Why security AI agents need clean telemetry to investigate well

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Query's blog post: Security AI agents are constrained by fragmented, inconsistent telemetry, and the data layer determines whether they can investigate or merely summarize partial evidence.

Why it matters: IAM, NHI and security practitioners need to treat agent access, normalization and context as control decisions, because agents can only reason as well as the data they can reliably reach and interpret.

By the numbers:

• More than 40% of security alerts go uninvestigated, according to Microsoft's State of SOC research cited by Query.
• Only 8.5% of public MCP servers implement OAuth, according to Software Analyst Cyber Research cited by Query.
• Tool poisoning attacks succeed at a 72.8% rate, according to Software Analyst Cyber Research cited by Query.

Context

Security operations fail when investigators have to stitch together telemetry that lives in different consoles, schemas and retention models. The result is not just slower triage, but weaker reasoning because the machine or human analyst never sees the full event chain. In an AI-driven SOC, that becomes an access and interpretation problem as much as a tooling problem.

A security data mesh is one answer to that gap: a way to make distributed data usable without forcing every source into one central store. AI agent observability becomes especially important here because agents need evidence trails, not only query access, if humans are going to trust the conclusions they surface.

Key questions

Q: How should security teams govern AI agents that can act across multiple business systems?

A: Treat the agent as a governed digital actor with its own identity, delegated authority, and revocation path. Give it task-scoped permissions, bind actions to policy, and require observability on every tool call and data flow. If the same agent can move across systems without clear ownership, the governance model is too weak to support production use.

Q: Why do AI agents produce incomplete investigations when telemetry is fragmented?

A: AI agents produce incomplete investigations when telemetry is fragmented because logs, alerts and traces lack shared identifiers, time alignment and context needed for correlation. Without semantic context, the agent cannot reliably join events across source systems, so evidence is missed or duplicated. Normalised schemas, common asset IDs and explicit event relationships reduce that gap.

Q: How does semantic context improve security data correlation?

A: Semantic context improves security data correlation by adding meaning to raw events, such as asset identity, user identity, process lineage, timestamps and attack stage. That lets tools link alerts from different source systems into one incident, instead of treating each record as isolated noise. Normalised fields and entity relationships are the key mechanism.

Q: What should teams do first when an AI SOC agent is missing evidence?

A: Teams should first verify which source systems are missing, then check ingestion, parsing and normalisation before asking the AI SOC agent to infer anything. If evidence is absent, the agent can only guess. Restoring feeds, fixing field mapping and confirming asset and identity context usually resolves the gap faster than tuning detection logic.

Technical breakdown

Why fragmented telemetry breaks AI investigations

AI investigation tools do not fail only when they lack access. They also fail when they can reach data but cannot reconcile different field names, taxonomies and event meanings. A source may call the same person by different identifiers, assign severity differently, or store related events in incompatible formats. The agent then has to infer relationships probabilistically, which can produce a coherent but incomplete narrative. That is the practical danger of silent hallucination in operations: the answer sounds right because the inputs were only partially aligned. See the MCP Security Guide.

Practical implication: Treat data normalization as part of the detection pipeline, not a post-processing convenience.

How semantic context changes the value of connected sources

Connectivity gives an agent reach, but context gives it judgment. An authentication event means little on its own until it is related to device, user and network evidence that shows whether the behaviour matches the environment. Semantic context is the layer that explains what a severity label, a disposition or a login pattern means in your own operating conditions. Without it, the system can correlate events but still miss the reason they matter. With it, the investigation becomes environmental rather than merely syntactic.

Practical implication: Define environment-specific semantics for severity, disposition and normal access patterns before handing investigations to automation.

Why evidence packages matter more than a single answer

An AI investigator should not be treated as an oracle. The more defensible design is one that records every query, source and correlation so a human reviewer can follow the reasoning path. That matters because even a strong model can make a faulty assumption while still surfacing useful assembled evidence. In practice, the value is not just the verdict. It is the reproducible chain of sources that lets an analyst validate, correct or close the case faster than manual console hopping would allow.

Practical implication: Require query traceability and source-by-source evidence retention for every automated investigation.

Threat narrative

Attacker objective: The objective is to exploit fragmented telemetry so the defender makes a faster but less accurate judgement about what is happening in the environment.

