There are perspectives you only earn with the years. Today’s comes from someone with around 15 years in information security, roughly 12 of them spent inside SOCs, seeing first-hand how the way we detect, investigate and respond was changing.
Juanma started at Incibe after winning a CTF, moved through offensive security, specialized CERT services and an internal lab, worked on a project about security in industrial environments, and later as a NATO contractor in event analysis in Belgium. Since 2022 he has been part of an MDR service in the EMEA region, as a principal analyst.
We talked from the analyst’s chair: what keeps a SOC up at night, why legitimate access has become the hardest terrain, and what he’d change if he could. He isn’t after headlines or controversial opinions, he’s after precision. What follows are his answers, unfiltered.
8Layers: You’ve spent 12 years working in SOC and detection. Over those years in security operations, what has changed the most in the work of a SOC?
Juanma: Yes, of the roughly 15 years I’ve been working in the information security sector, about 12 of them I’ll have spent in SOCs.
I’d say that in my own experience, which may be very different from that of other people in the sector, several things have changed, like the way teams are organized, since I see a greater tendency to remove the tiers, giving analysts more autonomy.
You can also see a change in the way of working, since we went from waiting for various static indicators to generate an alert, to creating more “intelligent” detections based on multiple factors.
Another important point is that people started to recognize that it’s impossible to stop everything, and that the goal is, when there’s an intrusion, to be able to recognize it and stop it with the least impact in the least possible time.
Also, with the tiered organization, investigations were slower, cases passed through various analysis queues before you could act, whereas now things are handled at greater speed. And from the attacker’s point of view, speed is a very important factor, since we see campaigns where they go from initial access to ransomware in minutes/hours.
Lately I’d say the focus is on identities, legitimate access, cloud activity. We see many investigations based on knowing whether whoever is doing something, besides being legitimately authorized to do it, is who they say they are.
8L: What would you say are the best-known problems for someone working in a SOC today? Is there any type of attack or pattern you feel SOC teams are still ill-equipped to see, despite all the available tools?
Juanma: To mention one of the problems teams have, I’d say one of the main ones is still the noise, along with alerts lacking information that make analysis slower and more complex. And both cause a lot of mental fatigue.
Multiple threat-sharing tools have been introduced that in theory should help reduce noise and increase information, but that in practice, in many cases, haven’t been integrated correctly, increasing the noise by treating indicators that should go together individually. This also means other mechanisms have to be created to solve it, which adds processing time and cost.
As for the blind spots, there’s a lot of difficulty with attacks that use legitimate resources, like those having to do with the theft of cookies, tokens, compromised accounts, service accounts, etc. These kinds of threats aren’t associated with visible malware, there’s no anomalous activity shown by an endpoint (if there is one).
Detecting a service account/user that seems legitimate behaving slightly differently over a short period of time is, I think, one of the main problems right now.
8L: What’s harder to investigate, a compromised endpoint or a compromised identity? Why?
Juanma: Both cases have their complexity and certain situations can be more or less difficult, but speaking generally, I’d say a compromised identity is harder.
In principle, a compromised machine generates more telemetry than an identity, or at least it’s more feasible to determine whether that telemetry represents malicious activity or not. There are the processes, network connections, changes to files/registry, etc.
On the other hand, if an attacker gets in using valid credentials, with MFA already completed or through the theft of an authenticated session, and their actions are aligned with the role of the compromised account, everything seems to indicate the activity is legitimate, and only small details can make you suspicious of it.
In those cases, the difficulty is no longer in determining whether an action is allowed, but in knowing whether whoever is carrying it out is really the legitimate user.
8L: Has that increase in the volume and types of identity (like AI agents) changed the reality for your team?
Juanma: It makes the work more complex and requires more communication with the client, since there are more identities to monitor, each with its own context to understand. More identities mean more distinct behavior patterns, and that also causes more false positives.
