TL;DR: Telemetry pipelines optimized for observability can erase adversarial context before security teams need it, according to DataBahn. The real risk is not transport efficiency but using the same retention and compression logic for data that serves different investigative and operational purposes.
At a glance
What this is: DataBahn says unified telemetry pipelines can undermine security by applying observability-style optimisation to data that needs evidentiary retention and adversarial context.
Why it matters: IAM, NHI, and SOC teams should treat security telemetry as evidence, not exhaust, because the same compression logic that helps operations can break investigations, correlation, and auditability.
Context
Telemetry pipelines are often designed around efficiency first, with the assumption that logs, metrics, and traces can be governed the same way regardless of whether they support operations or security. That assumption breaks when data must later prove malicious intent, reconstruct privilege abuse, or preserve identity and access context across long attack chains.
The article’s core governance point is that observability data and security telemetry have different retention needs, different value horizons, and different failure consequences. For identity teams, this matters wherever authentication events, privilege changes, service account activity, or workload access logs may become evidence long after the original event has passed.
Key questions
Q: How should security teams separate observability and security telemetry in practice?
A: Use different policy objectives for each stream. Observability data can be sampled, compressed, and retained for shorter periods because it exists to explain service health. Security telemetry should preserve the metadata needed for later correlation, forensic reconstruction, and identity investigation. If one pipeline serves both purposes, route by evidence value first and cost second, not the other way around.
A: Because cost and volume logic can suppress the rare events that make attacks visible. A pipeline tuned for short-term operational relevance may discard low-frequency signals, identity context, or partial attack chains that only matter after correlation. Security value is often retrospective, so optimisation must preserve the option to investigate later.
Q: What breaks when AI relevance scoring is used to filter security telemetry upstream?
A: The pipeline can start filtering evidence as if it were noise. If the model is trained on recent alert history or common behaviour, it may suppress dormant credentials, slow privilege escalation, or unusual identity activity that is critical in an investigation. That creates blind spots exactly where adversaries try to hide.
A: Yes. Authentication, privilege, and workload access events often become the core evidence in breach investigations, access reviews, and audits. They deserve longer retention, stronger enrichment, and clearer ownership than generic operational telemetry because their value can emerge long after collection.
Technical breakdown
Why observability-style sampling breaks security telemetry
Observability pipelines are designed to reduce volume, compress patterns, and keep only what is useful for operational health. Security telemetry is different because its value often emerges later, after correlation with other events or after a suspicious sequence becomes visible. Sampling can be rational for performance data, but it is dangerous for evidentiary data because the event that looks low value today may become the missing link in an investigation months later. This is especially true when adversaries stay below alert thresholds or move slowly across systems. The architecture must therefore distinguish performance truth from adversarial truth.
Practical implication: keep security telemetry on retention and access paths that preserve later reconstruction, even when the same source feeds observability workflows.
How AI relevance scoring can hide low-frequency attack signals
AI-driven relevance scoring often assumes that what has not recently triggered alerts is low value. That is a weak assumption for security because many attacks are sparse, low-and-slow, and intentionally normal-looking. A model trained on short-term usage patterns may compress away events that appear statistically unimportant, including dormant credentials, rare privilege changes, or delayed lateral movement indicators. In security terms, absence of recent investigations is not evidence of safety. Relevance must be judged against adversarial behaviour, not only operational frequency. Otherwise the pipeline becomes a filter for noise and a filter for evidence at the same time.
Practical implication: validate any upstream scoring model against adversarial cases, not just alert volume reduction or ingestion cost.
Why enrichment timing determines whether telemetry remains useful
Enrichment adds context such as asset ownership, identity resolution, geolocation, and threat intelligence to raw events. When that enrichment happens before ingestion, the pipeline can decide whether an event deserves full-fidelity retention while the evidence is still in motion. When enrichment happens after ingestion, analysts pay the ingestion cost first and receive context too late to change routing or retention decisions. That distinction matters because enrichment is not just an analyst convenience. It is what makes telemetry searchable, attributable, and defensible when an incident must be reconstructed.
Practical implication: move context attachment upstream so routing decisions can be made on enriched evidence rather than raw event volume.
Threat narrative
Attacker objective: The attacker’s objective is to remain detectable only after the evidence needed to reconstruct the intrusion has already been downsampled, compressed, or discarded.
- Entry occurs through normal-looking telemetry that enters a unified pipeline optimized for operational efficiency rather than evidentiary preservation.
- Credential abuse, privilege escalation, and low-and-slow movement can be compressed away when the pipeline treats rare security signals as noise.
- Impact appears later as missing investigative context, incomplete event chains, and reduced ability to prove what happened during an incident.
Breaches seen in the wild
- reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
- CI/CD pipeline exploitation case study: Credentials in an exposed .git/config let a researcher edit a Bitbucket pipeline so it planted their SSH key on the server. No victim was named.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Telemetry intent is now a governance boundary, not a data-handling detail. Security programmes fail when observability logic is allowed to govern evidence retention, because the same optimisation that helps operations can erase adversarial context. The decisive question is no longer how much telemetry an enterprise can collect, but whether the pipeline preserves the data needed to prove intent later. Practitioners should treat retention strategy as part of security governance, not only data engineering.
