Topic starter
02/08/2026 11:59 am
TL;DR: Security data fragmentation lets one attacker appear as five unrelated events across cloud, SaaS, and collaboration tools, while enterprises process an average of 24,000 unique log sources and retain less than 15% of available telemetry, according to DataBahn and MITRE ATT&CK. Unified identity resolution and pre-ingestion routing now matter more than adding another AI layer.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “Your AI Security Investment Will Fail Without This Foundation”.
Key questions
Q: What breaks when identity resolution is left to the SIEM?
A: When identity resolution is left to the SIEM, schema drift, custom parsers, and inconsistent source fields create silent failures.
Q: Why does fragmented telemetry create risk for AI-enabled SOC operations?
A: Fragmented telemetry weakens AI because models inherit the quality and consistency of their inputs.
Q: How can teams tell whether identity enrichment is working in the SOC?
A: Look for shorter investigation paths for high-risk identities, fewer false positives on low-risk accounts, and more consistent escalation decisions across analysts.
Practitioner guidance
- Implement identity resolution at ingestion Map cloud, SaaS, endpoint, and collaboration identifiers to a single verified identity before events reach the SIEM or AI layer.
- Preserve cross-system identity context Carry immutable relationships between usernames, email addresses, service principals, and session tokens through the pipeline so investigations can reconstruct one actor’s path.
- Route telemetry by identity value Send high-fidelity, identity-rich events to detection while diverting routine logs to cheaper storage based on enriched context.
Bottom line: Fragmented identity data, not weak AI, is what allows one attacker to look like several unrelated events across cloud and SaaS telemetry.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:06 pm
Identity stitching is now a governance control, not a reporting convenience. If the same actor cannot be resolved consistently across cloud, SaaS, endpoint, and collaboration telemetry, the organisation does not have a reliable security picture. That weakness affects human identity and NHI oversight alike, because service accounts, API keys, and user accounts all depend on clean attribution. Practitioners should treat entity resolution as part of the control plane, not as an analytics afterthought.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should security teams normalise identity data in the SIEM or upstream?
A: Upstream is the better choice when identity fragmentation is widespread. Normalising at query time pushes correlation cost into investigations, while upstream resolution lets routing, detection, and retention decisions use the same verified identity context from the start.
👉 Read our full editorial: Identity stitching is the real problem behind AI-powered SOC data