Topic starter
06/11/2026 6:38 pm
TL;DR: 55% of organisational data is unknown or unused, with most of the dark data sitting in logs, according to Uptycs, and valid-credential abuse can leave evidence uninvestigated when security teams only analyse a fraction of what they collect. That gap turns log volume into a governance problem, not just a detection problem.
Editorial analysis by NHI Mgmt Group, based on content published by Uptycs: “Juno for Splunk: Find the signal in an ocean of unused logs”.
By the numbers:
- 55% of organisational data is unknown or unused, and most of that dark data is log data.
- 78% of security leaders said their security tools were dispersed and disconnected.
Key questions
Q: How do security teams detect cloud credential abuse before fraud starts?
A: Look for validation and discovery behaviour, not only successful compromise.
Q: Why does disconnected telemetry make intrusion detection harder?
A: Disconnected telemetry makes intrusion detection harder because analysts lose the ability to correlate events across identity, cloud and endpoint controls, so attacker activity looks isolated instead of part of one chain.
Q: What is the best way to prioritise alerts by business impact?
A: Prioritise alerts by business impact by mapping each event to the criticality of the affected system, the sensitivity of the affected data, and the likely operational effect of loss, misuse or downtime.
Practitioner guidance
- Map telemetry to investigation priorities Define which identity, cloud, endpoint and network sources must be joined before an alert is considered actionable, then test those joins against a real intrusion path.
- Hunt for valid-credential abuse across systems Review sign-in logs, cloud control-plane events and server access records for the same account appearing in multiple places with inconsistent intent or geography.
- Assign business context to exposed assets Tag systems by data sensitivity, regulatory exposure and service criticality so that an investigation can rank compromise by impact rather than by alert count.
Bottom line: The main risk is not the absence of telemetry but the absence of correlation, which lets identity abuse and cloud misuse stay hidden in plain sight.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Telemetry without correlation is a control gap, not a tooling inconvenience. Security teams often assume that more logs automatically mean better detection, but the article shows the opposite when those logs remain disconnected. Identity events, cloud actions, endpoint signals and network records all existed, yet the relationship between them was hard to see. The practical lesson is that investigation quality depends on how evidence is connected, not how much of it is collected.
A question worth separating out:
Q: How can investigation context improve incident response decisions?
A: Investigation context improves incident response by showing what the alert affects, who or what has access, and which dependencies or privileges are involved. Enriched context from asset inventory, identity data, logging and change records helps responders separate false positives from real compromise and choose containment steps that avoid unnecessary disruption.
👉 Read our full editorial: Disconnected security telemetry leaves valid-credential attacks unseen