Topic starter
11/11/2026 6:01 pm
TL;DR: The biggest failure mode is fragmented investigative reach, according to Query, because agents that query one source at a time miss cross-system evidence and can confidently return incomplete answers. Security teams need a common way to reach identity and telemetry sources before they trust any automated conclusion.
Editorial analysis by NHI Mgmt Group, based on content published by Query: “Data reach is the problem worth solving in security”.
Key questions
Q: Why do security investigations fail when sources are spread across tools?
A: They fail because analysts cannot correlate events across identity, endpoint, cloud, and application records quickly enough to build a complete timeline.
Q: How does federated search improve security investigations?
A: Federated search lets an analyst run one query across multiple connected tools, such as SIEM, EDR, cloud logs and ticketing data, without first copying all records into one place.
Q: How should teams investigate a service account login from an unexpected device?
A: Treat the login as a potential account compromise and validate the device, source IP, geolocation, authentication method, and session history against the service account's approved use.
Practitioner guidance
- Map investigative reach across critical sources Inventory which identity, endpoint, network, DLP and data warehouse sources are queryable by your SOC workflows, then mark any source that is ingest-only or unreachable by API.
- Validate cross-source field normalisation Test whether time, host, IP and identity fields resolve to one shared format before the query leaves the agent layer, especially for sign-in, firewall and DLP logs.
- Escalate anomalous service account logins Treat interactive logins from service accounts as high-priority investigative events and require correlation with endpoint, directory and network telemetry before closure.
Bottom line: Security investigations can look complete while still missing the sources that would change the answer, especially when identity and telemetry data live in separate systems.
Glossary terms: Service Account, Federated Search, Sign-In Logs, Data reach
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Data reach is now a first-class security control: investigations fail when the right evidence cannot be queried where it lives, even if each individual tool is functioning. Query shows that the problem is not simply more data, but the ability to reach identity, network and endpoint sources in one investigation path. That makes reach a governance issue, not just a tooling convenience. Practitioners should treat source accessibility as part of detection design, not as an afterthought.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What signals indicate that a service account has been abused?
A: Interactive logons, unfamiliar source hosts, atypical time-of-day use, and sudden access bursts are the most useful signals. A service account should have a narrow behavioural pattern. When it starts acting like a person, or begins touching mailbox or cloud resources it never used before, treat that as compromise until proven otherwise.
👉 Read our full editorial: Data reach turns security investigations into fragmented puzzles