re-evaluate where their internal edge actually sits: in correlation logic, in response authority, or in evidence governance.

Security operations maturity is increasingly measured by response discipline, not tool count. A large SIEM estate with slow triage is still operationally weak, while a smaller hybrid model can outperform it if evidence, escalation, and handoff are tight. This is especially true when identity events drive the incident path. Organisations should assess whether their current model reduces analyst load without weakening auditability or access governance.

What this signals

identity-response latency: SOC performance will increasingly be judged by how quickly identity context is available at the point of triage, not by alert throughput alone. That makes service account visibility, privilege mapping, and secret ownership part of detection engineering rather than back-office hygiene. See also NIST SP 800-63 Digital Identity Guidelines.

AI will compress routine investigation work, but programmes that cannot govern identity context will still struggle with containment decisions. The practical shift is toward smaller analyst teams with stronger policy, evidence, and access governance. In that environment, the operational question becomes whether your response model can prove who or what had access, when, and under which control.

Teams should expect more blended operating models where MDR handles scale and the internal SOC retains authority over privileged access and major incidents. That means identity and response workflows must be designed together, especially where cloud roles, secrets, and delegated access are in play. For identity-heavy programmes, the SOC is now part of the identity control plane.

For practitioners

• Define response ownership by alert class Separate which events are handled by MDR, which remain internal, and which require immediate escalation into the organisation's incident command structure. Make identity-related alerts, such as suspicious service account use or token abuse, explicit ownership items in the runbook.
• Put identity data into detection workflows Ensure service account activity, API key usage, cloud role changes, and privileged access events are visible in the same investigation queue as endpoint and SIEM alerts. This shortens triage time and improves root-cause analysis.
• Measure time-to-context, not only time-to-respond Track how long it takes analysts to assemble enough identity, asset, and evidence context to make a containment decision. That metric exposes whether AI and MDR are actually reducing operational friction or just moving alerts faster.
• Audit offboarding and secret-revocation handoffs Test whether terminated users, service accounts, and API keys are removed from active access paths quickly enough for SOC workflows to rely on them. Weak handoffs here create false confidence in triage and can prolong attacker dwell time.

Key takeaways

• MDR and in-house SOC differ less by tooling than by who owns triage, evidence, and response authority.
• AI can reduce alert fatigue and speed investigations, but only if identity context is built into the operating model.
• Security operations maturity now depends on response discipline, access governance, and time-to-context, not just coverage hours.

Key terms

• Managed Security Operations Center: A security operations function delivered as a managed service rather than built entirely in-house. For SAP security, the value is not just alert handling. It is the ability to monitor identity, transaction, and application behaviour continuously when specialist staff are scarce or unavailable.
• Managed Detection And Response: MDR is a service model focused on detecting suspicious activity, investigating alerts, and helping contain attacks across threat-facing technologies. It is designed to turn telemetry into action, which makes it closer to security operations than simple platform administration.
• Time To Context: Time to context is the interval between an alert being raised and an analyst having enough information to make a defensible decision. It includes identity data, asset details, history, and evidence. Lowering this metric is often more valuable than simply increasing alert throughput.
• Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.

What's in the full article

Airmdr's full article covers the operational detail this post intentionally leaves for the source:

• Role-by-role breakdown of SOC, MDR, and MSSP operating responsibilities for real-world team structures
• Comparison table details on coverage, response SLAs, compliance evidence, and platform maintenance
• Examples of AI-assisted triage and automated evidence capture inside modern security operations
• Guidance on hybrid models for after-hours coverage, endpoint monitoring, and surge support

👉 Airmdr's full article covers the team-size guidance, AI operating model examples, and comparison details.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives security practitioners a stronger basis for aligning identity controls with detection and response programmes.