Topic starter
02/08/2026 11:53 am
TL;DR: Customer environments processed 79 billion events and 1.29 million alerts in 2025, with 97% of alerts requiring no analyst investigation and 98% later judged benign or false positives, while NHI density reached 14.5:1 and AWS made up 67% of telemetry on average, according to Exaforce. The operating lesson is that cloud-scale SOCs now depend on identity context, not just more log volume.
Editorial analysis by NHI Mgmt Group, based on content published by Exaforce: “Exaforce Agentic SOC 2025 year in review”.
By the numbers:
- Exaforce processed 79 billion events and over 1.29 million alerts across customer environments.
Key questions
Q: What breaks when cloud SOC teams cannot connect identity context to alert triage?
A: Alerts become isolated signals instead of actionable investigations.
Q: Why do non-human identities complicate SOC workflows?
A: Non-human identities complicate SOC workflows because they often operate at machine speed, carry persistent access, and generate activity that looks normal until it is correlated with privilege and asset criticality.
Q: What are the signs that cloud alert triage is failing?
A: Common signs include repeated manual pivots across consoles, long gaps between alert and verdict, inconsistent outcomes between analysts, and unresolved queues for identity-related alerts.
Practitioner guidance
- Standardise identity-aware alert enrichment Attach workload ownership, token provenance, and expected activity baselines to cloud alerts before analyst review so that machine-driven events can be separated from human-driven anomalies.
- Prioritise triage rules by identity type Create distinct handling paths for human users, service accounts, tokens, and automated workloads so the SOC can avoid applying the same triage logic to fundamentally different entities.
- Reduce analyst load with first-pass dispositioning Automate obvious benign cases and low-value noise so analysts spend time on alerts that combine privilege, unusual cloud activity, or third-party context.
Bottom line: The article shows that cloud SOCs are not failing because they lack alerts, but because they have too much low-value telemetry and too little identity context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:02 pm
Identity context is now a SOC control plane issue, not an enrichment nice-to-have. The article shows that cloud telemetry alone cannot distinguish routine machine activity from meaningful abuse at scale. When non-human identities and third-party dependencies dominate investigation paths, the SOC’s effective control surface shifts toward identity-aware correlation and lifecycle context. Practitioners should treat identity context as a core triage input, not a post-processing label.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should SOC teams respond when third-party dependencies become part of daily risk?
A: They should treat delegated access, partner integrations, and shared telemetry as part of the investigation boundary. That means triage, escalation, and scoping must account for external identity paths, not just the systems the organisation directly owns or administers.
👉 Read our full editorial: Agentic SOCs are redefining triage as identity and cloud noise grows