Notifications
Clear all
Topic starter
27/08/2026 2:11 pm
TL;DR: Identity security only delivers full value when it is connected to the security operations centre, according to Nexis, and this webinar argues that siloed identity and SOC workflows slow response when critical events unfold. The practical question is how teams coordinate identity context, detection, and response without adding more manual handoffs.
NHIMG editorial — here’s why we think this discussion matters
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
Questions worth separating out
Q: How should security teams integrate identity data into SOC workflows?
A: Start with the identity events that change response decisions, not with every available log.
Q: Why do technology silos create identity risk?
A: Because identities move across systems faster than org charts do.
Practitioner guidance
- Map identity signals into SOC workflows Identify which identity events must reach the SOC in real time, including authentication changes, privileged access events, and NHI lifecycle updates.
- Define the minimum response context for each actor type Specify the identity fields analysts need for humans, NHIs, and automated workloads, including ownership, entitlement scope, last change time, and offboarding status.
- Test containment using identity-to-security handoffs Run exercises where the response team must contain a suspicious account or token using only the integrated identity and security workflow.
What to expect at the briefing
Nexis's full briefing covers the operational detail this post intentionally leaves for the source:
- How the NEXIS Platform and IVIP capabilities are positioned to connect identity and security workflows.
- The live presentation format with Alexander Puchta and Ivan Pepelov, including the practitioner angle they bring.
- The source webinar context and registration details for teams that want the full discussion directly from the speakers.
👉 Register for Nexis's webinar on identity security and SOC integration →
Webinar: identity security and SOC integration - 2026-10-07?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
27/08/2026 2:12 pm
Identity security only becomes operationally useful when the SOC can consume it in real time. Identity programmes that remain isolated from detection and response workflows turn access state into archival information instead of active defence context. That leaves analysts guessing at entitlement scope, recent changes, and account criticality when speed matters most. The practitioner takeaway is that identity data must be treated as live security telemetry, not post-incident evidence.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: Who should be accountable when identity risk spans IAM and security operations?
A: Both teams, but with different responsibilities. IAM owns identity context, ownership, and lifecycle state, while security owns abuse detection, threat correlation, and containment. When those functions stay separate, no one has a complete picture of who or what can actually move through the environment.
👉 Read our full editorial: Identity security and SOC integration for faster response
