Telemetry in the AI era is becoming an identity and governance problem

At a glance

What this is: This is a Black Hat 2025 commentary on how AI-era security operations are shifting toward selective, structured telemetry collection and policy-aware routing.

Why it matters: It matters because telemetry pipelines now sit close to SIEM, data, and AI workflows, so IAM, NHI, and governance teams need to think about access, scope, and trust decisions earlier in the data path.

👉 Read DataBahn's Black Hat 2025 commentary on telemetry in the AI era

Context

Telemetry is no longer just a logging problem. In environments where AI agents, security tooling, and distributed applications consume the same streams, collection strategy becomes a governance decision about what is trusted, what is retained, and what is allowed to drive action. That makes this a telemetry architecture issue with a real identity governance dimension, especially where service accounts, API keys, and agent workflows determine what data can move.

The article frames Black Hat 2025 as a community event, but its more durable message is about operational pressure: security teams are being asked to collect less, understand more, and route faster. That is a familiar pattern in modern security programmes, and it is typical of environments where telemetry cost, downstream analytics quality, and access governance are converging.

Key questions

Q: How should security teams decide what telemetry to collect in AI-driven environments?

A: They should collect telemetry based on the security, detection, and compliance decisions the data must support, not on source availability alone. That means defining required fields, retention needs, and enrichment points for each use case. If the data cannot support a specific action, it should not be ingested by default.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.

Q: What breaks when telemetry is enriched only after ingestion?

A: When enrichment happens after ingestion, the SIEM already absorbs the full cost and the analyst gets context too late. That means routing decisions are made without enough information, sensitive data may already be stored, and triage slows because analysts must reconstruct context manually. Upstream enrichment avoids that waste.

Q: How do organisations know if telemetry governance is working?

A: Look for fewer unnecessary ingestions, higher-value events reaching the SIEM, and clearer ownership of collection rules and routing logic. A working programme can explain why data is collected, who can change it, and how enrichment improves both cost and detection outcomes.

Technical breakdown

Why selective telemetry collection matters in AI-driven operations

Selective telemetry means collecting only the signals that support a specific operational or detection outcome, rather than ingesting every available event. In AI-driven environments, that matters because models, analytics pipelines, and SIEM workflows all amplify whatever data they receive, good or bad. Low-quality telemetry creates cost, noise, and decision risk. Structured telemetry adds consistent fields and context so downstream systems can query, correlate, and automate reliably. The security issue is not just volume. It is whether the data path preserves enough meaning to support defensible action.

Practical implication: define data collection policy by use case, not by source availability.

Agent and agentless collection are complementary, not competing patterns

Agent-based collection gives local context, policy enforcement, and richer control over what leaves the endpoint or workload. Agentless collection reduces footprint and can be useful where deployment constraints are high. The false binary arises when teams treat the choice as ideological instead of operational. Modern environments mix asset types, latency requirements, compliance needs, and ownership models, so no single collection method fits all cases. The real design question is where context must be captured and where routing decisions should occur.

Practical implication: use collection method by asset risk and control requirement, not by default standard.

Pre-SIEM enrichment changes the economics of detection

Pre-SIEM enrichment attaches context before data reaches the primary analytics tier. That can include asset identity, threat intelligence, geolocation, or environment classification. Once the event is enriched, routing decisions become more accurate because the pipeline can distinguish low-value routine activity from signal worth retaining at full fidelity. This changes the economics of detection because ingestion is no longer a blind pass-through. It becomes a policy decision about what deserves expensive retention and what can be stored more cheaply without losing future investigative value.

Practical implication: enrich at the edge or in-stream before telemetry hits the costliest platform.

NHI Mgmt Group analysis

Telemetry governance is becoming a first-class identity problem. Once AI agents and automation consume security data, the question is no longer only what gets collected, but who or what is authorised to influence downstream decisions. That makes telemetry pipelines part of the trust boundary, especially when service accounts, API keys, and workload identities are involved. The practitioner conclusion is simple: telemetry controls now need identity controls around them.

Agent sprawl creates data sprawl unless collection is policy-led. The article is right to challenge the agent versus agentless debate, because the real issue is control placement. If organisations deploy sensors without policy about scope, they generate unnecessary cost, noise, and exposure. This maps to broader governance failures seen in over-collected security data and under-defined ownership. The practitioner conclusion is that collection strategy must be tied to business asset classification and downstream use cases.

