Who should own agentic insider threat cases: the SOC, IAM team or identity governance function?

How ownership should be split across SOC, IAM and identity governance

agentic insider threat cases are cross-functional by nature, but ownership is not shared in the same way across the whole lifecycle. The SOC is the natural owner of active response because it is built to triage alerts, preserve evidence and coordinate containment. IAM supplies entitlement and access context, while identity governance validates business ownership, access purpose and recertification history. That split should be defined before an incident starts, not negotiated during one.

A practical way to think about the case is by decision layer. Detection and response belong with the SOC; access facts belong with IAM; accountability and business justification belong with identity governance. If those layers are blurred, the case often stalls on basic questions such as who can revoke access, who understands inherited privilege, and who can say whether the agent or user was acting within an approved role. The same principle appears in NHIMG’s IAM and IGA Basics, where authentication, authorization and access review are treated as distinct functions rather than one team’s catch-all responsibility.

This also means ownership should be written as a decision matrix, not a vague RACI. For example, the SOC should own incident ticketing, evidence handling and escalation timing; IAM should own entitlement lookups, session or token context, and immediate access changes; identity governance should own whether the access relationship was appropriate for the job, vendor relationship or delegated function. When the case concerns non-human access, lifecycle and ownership questions become harder to ignore, which is why NHIMG’s NHI Lifecycle Management Guide is a useful reference for understanding how ownership, visibility and offboarding need to line up.

What the SOC needs that IAM and governance do not provide

The SOC should not be reduced to a passive notification queue. It needs authority to coordinate the response, decide when a case is suspicious enough to escalate, and preserve the timeline of activity around the agent, credential or account in question. In agentic cases, the immediate question is often not just “who owns the identity?” but “what did that identity actually do, and how fast do we need to contain it?” NHIMG’s AI Agent Observability, Audit and Incident Response Guide is relevant here because attribution, logging and kill-switch thinking are central to making response actionable.

IAM’s contribution is different: it should answer what access existed, how it was granted, whether it was standing or time-bound, and whether the affected identity had broader reach than the business expected. That context lets the SOC distinguish routine automation from abusive use, and it helps responders understand whether the safest containment action is credential rotation, token revocation, policy tightening or full account suspension. Where the case involves agent permissions and delegated authority, NHIMG’s AI Agent Authorisation Guide provides the right access-control lens.

Identity governance contributes the least operational speed, but often the most organisational clarity. It can confirm who approved the access, whether it matched the role or business function, and whether the case exposes a broader entitlement design problem. That matters because many agentic insider threats are only partly technical; they become serious when access was excessive, poorly reviewed, or never properly owned. NHIMG’s Top 10 NHI Issues is a useful reminder that ownership gaps and access sprawl are recurring failure patterns, not edge cases.

How to set the operating model before the next case

The cleanest operating model is to predefine three things: who leads, who supplies facts, and who approves business interpretation. The lead should be the SOC for active cases, because the work is time-sensitive and evidence-driven. IAM should be the named technical support function for access and entitlement facts. Identity governance should be the policy and ownership authority for questions about whether access was legitimate, properly approved, or still needed.

That model only works if escalation triggers are explicit. If the case shows unusual privilege, suspicious delegation, or evidence that an agent is acting beyond its intended scope, the SOC should escalate immediately rather than waiting for a governance review cycle. If the issue is mainly a control design flaw, such as poor recertification or unclear ownership, governance should lead the remediation work after containment. For broader NHI control design, NHIMG’s Ultimate Guide to NHIs, Regulatory and Audit Perspectives helps frame the audit trail, ownership and accountability questions that sit behind the operational response.

Teams also need a shared evidence pack for every case: identity owner, approver, entitlement set, scope of access, last successful use, and whether the activity aligns with the approved business purpose. Without that, ownership becomes opinion-based, and opinion is a poor substitute for response authority when an agentic case is moving quickly.

Practitioner Guidance

What to prioritise: Define the case lead first. If a response is already underway, stop debating taxonomy and assign the SOC to run containment, evidence collection and handoff timing.

What to verify: Confirm that every agent, workload or account in scope has a named owner, a current entitlement view, and a documented business purpose. If any of those are missing, treat the case as both an incident and an ownership defect.

Decision rule: If the issue is “what happened now?”, let the SOC own it. If the issue is “what access existed?”, let IAM answer it. If the issue is “should this access have existed at all?”, bring identity governance into the decision.

Practitioner takeaway: The best operating model is not joint ownership of everything; it is clear lead ownership for response, with IAM and identity governance supplying the facts and accountability needed to make containment and remediation defensible.

Related resources from NHI Mgmt Group

• What makes agentic AI an NHI governance issue?
• Why is it important to integrate identity and data governance?
• What is the difference between human IAM controls and NHI governance?
• What does the 144:1 NHI-to-human ratio mean for IAM governance programmes?