RAD Security’s signal pipeline links cross-stack identity and runtime context

At a glance

What this is: RAD Security describes a signal pipeline that correlates cloud, identity, endpoint, and posture telemetry into one evidence graph to preserve context and impact.

Why it matters: This matters because IAM, NHI, and security operations teams increasingly need shared evidence across identity events, workload activity, and endpoint signals to make fast, defensible decisions.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read RAD Security’s post on cross-stack context in the RAD Signal Pipeline

Context

Cross-stack security correlation is the problem of tying together identity, cloud posture, endpoint detections, and runtime activity so investigators can see a single sequence instead of a pile of disconnected alerts. In NHI and IAM programmes, that matters because the control failure is often not the alert itself but the inability to prove what touched what, when, and through which identity path.

RAD Security’s signal pipeline is framed around that governance gap: source tags, timestamps, and shared evidence are kept intact so findings can be read as one story. That approach reflects a broader operational reality for cloud and identity teams, where role assumptions, session lifetimes, and host activity increasingly need to be judged together rather than in separate consoles.

Key questions

Q: How should security teams correlate identity, cloud, and endpoint signals?

A: They should correlate by shared resource, identity, and sequence rather than by alert volume. A useful triage path joins posture drift, role changes, and runtime detections into one evidence chain so investigators can see what happened first, what followed, and which account or workload connected the events.

Q: Why do identity events matter in cloud incident response?

A: Identity events explain how a change became possible and which session or role made it happen. In cloud incidents, role assumptions, MFA challenges, and session lifetimes often reveal the pivot from benign access to meaningful impact, especially when a posture alert or runtime detection appears nearby.

Q: What breaks when security tools do not preserve source context?

A: Analysts lose provenance, timing, and the ability to prove which signals belong to the same sequence. The result is slower triage, weaker accountability, and more uncertainty about blast radius, because the team can see events but cannot reliably connect them into a single story.

Q: How can teams reduce alert noise without losing incident context?

A: They should aggregate only after preserving metadata that supports reconstruction, such as timestamps, source tags, and shared asset identifiers. That approach reduces duplicate work while keeping enough evidence to support remediation, review, and escalation decisions.

Technical breakdown

Evidence graph correlation across identity and runtime signals

An evidence graph is a correlation layer that preserves relationships between events rather than flattening them into isolated alerts. Here, the important detail is not just that Wiz, CrowdStrike, and Okta send data into one system, but that each event retains source identity, timestamp, and shared resource context. That lets analysts trace whether a posture change, an identity event, and a runtime detection describe the same object or attack path. In practice, this is closer to incident reconstruction than alert aggregation, because the graph can show sequence, provenance, and overlap across the stack.

Practical implication: correlate by shared resource and identity path, not by alert volume.

Identity events, session lifetimes, and role assumption context

Identity telemetry becomes more useful when it captures role assumptions, MFA challenges, and session lifetimes as first-class evidence. Those details tell you whether a privileged session is a normal administrative action, a risky elevation, or a session that lines up with a later workload or endpoint change. In cloud environments, identity events are often the bridge between configuration drift and execution impact. Without them, analysts may see a bucket go public and a binary appear on a host, but miss the identity step that made the sequence coherent.

Practical implication: preserve session and role metadata so privilege changes can be tied to downstream impact.

From alert fan-out to continuous security story

The architectural shift here is from fan-out alerts to a continuous story that follows the same asset or identity across tools. When a finding in one system is matched with runtime and endpoint evidence, the analyst can move from triage to decision faster because the graph already answers the key question of blast radius. This is especially valuable in cloud and NHI-adjacent operations, where evidence is scattered across scanners, identity platforms, and response tools. The challenge is no longer collecting more data, but keeping the relationships intact long enough to act on them.

Practical implication: design workflows that preserve evidence lineage from detection through remediation.

Threat narrative

Attacker objective: The objective is to turn a single exposed cloud path into broader execution and access impact before defenders separate the signals.

1. entry: A storage bucket is reported as public-read while runtime telemetry shows external traffic reaching the exposed resource.
2. escalation: An Okta event shows a support engineer assuming an elevated role tied to the same account, expanding the available action set.
3. impact: CrowdStrike records unfamiliar binaries on the host a few minutes later, linking identity elevation to execution on the affected system.

Breaches seen in the wild

• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cross-stack context is now an identity governance requirement, not a nice-to-have visibility layer. When cloud posture, identity events, endpoint detections, and runtime activity are separated, teams lose the ability to prove which identity actually drove the impact. That is not just an operational inconvenience, it is a governance failure because accountability depends on reconstructable evidence. The practitioner conclusion is simple: if the evidence cannot be joined, the control story cannot be defended.

