Topic starter
19/08/2026 3:25 pm
TL;DR: Agentic security operations should start on telemetry rather than alerts, so AI can reconstruct investigations from raw events instead of inheriting whatever upstream tools chose to flag, according to Abstract Security. That shift changes SOC value from summarising noise to building end-to-end incident context, which makes event fidelity and data modelling the real control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Abstract Security: “Agentic Security Operations: What an AI SOC Should Be”.
Key questions
Q: What breaks when SOC teams rely only on technical alerts and ignore human context?
A: When teams rely only on technical alerts, they often lose sight of why an event matters.
Q: Why do event-level correlations improve incident investigations?
A: Because incidents are temporal and relational, not single-point signals.
Q: How should security teams decide what telemetry to collect in AI-driven environments?
A: They should collect telemetry based on the security, detection, and compliance decisions the data must support, not on source availability alone.
Practitioner guidance
- Standardize event normalization across core telemetry sources Define one canonical schema for cloud, SaaS, identity, and network events so investigations can be reconstructed without translation gaps.
- Measure alert dependence in investigation workflows Track how often analysts can resolve incidents only from alerts versus from direct event correlation, then identify the sources that break reconstruction.
- Test cross-source entity resolution for identity-rich cases Validate that the same user, workload, or account can be traced consistently across Okta, Salesforce, AWS, and network logs.
Bottom line: Alert-first SOC designs inherit whatever upstream systems decide to flag, which means they can miss activity that was visible in the raw data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:10 pm
Event fidelity is now a governance control, not just an engineering detail: if the SOC can only reason from alerts, it is always constrained by somebody else’s detection choice. That creates blind spots by design, especially across identity-rich systems where the most relevant signal is often the sequence of events rather than a single trigger. Practitioners should treat normalized telemetry quality as a first-order operational dependency.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: Should organisations replace their SIEM to adopt agentic security operations?
A: Not necessarily. The article’s core architectural point is that composable blocks can be adopted one at a time if they share a common data model. That lets teams start with collection or pipeline cost, then expand into detection and orchestration once the underlying telemetry foundation is stable.
👉 Read our full editorial: Agentic siem operations start on events, not alerts