For years, Identity and Security Operations were often treated as separate disciplines and Identity teams focused on a familiar question, who should have access to what? The SOC focused on another question, what is happening in our environment, and is that activity malicious?

In a world dominated by cloud, SaaS, remote access, privileged accounts, APIs and machine identities, AI Identities, attackers do not always need to "break in" in the traditional sense. Sometimes, they can simply log in.

In my view, this changes the role of identity. It has become an essential source of context, control and response capability for the modern SOC.

Why does the SOC need Identity for context?

A successful login confirms that an account has authenticated. It does not establish whether the person or process using it is legitimate, whether its permissions are appropriate or whether the activity that follows should be trusted.

Security operations teams collect telemetry from endpoints, networks, cloud platforms and applications. Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) platforms help bring those signals together.

But an event without identity context can tell only part of the story.

Consider a privileged account signing in successfully. The authentication itself may appear legitimate, but security teams need to ask more detailed questions:

• Is this a human identity, service account, workload, machine or AI agent?
• What applications and data can it access?
• How privileged is the account, and were those privileges recently granted?
• Is the login coming from an expected location?
• Where required, is there an approved ticket or request justifying privileged access?
• Is this behaviour normal for that identity?
• What should happen if the account has been compromised?

The answers help analysts assess both the likelihood of compromise and its potential impact. An unusual login involving an account with limited access presents a different risk from one involving an administrator who can reach critical systems.

Identity teams understand authentication, entitlements, roles, privilege and the access lifecycle. SOC teams bring expertise in detection, investigation, correlation and response. Bringing that knowledge together makes both teams more effective.

How does Identity improve SOC investigations?

Identity context helps analysts connect activity to an account’s permissions, expected behaviour and potential reach. It gives them a stronger basis for deciding what to investigate and how urgently to act.

A login alone may reveal little. A login involving a highly privileged identity, followed by unusual access to sensitive data and unexpected behaviour, creates a much clearer reason for investigation.

Analysts need to understand whether that activity makes sense for the identity involved. Were its permissions recently changed? Is it accessing systems outside its usual responsibilities? Could the account provide a route into other parts of the organisation?

Combining identity information with endpoint, cloud, network and application telemetry helps answer those questions.

The goal should be better context. More alerts have limited value if analysts still cannot establish whose account is involved, what it can reach or why the activity matters.

How can Identity context support Incident Response?

Understanding an identity’s access and business role helps the SOC choose a proportionate response to suspected compromise.

Depending on the environment and available controls, that response could include revoking active sessions, requiring additional authentication, removing privileges, restricting access or disabling an account.

Those decisions need care. Disabling an employee account and disabling a service account supporting a critical application can have very different operational consequences.

Identity teams can help the SOC understand those dependencies. Security operations teams can explain the observed behaviour, the evidence of compromise and the urgency of containment.

Clear ownership and agreed response procedures allow teams to act with greater confidence when an incident occurs.

How can the SOC improve Identity?

The benefit works in both directions. Identity information strengthens security investigations, while SOC findings can reveal access risks that governance processes alone may miss.

Historically, many identity programmes have focused on policy and governance: should this person have access to this system?

Security operations introduces another important question: what are they actually doing with that access?

An entitlement may be approved and technically valid, while the behaviour associated with it warrants investigation. An account could begin accessing unfamiliar applications, retrieving unusual volumes of data or using privileges in ways that do not match its purpose.

Feeding these findings back into identity processes can inform access reviews, privilege changes and further investigation. It also helps organisations assess identity risk between scheduled reviews.

This matters across human, machine and AI identities. Understanding what an identity is permitted to do is essential. Understanding how it uses those permissions adds another layer of insight.

Bringing Identity and security operations together

Closer collaboration requires more than sending identity logs into a SIEM. Teams need a shared understanding of identity ownership, access rights, expected behaviour and the business impact of response actions.

A practical starting point is to make authentication, entitlement and privilege information available during SOC investigations. Teams should also agree how suspected account compromise will be handled and how investigation findings will feed back into access decisions.

Identity teams help define what appropriate access looks like. SOC teams help identify when actual behaviour challenges those assumptions.

For me, this is the central shift: identity tells the SOC what an identity is allowed to do. The SOC shows identity teams what it is actually doing.

Together, those perspectives help organisations make better decisions about access, investigation and response.

Speak to Integrity360 about bringing your Identity and security operations teams closer together.

FAQs

What is Identity Security?

Identity security protects the accounts and access rights used by people, machines, applications and AI agents. It helps organisations control who can access systems and data, what they can do and when that access should change or be removed.

Why is Identity Security important to the SOC?

Identity security gives the SOC context about account ownership, permissions and expected behaviour. This helps analysts distinguish legitimate activity from potential compromise, assess which systems could be affected and decide how to respond.

What Identity information does the SOC need?

Useful information includes authentication activity, account ownership, roles, access permissions, privilege changes and lifecycle status. Combining this with endpoint, network, cloud and application data helps analysts investigate suspicious behaviour more effectively.

Can an account with approved access still present a security risk?

Yes. An attacker can misuse a compromised account’s legitimate permissions. An authorised user may also abuse their access. Security teams therefore need to understand both what an account is allowed to do and how it actually uses that access.

How can SOC findings improve access governance?

SOC investigations can identify unexpected access, privilege misuse or behaviour that warrants a review of permissions. Feeding these findings into identity processes helps organisations reassess access when risks emerge, alongside scheduled reviews.

How should Identity teams and the SOC respond to a compromised account?

The teams should coordinate containment based on the evidence, the account’s permissions and its business role. Actions may include revoking sessions, resetting credentials, removing privileges or disabling the account. Agreed procedures help teams act quickly while considering the impact on business operations.