Topic starter
09/07/2026 3:25 pm
TL;DR: 96% of security leaders see critical visibility gaps, 77% report higher alert volume, and 67% still lack identity and access behavior visibility, even as 87% evaluate or deploy AI-powered SOC tools, according to Gurucul's 2025 Pulse of AI-Powered SOC Transformation report. AI can speed triage and investigation, but SOC modernisation fails if identity data remains a blind spot.
Editorial analysis by NHI Mgmt Group, based on content published by Gurucul: ““2025 Pulse of AI-Powered SOC Transformation Report” Out Now!”.
By the numbers:
- 96% of respondents acknowledged critical blind spots, most notably in cloud infrastructure and identity and access behavior.
- 67% of organizations still lack visibility into identity and access behavior.
- 77% of organizations have seen an increase in alert volume.
Key questions
Q: How should security teams implement AI-driven SOC coverage without losing identity visibility?
A: Start by mapping every alert source the AI can actually see, then verify that identity provider logs, privilege changes, cloud authentication events, and workload telemetry are included.
Q: Why do identity-driven threats become harder to contain when SOC tools are fragmented?
A: Fragmented tooling slows correlation, especially when identity abuse moves across cloud, access, and investigation layers.
Q: What are the warning signs that AI SOC automation is becoming unsafe?
A: Look for actions taken without a linked case, approvals that happen after execution, investigation summaries that cannot be traced back to source evidence, and workflow changes that only one team member understands.
Practitioner guidance
- Prioritise identity telemetry ingestion Bring identity, entitlement, and access behaviour data into SOC pipelines before broadening AI use cases, so prioritisation and enrichment have reliable context.
- Reduce telemetry fragmentation Map which sources are delayed, duplicated, or absent across SIEM, cloud, and identity workflows, then remove the handoffs that force analysts to reconstruct the same event chain in multiple tools.
- Use AI first for high-volume triage Apply automation to alert triage, enrichment, and false-positive suppression before trusting AI with higher-risk decision paths, because those are the areas where adoption has already shown the strongest operational gain.
Bottom line: AI-powered SOC programmes do not solve the visibility problem if identity and access behaviour remain under-monitored.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:44 pm
Identity visibility is now a SOC control plane issue, not a logging issue. The report shows that AI adoption is rising while identity and access behaviour remain among the least visible parts of the environment. That means the SOC is modernising its processing layer without closing the governance gap in its input layer. Practitioners should treat identity telemetry as core detection infrastructure, not supplementary context.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when AI adoption outpaces SOC visibility maturity?
A: Treat AI as an amplifier of existing governance, not a substitute for it. Before expanding agentic or automated workflows, teams should verify that the SOC can ingest identity data reliably, correlate it across cloud and access systems, and explain why an alert was prioritised over others.
👉 Read our full editorial: AI-powered SOCs expose the identity visibility gap in modern defence