Topic starter
06/07/2026 9:42 am
TL;DR: Log, endpoint, and network telemetry no longer give SOC teams enough visibility into application runtime behavior, so application visibility must become the fourth pillar of the SOC visibility model, according to Oligo Security. The missing layer matters because many modern attacks unfold inside applications, where legacy WAF and RASP controls often fail to provide enough context or response speed.
Editorial analysis by NHI Mgmt Group, based on content published by Oligo Security: “The SOC Visibility Quad: Why Application Visibility Completes the SOC in 2025”.
Key questions
Q: How should SOC teams handle application-layer blind spots in modern environments?
A: SOC teams should treat application-layer blind spots as a visibility gap, not a tuning problem.
Q: Why do logs, endpoints, and network tools fail to fully detect application-layer attacks?
A: They each cover only part of the attack surface.
Q: What are the signs that application visibility is too weak for SOC use?
A: Common signs include repeated alerts with poor application context, vulnerability findings that do not map to real runtime exposure, and incident investigations that stop at the infrastructure layer.
Practitioner guidance
- Map application-layer blind spots Identify where current SOC telemetry stops at infrastructure boundaries and cannot see runtime function calls, dependency execution, or in-process malicious behaviour.
- Instrument runtime evidence sources Prioritise telemetry that captures actual application execution paths so detections can key off what software did, not just what traffic or logs suggest.
- Reassess WAF and RASP coverage Document which application-layer behaviours those controls still miss, especially in encrypted, distributed, or cloud-native environments.
Bottom line: The article argues that the SOC Visibility Triad no longer captures enough of the application layer to support modern detection and response.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:58 am
Application visibility is now a SOC governance issue, not a niche observability add-on. The old triad assumed that logs, endpoints, and networks would expose enough of the attack surface to support detection and response. That assumption breaks once meaningful attacker activity occurs inside application runtime, where infrastructure telemetry loses context. The implication is that SOC operating models must treat application-layer evidence as a first-class source of security truth.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: Should organisations replace WAF and RASP with application visibility?
A: No. WAF and RASP still have value, but they solve partial problems and do not by themselves expose full application runtime behaviour. Application visibility should complement those controls by giving SOC teams the missing evidence needed to understand what happened inside the software.
👉 Read our full editorial: Application visibility becomes the fourth SOC pillar in 2025