Topic starter
06/11/2026 6:38 pm
TL;DR: SASE has already fused networking and security at the edge, but most SOCs still work through fragmented SIEM, identity, endpoint, cloud and response tools, leaving MSSPs to absorb the operational cost of disconnected workflows, according to Stellar Cyber. The next convergence point is the SOC, where AI-driven correlation and case-centric investigations can turn edge context into usable security decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Stellar Cyber: “How Cato Networks and Stellar Cyber Can Provide MSSPs a Modern, Integrated Operating Model from the Edge to the SOC”.
Key questions
Q: How should a SOC use SASE telemetry in investigations?
A: A SOC should use SASE telemetry to correlate access events, policy decisions, session details and network paths so investigators can reconstruct what a user, application, location and policy context saw at the time.
Q: Why does fragmented security tooling slow down incident response in modern SOC operations?
A: Fragmented tooling slows response because analysts lose context across disconnected systems.
Q: How do case-centric investigations improve security operations?
A: Case-centric investigations organise alerts, logs and artefacts around one evidence thread, so analysts work from a single incident record rather than hopping between disconnected tickets.
Practitioner guidance
- Build a case-centric SOC workflow Group SASE events, identity signals, endpoint telemetry and cloud evidence into one investigative record so analysts can move from signal to context without manual reconstruction.
- Standardise multi-tenant intake and correlation Define one repeatable path for how SASE context enters the SOC, how it is deduplicated, and how cases are opened across customer environments.
- Map edge context to identity evidence Treat user, application, session and policy metadata as investigation inputs that must be correlated with account and privilege evidence before response decisions are made.
Bottom line: The core issue is not lack of telemetry, but lack of a shared operating model that can carry edge context into the SOC.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
SASE-to-SOC convergence is now an operating-model problem, not a feature problem. The security industry already solved part of the edge with converged networking and policy, but most organisations still move that context into a fragmented SOC where every telemetry source behaves differently. That creates analytical drag, especially when identity, endpoint and cloud signals need to be interpreted together. The practical conclusion is that the control point has shifted from collection to correlation.
A question worth separating out:
Q: How should MSSPs standardise SOC workflows across tenants?
A: An MSSP should standardise SOC workflows with a common intake, enrichment, deduplication and case-building process so each tenant is handled consistently. That means normalising alert formats, removing duplicates, adding context such as asset, identity and threat data, and creating cases with the same triage fields, escalation rules and evidence structure.
👉 Read our full editorial: SASE context is reshaping SOC workflows for MSSPs