Identity threat detection: are SIEM, EDR and SOAR enough?

TL;DR: SIEM, EDR, and SOAR can still miss identity abuse when attackers log in with stolen credentials or hijacked sessions, because the authentication succeeds and the activity looks legitimate, according to Blackpoint Cyber. The missing control is identity threat detection and response, which watches for misuse after access has already been granted.

Editorial analysis by NHI Mgmt Group, based on content published by Blackpoint Cyber: “Is Identity Threat Detection Already a Gap in Your Security Stack?”.

By the numbers:

• Microsoft reported a 32% surge in identity-based attacks in the first half of 2025.
• More than 97% of identity attacks are password attacks, according to Microsoft’s Digital Defense Report 2025 cited by Blackpoint Cyber.

Key questions

Q: What breaks when a security stack relies on MFA but does not monitor identity behaviour after login?

A: The control fails at the point where authentication succeeds but trust should be re-evaluated.

Q: Why do valid credentials and session tokens remain such an effective attack path?

A: Because they let attackers operate inside trusted access paths instead of breaking in noisily.

Q: How do you know if identity threat detection is actually working?

A: Look for shorter mean time to detect and mean time to respond, plus fewer incidents where suspicious sessions persist for hours.

Practitioner guidance

• Instrument post-authentication identity telemetry Alert on unusual sign-in geography, unexpected hours, suspicious infrastructure, and active sessions that move from their origin point.
• Track mailbox and grant abuse signals Monitor new inbox rules, auto-forwarding changes, deletions, and OAuth grants as indicators of account takeover rather than nuisance noise.
• Separate detection from prevention in your control design Validate that your programme can detect a misused valid credential after MFA succeeds, not just block unauthorised logins.

Bottom line: A mature stack can still leave identity abuse visible only after the attacker is already inside the account.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →