Notifications
Clear all
Topic starter
11/08/2026 3:19 pm
TL;DR: Security teams are now juggling 17 alert-generating tools on average, with larger enterprises nearing 30, while organisations generate 960 alerts daily and spend up to 70 minutes investigating each one, according to Prophet’s State of AI in Security Operations 2025 and CrowdStrike’s threat reporting. The core problem is not alert volume alone, but the loss of cross-tool context that leaves identity, endpoint, email, and network signals disconnected.
NHIMG editorial — based on content published by Prophet: Why Your Security Stack Needs an AI SOC Orchestrator
By the numbers:
- organizations deploy an average of 17 alert-generating security tools
- larger enterprises utilizing nearly 30 such platforms
- organizations now generate an average of 960 alerts daily
Questions worth separating out
Q: How should security teams use AI in the SOC without weakening human oversight?
A: Use AI for enrichment, clustering, summarisation, and draft recommendations, but keep humans responsible for containment decisions that affect access, identity state, or business-critical workflows.
Q: Why do identity signals matter in AI-driven SOC investigations?
A: Identity signals matter because many security decisions depend on who acted, from where, with what access, and whether the behaviour fits the user's normal pattern.
Q: What breaks when security tools are investigated in isolation?
A: Investigations slow down, context gets lost, and analysts miss links between email, endpoint, identity, and cloud activity.
Practitioner guidance
- Define identity-first investigation paths Map the exact steps analysts take when an alert begins with IAM, email, or NHI signals, and document which systems must be queried before escalation.
- Measure cross-tool confirmation time Track how long it takes to confirm a suspicious event using SIEM, EDR, IAM, and cloud telemetry together.
- Treat identity telemetry as core SOC data Include login anomalies, privilege changes, service account activity, and token use in orchestration design so the AI does not rely only on endpoint or network evidence.
What's in the full article
Prophet's full analysis covers the operational detail this post intentionally leaves for the source:
- How its AI SOC orchestration maps investigations across existing tools without relying on fixed playbooks
- The specific operational workflows used to reduce manual pivoting across SIEM, EDR, IAM, and email consoles
- Benchmark details on investigation time reduction and what implementation teams need to validate before deployment
- The evaluation criteria Prophet says security leaders should use when comparing AI SOC approaches
👉 Read Prophet's analysis of AI SOC orchestration and tool-sprawl reduction →
AI SOC orchestration: what it means for SOC teams and IAM signals?
Explore further
11/08/2026 3:31 pm
AI SOC orchestration is becoming the control layer between telemetry and decision-making. SOCs have accumulated specialised point tools faster than they have built a way to reason across them. The practical shift is from managing alerts to managing investigative context, which is where identity data becomes decisive. For IAM teams, that means identity telemetry should be designed as a first-class signal in SOC workflows, not as a separate console the analyst checks later.
A question worth separating out:
Q: How should organisations decide whether AI orchestration is worth adopting?
A: Prioritise it when your analysts spend too long pivoting between tools, when identity events are central to your incidents, or when alert volumes exceed the team’s ability to correlate them manually. The right test is not whether the technology is fashionable, but whether it reduces investigation time and improves evidence quality.
👉 Read our full editorial: AI SOC orchestration could cut investigation times from minutes to hours
