Topic starter
02/08/2026 11:53 am
TL;DR: GigaOm, according to Exaforce, compared 19 SecOps automation vendors and highlighted an agentic SOC model that links detection, triage, investigation, and response across identities, resources, and time. Security operations now depends on whether automation can preserve identity context well enough to support correct response decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Exaforce: “Exaforce Named a Leader and Outperformer in the 2025 GigaOm Radar for SecOps Automation”.
By the numbers:
- GigaOm compared 19 vendors across key features, emerging features, and business criteria dimensions.
Key questions
Q: Why does AI-driven SecOps increase the importance of identity governance?
A: Because automation decisions increasingly depend on whether the system can trust, link, and interpret identity-linked events correctly.
Q: What are the signs that agentic SOC automation is misconfigured?
A: Look for agents that can reach beyond their intended workflow, generate actions without clear evidence trails, or make repeated decisions that analysts cannot explain after the fact.
Q: What breaks when SecOps automation cannot correlate identity context well enough?
A: Detection becomes fragmented, triage slows down, and incident responders lose the ability to distinguish related activity from unrelated noise.
Practitioner guidance
- Define identity-aware correlation requirements Specify how your SOC platform must join users, service accounts, cloud resources, and time-based events before it can automate triage or response.
- Test AI triage for explainability Require incident outputs to show why events were linked, what context was used, and which evidence supported the recommended action.
- Separate enrichment from decisioning Keep normalisation, deduplication, and entity enrichment upstream of any autonomous response step so the model sees a coherent record.
Bottom line: The article reflects a wider SOC shift away from static playbooks and toward AI-driven correlation across identities, resources, and time.
Glossary terms: Agentic Soc, Identity-linked SOC reasoning, Pre-LLM data layer, Entity-centric correlation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:02 pm
Identity context is becoming a first-class SOC control surface: Once detection and response depend on stitching events across identities, resources, and time, identity data stops being a back-office enrichment field and becomes part of the operational decision chain. That changes governance expectations for IAM, PAM, and cloud teams because the SOC now depends on identity fidelity to drive response quality. Practitioners should treat identity telemetry as part of the detection architecture, not just an adjacent data source.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How should teams govern automated response in the SOC?
A: Treat every automated action as a controlled change. Define preconditions, approval boundaries, logging requirements, and rollback steps before allowing the system to change access, isolate systems, or terminate sessions in production.
👉 Read our full editorial: GigaOm recognition highlights identity-aware SOC automation
This post was modified 2 days ago by NHI Mgmt Group