Shared evidence graphs create a new kind of control surface for NHI and IAM teams. The real value is not another dashboard, but a way to preserve provenance across role assumptions, sessions, and workload activity. That matters because NHI and human identity events increasingly intersect in the same incident chain, and isolated tools make those relationships invisible. Practitioners should treat correlation fidelity as a security control, not a reporting feature.

Named concept: evidence continuity debt. This pipeline addresses the operational debt created when each security tool tags events differently and time-aligns them inconsistently. The debt is not the absence of data, but the loss of connective tissue between data sources, which turns triage into manual reconstruction. The implication for practitioners is that the cost of delayed correlation now sits alongside the cost of delayed detection.

Identity, runtime, and posture telemetry only become actionable when they can be reasoned over as one sequence. That makes cross-stack correlation central to cloud incident response, NHI investigations, and privilege review workflows. The field is moving toward evidence-led operations, where governance teams need proof of sequence and scope before they can certify or close an issue. The practitioner conclusion is to align access governance, detection, and response around the same evidence model.

The market signal is convergence around evidence orchestration, not isolated detection. Vendors are moving toward stitched workflows because practitioners need context that survives handoff from scanner to analyst to approver. That does not eliminate the need for specialist controls, but it does raise the bar for integration quality and metadata consistency. The practitioner conclusion is to evaluate whether your tools preserve context end to end or merely export more alerts.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant behaviour gap across application teams.
• For a broader view of identity exposure patterns, see Guide to the Secret Sprawl Challenge for how fragmented secret handling undermines control.

What this signals

Evidence continuity debt: organisations that cannot preserve source tags, timestamps, and shared identifiers across tools will keep paying a manual reconstruction tax during every incident. That tax slows response and weakens governance because analysts cannot defend a sequence they cannot reassemble.

With 6 distinct secrets manager instances on average, per The State of Secrets in AppSec, fragmentation already creates the conditions for broken provenance and inconsistent handoffs.

Teams should treat cross-stack correlation as an operating requirement and compare their pipeline design with the control patterns in Ultimate Guide to NHIs and the OWASP Agentic AI Top 10 where identity, tool use, and evidence chaining increasingly overlap.

For practitioners

• Map your evidence chain before your alert chain Document which systems must agree before a cloud finding, identity event, and endpoint alert are treated as one incident. Include source tags, timestamps, and shared object identifiers so analysts can prove sequence without manual stitching.
• Preserve identity metadata through every handoff Ensure role assumptions, MFA state, session lifetimes, and account context survive into SIEM, SOAR, and case management workflows. If that metadata is stripped at ingestion, downstream correlation will always be partial.
• Correlate by resource and behaviour, not by tool name Build detection logic around the same bucket, host, account, or workload appearing across multiple sources within the same sequence. That reduces false linkage and helps you identify the actual blast radius sooner.
• Route evidence with the remediation request Attach the original findings, the matching identity event, and the runtime proof to every ticket or change record. Approvers need the reason, impact, and scope in one view if they are going to sign off quickly and defensibly.

Key takeaways

• Cross-stack context is the difference between seeing alerts and proving an incident sequence across identity, runtime, posture, and endpoint data.
• When identity metadata is preserved end to end, teams can link role changes, session timing, and host activity to the same blast radius.
• Security programmes should judge correlation fidelity as a control outcome, because incomplete evidence makes accountability and remediation harder to defend.

Key terms

• Evidence graph: An evidence graph is a correlated record of events that keeps relationships between identity, runtime, posture, and endpoint data intact. It helps analysts reconstruct what happened in sequence rather than manually stitching together separate alerts after the fact.
• Source context: Source context is the metadata that explains where an event came from, when it occurred, and which asset or identity it belongs to. In security operations, preserving source context prevents alerts from becoming isolated facts that are hard to prove or act on.
• Blast radius: Blast radius is the scope of systems, identities, or data that can be affected once an event succeeds. In cloud and identity operations, it is determined by access scope, session timing, and how quickly teams can connect evidence across the environment.

What's in the full article

RAD Security's full blog post covers the operational detail this post intentionally leaves for the source:

• How the RAD Signal Pipeline preserves source tags and timestamps across Wiz, CrowdStrike, Okta, Jira, ServiceNow, and Slack.
• The way CloudBot, VulnBot, and GRCBot consume shared evidence to decide next actions.
• The specific integration paths for posture findings, identity events, and endpoint detections.
• How the evidence graph connects findings to recommended fixes, approvals, and remediation threads.

👉 RAD Security’s full post shows how the evidence graph links identity events, detections, and remediation workflow.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.