Yes, if the goal is faster containment and less ambiguity during active events. A shared workflow does not remove specialist roles, but it does let both teams work from the same identity evidence and response state. Without that, the organisation keeps paying a coordination penalty every time an alert turns into an investigation.
When a shared workflow helps, and when it does not
A single incident workflow is usually the right choice when identity operations and SOC both need to see the same facts, make time-sensitive decisions, and preserve one response state. It reduces duplicate triage, avoids conflicting actions, and makes escalation cleaner. The benefit is strongest when the event involves account compromise, token abuse, privilege changes, or other identity-driven attack paths.
A shared workflow does not mean shared ownership of every action. Identity operations still owns identity changes, access decisions, and lifecycle fixes, while the SOC drives detection, containment, and investigation coordination. The practical aim is one case, one timeline, and one set of decisions, not one team absorbing the other.
The workflow should be built around the evidence both teams actually need: suspicious authentications, credential events, privilege changes, session activity, revocation status, and recovery state. Where those signals are split across tools or queues, Identity Threat Detection and Response (ITDR) becomes the bridge between alerting and action, because identity compromise rarely stops at one system or one analyst queue.
What a shared workflow changes in the response model
The biggest operational change is that the incident becomes a coordinated identity event instead of two separate tickets. That matters because identity evidence often evolves quickly, revoked access may need to be verified, and containment decisions can affect business continuity. If teams work from different timelines, they can easily reverse each other’s actions or miss the order in which compromise unfolded.
A shared workflow also improves decision quality. Identity operations can confirm whether an account was disabled, a token rotated, or a risky delegation path removed; the SOC can confirm whether the activity stopped, whether the attacker pivoted, and whether the same pattern appears elsewhere. That division of labour is most effective when the case system captures who changed what, when it changed, and what evidence justified the change.
For teams that manage non-human credentials as well as human ones, the workflow should make room for service accounts, API keys, and workload identities. The same incident can require containment of both human access and machine access, so lifecycle visibility is not a separate admin concern, it is part of the response record. NHI lifecycle management is especially useful here because offboarding, rotation, and inventory state often determine how fast containment can be completed.
Where shared workflows break down in practice
Shared workflows fail when “shared” becomes vague ownership. If no one is clearly accountable for revocation, investigation updates, or case closure, the organisation gains a single queue but loses decision speed. Another common failure is treating identity operations as a downstream execution team after the SOC has already finished the investigation, which leaves remediation lagging behind the attacker’s dwell time.
They also break down when identity data is incomplete. If the incident process does not capture inventory, ownership, last use, and privilege scope, teams cannot reliably tell whether the affected identity is business-critical, stale, or overprivileged. That is where structured identity governance and incident context need to meet. Top NHI issue patterns are helpful as a reminder that stale accounts, shared credentials, and excessive permissions often turn a small compromise into a much larger containment problem.
Workflow design also needs to account for post-containment verification. An account can be disabled and still remain dangerous if active sessions, cached tokens, delegated access, or duplicate credentials survive the initial response. The incident process should therefore require a proof step, not just an action step, before declaring the identity path contained.
Risk and Threat Considerations
When identity operations and SOC functions run separate incident workflows, the organisation increases the chance of delayed containment, duplicated actions, and inconsistent truth during an active compromise. That creates room for attackers to keep using the same account, token, or delegated path while teams debate who owns the next step.
Failure mechanism: The defender loses shared state, so one team revokes access while another is still basing decisions on stale evidence, or both teams assume the other has already closed the gap. In identity-led incidents, that gap is enough for persistence, lateral movement, or re-entry through leftover credentials or sessions.
Impact: Response time stretches, evidence becomes harder to trust, and remediation work gets repeated or undone. In the worst case, the organisation contains the alert but not the identity path, which leaves the attacker with a second chance to act.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-17 — Incident Response Management | Shared incident workflows directly improve coordinated response handling. |
| Recommendation — Centralise identity-led incidents in one response process with clear ownership and escalation. | ||
| NIST SP 800-53 Rev 5 | IR-4 — Incident Handling | The question concerns coordinated handling of incidents across teams. |
| AU-6 — Audit Record Review, Analysis, and Reporting | A shared workflow depends on using the same evidence and response state. | |
| Recommendation — Define a common incident-handling workflow with identity and SOC roles explicitly assigned. Use shared logging and review processes so both teams work from the same incident evidence. | ||
| NIST CSF 2.0 | RS.CO-02 — Incidents are reported consistent with established criteria | The question is about cross-team incident coordination and reporting state. |
| Recommendation — Set one reporting path and one case state so identity and SOC teams respond consistently. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Identity incidents often require coordinated removal of compromised access. |
| Recommendation — Route offboarding and containment through the same incident workflow to prevent lingering access. | ||
Practitioner Guidance
What to prioritise: Build one shared incident record with clear role separation, not one blended team process. The record should show the affected identity, the current access state, the containment actions taken, and the verification steps still outstanding.
What to verify: Do not close the incident until you can confirm that access is actually gone, not just marked for removal. For machine identities in particular, verify token revocation, key rotation, session invalidation, and any alternate credentials before declaring containment complete.
Decision rule: If the event can change identity state, treat it as a joint workflow by default. If the event is purely observational, the SOC can own the case, but the moment containment depends on an identity change, identity operations needs to be in the same workflow.
Practitioner takeaway: Shared incident handling works best when it preserves one response truth while keeping accountability separate, because speed comes from coordinated state, not from collapsing specialist roles.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org