Telemetry intent gap: this is the failure mode that explains why a single pipeline can look efficient and still be operationally unsafe for security. The article shows that performance data and security evidence have different lifecycles, so combining them under one optimisation model creates a hidden control conflict. That conflict matters most in investigations where identity events, privilege changes, and long-horizon attack chains must remain reconstructable. Practitioners should separate evidence preservation from observability optimisation.
AI relevance scoring is only as safe as the threat model behind it. If the model learns from recent alert frequency, it will underweight the rare signals that adversaries deliberately produce. That creates a false economy: reduced volume at the cost of degraded detection fidelity. In security telemetry pipelines, relevance must be defined by adversarial value, not by historical operational popularity. Practitioners should demand threat-informed scoring controls before trusting any upstream suppression logic.
Identity evidence is part of the telemetry problem. Authentication events, privilege changes, and workload access logs are not just application noise; they are the evidence trail for identity abuse and NHI-related compromise. If unified pipelines compress those records too aggressively, identity teams lose the chain needed to investigate service account misuse, dormant credential abuse, or lateral movement. Practitioners should preserve identity-linked telemetry with longer retention and stronger reconstruction guarantees than ordinary observability data.
Security outcomes depend on separating budget logic from evidentiary logic. Cost reduction is legitimate, but it cannot be the primary filter for deciding what security data survives. The moment retention policy is driven by ingestion price or short-term alert history, investigative integrity becomes the trade-off. That is a structural governance choice, not a tuning issue. Practitioners should force explicit ownership for that decision across SOC, platform, and identity operations.
What this signals
Intent-aware telemetry is becoming a security governance requirement. The practical lesson for programmes is that a single ingestion strategy rarely serves both operational monitoring and incident reconstruction. Teams should decide, in advance, which events must survive compression and which can safely flow through observability-first optimisation. That decision needs SOC, platform, and identity ownership, not just pipeline tuning.
Identity-linked evidence is where the intent gap becomes visible fastest. Authentication logs, privilege changes, and workload access records are the records most likely to matter later in an investigation, yet they are often the first to be normalised into generic telemetry flows. Security architects should preserve those signals with explicit retention and enrichment rules, especially where NHIs or service accounts are involved.
For practitioners
- Preserve security telemetry separately from observability data Define which logs, traces, and identity events must retain evidentiary value and keep them on security-specific retention rules rather than shared compression logic.
- Move enrichment before ingestion for security events Attach identity resolution, asset ownership, geolocation, and threat intelligence while data is in motion so routing decisions use context, not raw volume.
- Test relevance scoring against adversarial scenarios Challenge any AI-based suppression model with rare privilege changes, slow lateral movement, dormant credential abuse, and long-horizon attack chains.
- Set longer retention for identity-linked evidence Keep authentication, authorisation, and workload access records accessible long enough to support investigations, audits, and reconstruction across extended incident timelines.
- Separate cost optimisation from security governance Assign explicit ownership for retention decisions so platform teams can tune efficiency without silently overriding SOC or identity evidence requirements.
Key takeaways
- Telemetry pipelines break security outcomes when observability optimisation is applied to data that must remain usable as evidence.
- The core risk is not transport efficiency but the loss of context needed to reconstruct identity abuse, privilege escalation, and slow-moving attacks.
- Security teams should preserve evidentiary telemetry, enrich it before ingestion, and keep retention decisions separate from cost-driven observability policy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | The article centres on retaining security evidence and preserving telemetry integrity across pipeline stages. |
| DE.CM-01 — Networks and systems and network communications are monitored to detect potential cybersecurity events | The article is about monitoring data that must remain useful for detection and investigation. | |
| Recommendation — Protect security telemetry so compression and routing decisions do not destroy evidentiary value. Monitor telemetry paths to ensure security-relevant events survive collection, enrichment, and retention decisions. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The article focuses on preserving logs and event context for later investigation. |
| Recommendation — Apply audit log management to retain and protect security events independently of observability optimisation. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article cites dormant credentials and lateral movement as signals that unified pipelines may compress away. |
| Recommendation — Map low-frequency credential access and lateral movement patterns to telemetry retention rules. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | The article is about whether retained telemetry still supports later analysis and investigation. |
| Recommendation — Use AU-6 to keep audit data available for later review instead of filtering it away at ingestion. | ||
Key terms
- Telemetry Gap: A missing or incomplete stream of security events that prevents the SIEM from building a reliable picture of activity. In hybrid environments, telemetry gaps often appear where identity context is weakest, turning visibility problems into detection and governance problems.
- Security Telemetry: The logs, events, and configuration data that let defenders understand and prove what happened in a system. For SaaS governance, telemetry is what turns an application from a black box into something the security team can review, alert on, and investigate.
- Observability Telemetry: Observability telemetry is data such as metrics, traces, and debug logs used to understand system health and performance. It is typically designed for aggregation, sampling, and short- to medium-term analysis rather than long-term forensic use.
- Stream Enrichment: Stream enrichment is the process of attaching context to telemetry while it is moving through the pipeline, before it is stored or queried. In security operations, it allows routing, triage, and retention decisions to use threat intelligence, identity, and asset context in real time.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader telemetry and detection decisions their programmes depend on.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org