Pre-ingestion routing is a governance mechanism, not just an optimisation trick. The most important shift in the article is that enrichment and filtering happen before the expensive platform sees the data. That means the security programme is deciding what counts as operationally relevant at the edge, which is a material control point. For identity and access teams, the parallel is clear: the earlier a policy decision is enforced, the less ambiguity remains later. The practitioner conclusion is to treat routing rules as governance artefacts.

Structured telemetry is becoming the common language between security tooling and AI systems. If the data is not structured, AI agents and analytics workflows inherit ambiguity and make brittle decisions. That creates a new dependency between data quality and machine decision-making that identity teams should recognise immediately. It also reinforces why NHI governance matters in adjacent security domains: machine-consumed data is only as trustworthy as the identities, permissions, and policy controls that shaped it. The practitioner conclusion is to align telemetry design with identity assurance.

What this signals

Telemetry programmes are starting to look more like governance layers than plumbing. As AI systems and automated workflows consume more machine-generated data, security teams need to know which identities can alter collection logic, which enrichment rules are trusted, and where policy enforcement happens in the pipeline. The related governance question is not just volume control, but whether the data path is itself well-controlled.

Context-bearing collection: the next operational advantage will come from capturing enough identity and asset context at the edge to support trust decisions later. That matters for teams trying to reduce SIEM cost without weakening investigative value, and it aligns with the broader shift toward controlled data movement in security operations. For background on how NHI risk compounds when access is poorly governed, see The State of Non-Human Identity Security.

The forward signal for practitioners is clear: telemetry architectures will increasingly be evaluated the same way identity platforms are evaluated, by scope, ownership, and policy control. If a service account or API key can change what is collected or routed, that identity deserves the same scrutiny as any privileged admin account. Where AI agents consume those streams, telemetry quality becomes a prerequisite for trustworthy automation.

For practitioners

• Define telemetry scope by use case Create collection policies that specify which assets, events, and fields are required for each detection, response, or compliance objective. Remove default broad collection where the data is not used, and review scope alongside asset classification.
• Separate context capture from central retention Capture identity, environment, and risk context as close to the source as possible, then route telemetry based on that enrichment before it reaches the highest-cost platform. This reduces blind ingestion and makes retention decisions defensible.
• Treat collection methods as control choices Use agent-based collection where local policy enforcement or richer context is needed, and agentless methods where footprint matters more than depth. Document why each method is used so operational teams can defend the design during review.
• Align telemetry controls with identity governance Map the service accounts, API keys, and workload identities that can change collection or routing rules, then apply least privilege and review their access lifecycle. The same trust assumptions that govern NHI access should govern telemetry control planes.

Key takeaways

• Telemetry in AI-heavy environments is becoming a governance issue because collection choices now shape trust, cost, and downstream decision quality.
• Identity and access controls matter in telemetry pipelines whenever service accounts, API keys, or workload identities can alter what data moves.
• Pre-ingestion enrichment and policy-led routing are the controls that separate useful signal from expensive noise in modern security operations.

Key terms

• Structured Telemetry: Structured telemetry is security data that has been normalized into consistent fields, types, and meaning before downstream analysis. Instead of forcing analysts or models to interpret raw log variation, it preserves context at ingest. That makes correlation, triage, and AI reasoning far more reliable.
• Pre-SIEM Enrichment: Pre-SIEM enrichment is the process of attaching security context to telemetry before it reaches the SIEM. That context can include identity data, asset ownership, geolocation, or threat intelligence, allowing teams to make a routing decision before they pay indexed-storage costs.
• Telemetry-driven governance: Telemetry-driven governance is a control approach that relies on runtime signals rather than periodic paperwork. For AI, that means watching drift, leakage, prompt anomalies, and other live indicators so governance decisions reflect current system behaviour instead of stale review findings.
• Agent Sprawl: Agent sprawl is the uncontrolled growth of AI agents, scripts, and automation identities across teams and environments. It creates governance strain because each agent can introduce its own permissions, secrets, and ownership gaps, making revocation, review, and accountability harder to sustain.

What's in the full article

DataBahn's full article covers the operational detail this post intentionally leaves for the source:

• Why the Smart Agent is positioned as a lightweight collection layer for reducing agent sprawl and storage waste
• How the vendor describes the agent versus agentless decision across asset type, risk profile, and latency needs
• What pre-SIEM enrichment and routing look like in practice for telemetry cost control
• Which Black Hat 2025 context and examples the source uses to frame the market shift

👉 The full DataBahn article covers the Smart Agent concept, agent versus agentless trade-offs, and pre-SIEM enrichment examples.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners who need to connect access control to operational risk. It is designed for security teams building stronger identity-led control across modern environments.