1. Entry begins when the agent can only query a subset of the security environment and therefore starts from partial telemetry instead of complete evidence.
2. Escalation occurs when inconsistent schemas and semantics force the agent to infer relationships probabilistically, creating a high-confidence but incomplete conclusion.
3. Impact follows when analysts act on the assembled result without an evidence trail, which can mask benign activity as a coordinated intrusion or miss the real one entirely.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The deciding control is not model quality, but evidence quality. Security teams keep framing AI agents as a reasoning problem, when the harder problem is whether the environment exposes a coherent evidentiary surface. If the agent can only see part of the picture, the output becomes a polished summary of missing context. The practical conclusion is that AI in security rises or falls on the integrity of the data layer underneath it.

Security data mesh is an access model for reasoning, not just a storage pattern. The article's real contribution is to show that distributed telemetry can still be operationally usable when connectivity, normalization and semantic context are built together. That matters for identity and NHI programmes because service accounts, authentication logs and workload events often live in separate systems that must be correlated to prove misuse. Practitioners should treat cross-source reasoning as a governance requirement, not a convenience.

Silent hallucination is the right name for incomplete but plausible AI output. The risk is not that the model invents facts in the abstract, but that it confidently resolves incompatible records into a story that never actually happened. That failure mode is especially dangerous in SOC and IAM investigations because analysts tend to trust structured output more than raw console noise. The right response is not to suppress the agent, but to make every conclusion traceable to specific evidence.

Data centralisation is not the only path to operational coverage. Many programmes still assume the answer is one platform, one schema and one repository. In practice, cost, compliance and existing investments make that unrealistic, so the governance question becomes where to normalise, where to leave data in place and how to preserve meaning across the boundary. Teams that ignore that trade-off will build AI on top of brittle centralisation assumptions.

Agentic investigations expose the boundary between automation and judgment. The strongest operating model is one where the agent assembles the evidence and the human decides what it means. That is a useful template for broader identity governance as well: machines can accelerate correlation, but accountability still depends on a reviewer who understands the business context. The field should measure success by better decisions, not by more automated output.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Coverage, not model novelty, will separate effective AI SOCs from noisy ones. Teams that keep layering agents onto fragmented telemetry will see faster summaries but not better decisions, because the limiting factor remains the quality of the underlying evidence surface. The more valuable programme shift is to normalise data, preserve source traceability and let the agent work across systems without pretending they are one.

Evidence chains will become the operational proof standard for agentic security work. Analysts will not trust an AI conclusion unless they can inspect the queries, sources and joins that produced it. That pushes SOC programmes toward deterministic joins, explicit environment semantics and reviewable investigation artefacts, rather than opaque automation that cannot be challenged or corrected.

For practitioners

• Implement cross-source data normalization Map identity, endpoint and cloud fields to shared semantics before letting agents consume them, so the same user, host or alert means the same thing everywhere.
• Preserve source-level evidence trails Require every automated investigation to retain queries run, systems checked and correlation steps used, so reviewers can validate the conclusion without re-running the case.
• Define environment-specific severity semantics Document what high severity, resolved, new and anomalous mean in your own environment, then apply those definitions consistently across tools and agents.
• Govern agent access by dataset, not just connector Decide which data sources an agent may reach, but also which fields, events and contextual joins it may use, because broad connectivity without scope control creates noisy reasoning.

Key takeaways

• AI security agents are limited less by model capability than by fragmented, inconsistent telemetry that prevents complete investigations.
• The strongest evidence in the source points to normalization, semantic context and traceable queries as the controls that make automation trustworthy.
• Security teams should measure AI SOC value by the quality of assembled evidence and analyst decision speed, not by output volume.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Identity Security Buyer's Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Identity Guide

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Security Information and Event Management (SIEM): SIEM is a security control that centralises event collection, correlation, and alerting so analysts can monitor suspicious activity. It is useful for visibility and detection, but it often produces large volumes of alerts and usually needs enrichment and response automation to become operationally effective.
• Semantic Context: Semantic context is the broader meaning of code, including purpose, intent, dependencies, and how components work together. In application security, it helps distinguish harmful patterns from benign ones and exposes issues that purely structural analysis misses. It is essential for finding business logic flaws and reducing false positives.
• Autonomous Investigation: The process of resolving an alert without step-by-step human direction. The system decides what evidence to pull next, adapts its path based on findings, and returns an auditable conclusion that a human can review and act on.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the course if your programme needs a structured way to govern machine identity, delegated access and agentic AI risk.