There are service accounts, APIs, automations and more and more AI agents, and that requires adequate context or knowledge provided by the client in order to determine whether their behavior is the expected one.
Can an employee access this system? And what about an AI agent? This requires a knowledge of the business that the SOC doesn’t usually have.
With AI agents there’s also the challenge of understanding and controlling their scope of action. An agent with broad permissions and access to multiple systems can become a significant risk. Even without being directly compromised, it could be induced to carry out unintended actions through the abuse of its capabilities or a poor configuration.
In our case we started to see alerts generated by these agents; however, the level of visibility depends a lot on the integrations and controls each organization has implemented.
8L: Have you had cases where you realized the attacker was using a legitimate identity or access?
Juanma: Yes, several times.
In most cases this activity was related to email services.
The interesting thing is that there usually weren’t clear indicators of compromise. The first signs were usually small changes in behavior: the location wasn’t the usual one, or the time, or the device, or slightly different actions from those the account had historically performed were observed.
Digging deeper, we were able to verify that the attacker had gained access to the account and was using exclusively legitimate functionalities of the environment, like for example creating forwarding rules, sending a limited number of internal emails aimed at compromising other accounts, etc.
In some cases, the lack of visibility required contacting the client so they could validate the observed activity against the logs we weren’t receiving in the SOC. This is very relevant in techniques like MFA bombing, where the SOC’s ability to act depends to a large extent on the telemetry received.
These kinds of cases are complex since it’s the sum of several actions, apparently legitimate individually, that ultimately determines whether there’s unauthorized access or not.
8L: If you could solve a single thing in your detection stack, with no budget or technology constraint, what would it be?
Juanma: In that case, I personally would focus on having the maximum context, backed by complete, normalized and enriched telemetry. This would allow for more precise detections and, above all, significantly reduce investigation time.
Most of the problems we see in a SOC don’t come from a lack of events, but from a lack of context to interpret them correctly.
For example, from the identity point of view, having information about the user’s usual access context would be enormously valuable. I’d like to know the user’s schedule and working hours, whether they have work planned outside of hours, whether they’re allowed to use anonymization services and which ones and under what conditions.
Having information about how many MFA requests were made before the successful login, what the details of their authorized connection device are.
It would also be useful to know their ISP in case they’re allowed to work from home, or in case of working while traveling, to know where they’ll connect remotely from and over what period of time.
If it’s a service account, automation, AI, etc., it would be very useful to have information about its scope, expected behavior patterns, execution schedules and systems it should access.
SOCs don’t need more alerts, but they do need much more context.
8L: Do you have any unpopular opinion about identity security in the cybersecurity world, or about SOC operations, that you’d defend even knowing a lot of people wouldn’t agree?
Juanma: I don’t usually have especially controversial opinions on these topics. Over these years I’ve learned that most problems have many nuances, and that what works in one organization may not work in another. More than defending unpopular positions, I prefer to focus on understanding the context and finding practical solutions to the problems we see day to day.
After twelve years in a SOC, Juanma’s conclusion isn’t a sweeping opinion, but a calm insistence: the problem is rarely a lack of alerts, it’s a lack of context to understand them. An access with valid credentials, an MFA already passed, an account behaving “almost” as always: there, it’s no longer about knowing whether an action is allowed, but about knowing whether whoever performs it is who they say they are. And to answer that, you don’t need more events. You need to understand who, and what, we’re looking at.
Identity Attack, Unfiltered
Identity Attack, Unfiltered is 8Layers’ biweekly series where we give security experts the floor to talk, unfiltered, about identity risk: how they see it from the field, what worries them, and what they’d do differently. Each conversation adds a different perspective, from governance to digital forensics, from the SOC to threat intelligence.
The series grows out of what we do at 8Layers: uniting in a single view of identity what normally lives apart: posture, detection, and compliance.
Do you work in identity security and feel you have something to contribute? We’d love to hear from you. Write to us at marketing@8layers.io and tell us your perspective; you could be the next voice in the series.