Zero Assumptions · Week 9 of 25 · Pillar 2: Software stack & contextual risk
Your SIEM fired an alert at 09:14.
Your EDR caught the same attack at 09:24.
Two tools. Same attacker. Ten minutes apart. Neither told the other. Your analyst saw two separate alerts in two separate consoles and triaged them as two separate incidents. The attacker had already moved.
|
In weeks 6, 7, and 8 we covered the operational gaps between assessment cycles, session windows, and board oversight. This week we move to the layer that connects all of them — or fails to. The signal orchestration layer that should be correlating risk signals from your identity provider, EDR, SIEM, network monitoring, and physical access control in real time — but isn't.
The assumption most security architectures are built on: each security tool fires alerts when it detects a threat. The SOC reviews those alerts and identifies patterns. That is how attacks are detected.
The reality: your tools generate signals in isolation. An impossible-travel alert in your identity provider and a lateral movement alert in your EDR firing ten minutes apart are almost certainly the same attack. Nothing in your stack correlates them automatically in real time — and your analyst is looking at a queue of 847 other alerts.
|
45%
Of SOC analysts report that alert fatigue causes them to ignore or deprioritise alerts they know may be significant — because the volume makes it impossible to investigate every signal before the next wave arrives. The problem is not detection. It is correlation and prioritisation.
Source: Tines — Voice of the SOC Report 2024
|
Why your tools don't talk to each other — and what that costs you
Enterprise security stacks are built by accumulation. An identity provider here, an EDR vendor there, a SIEM from a third, network monitoring from a fourth, physical access control from whoever built the building. Each tool is best-in-class for what it does. None of them were designed to share a common signal taxonomy, a shared entity model, or a real-time event correlation layer with each other.
The result is a stack that generates enormous volumes of individually correct but contextually isolated signals. A user authentication event in Azure AD has no awareness of an endpoint process injection event in CrowdStrike that occurred for the same user 8 minutes earlier. A network anomaly in Darktrace has no link to the impossible-travel alert in Okta that preceded it. Each tool fires correctly. No tool fires with full context.
Attackers understand this architecture better than most defenders do. The multi-stage attack — initial access via credential theft, lateral movement via Pass-the-Hash, privilege escalation via Kerberoasting, data exfiltration via a cloud storage API — generates signals across four different tools in four different consoles. Each signal individually looks like a medium-severity alert. Correlated together, they are a critical incident in progress. Without real-time correlation, you see four medium alerts. The attacker sees a clear path.
| Tool |
Signal it generates |
What it misses without correlation |
| Identity provider |
Impossible travel — user authenticated in Stockholm at 09:00, Copenhagen at 09:12 |
That the same user's endpoint had a process injection event at 08:58 |
| EDR |
LSASS memory access attempt — medium severity, no execution |
That the same user authenticated from an impossible location 14 minutes later |
| SIEM |
Lateral movement — SMB traffic spike between workstations |
That the source account had an authentication anomaly 22 minutes earlier |
| Network monitoring |
Unusual DNS query pattern — potential C2 beacon |
That the originating host has been generating credential-related EDR alerts for 40 minutes |
| Physical access |
Server room badge entry at 02:17 — valid credential |
That this user also authenticated to cloud services from a different country at 02:09 |
|
19 days
The median dwell time for attackers in environments with mature individual tool deployments but no cross-tool correlation layer — compared to under 5 days in environments with real-time signal orchestration. The tools are working. The integration layer is the gap.
Source: Mandiant M-Trends Report 2024
|
|
The blueprint — three layers of signal orchestration
Layer 1 — Shared entity model: Every tool must refer to the same user, device, and session identifiers. When your EDR fires on a device, your SIEM and identity provider must be able to correlate that device to a specific user session and authentication event using a shared identifier — not a best-guess match on hostname or IP. Hardware security keys solve this at the identity layer: the credential that authenticates the user to the identity provider is the same physical token that generates the audit trail across every system it touches, creating a consistent entity anchor across your entire stack.
Layer 2 — Real-time cross-tool correlation: Deploy a SOAR (Security Orchestration, Automation and Response) layer or a modern XDR platform that ingests signals from all tools in real time and applies correlation rules across them. The specific rule that would have caught the scenario above: any combination of an identity anomaly + endpoint signal + network anomaly for the same entity within a 30-minute window escalates automatically to critical and pages an analyst — regardless of the individual severity of each alert. This is not AI detection. It is logic applied to signals your tools are already generating but not connecting.
Layer 3 — Physical/logical convergence: Your physical access control system must feed into the same correlation layer as your logical security tools. A badge entry at 02:17 from a user whose cloud account authenticated from a different country at 02:09 is not a valid access event — it is either credential theft or tailgating, both of which are critical incidents. Without the physical signal in the same correlation engine, you will never see it. This is the gap we will cover in full in Week 10.
|
The one control that solves the entity model problem at its root
The signal correlation problem is partly a technology problem — but it starts as an identity problem. If every tool in your stack refers to the same user differently (UPN in the IdP, SAM account in the EDR, email address in the SIEM, badge ID in physical access), no correlation engine can reliably join those signals in real time without a matching layer that introduces latency and errors.
A hardware security key solves this at the credential layer. The same physical token authenticates the user to cloud SSO, Windows domain login, VPN, and — with a PIV-capable key — physical access control. Every authentication event across every system carries the same cryptographic identifier derived from the same hardware credential. Your correlation engine doesn't need to guess whether "john.smith@company.com" in Azure AD is the same person as "JSMITH" in Active Directory and badge number 4471 in the access control system. They all resolve to the same hardware token.
|
Hardware keys — the identity anchor your correlation engine needs
NeoWave — ANSSI-certified, CC EAL6+, FIDO2 + PIV, EU sovereign supply chain
French-engineered, ANSSI Security Visa certified, CC EAL6+ secure element. Supports both FIDO2 (for cloud SSO and modern authentication) and PIV (for Windows domain, VPN, and physical access control integration). One token, one cryptographic identity, across your entire logical and physical access stack. The sovereign supply chain certification makes it the right choice for regulated industries, defence, and critical infrastructure where the manufacturer's national jurisdiction is a board-level procurement consideration.
Feitian BioPass K49 — CC EAL6+, on-device fingerprint, FIDO2 + PIV, PQC-ready
CC EAL6+ secure element with on-device fingerprint — the template never leaves the chip, authentication is user-bound not device-bound. FIDO2 and PIV support brings the same unified identity anchor across cloud, on-premises, and physical access. PQC-ready via ML-KEM/ML-DSA hardware co-processor. For workforce-scale deployment where biometric binding eliminates the PIN-sharing and token-handover risk that undermines the shared entity model.
One hardware token across every system means one entity identifier across every signal. That is the foundation your correlation layer needs to work. Both keys are available through Ciptor.
|
|
Series recap — where we are
Pillar 1 (Weeks 1–5): EDR blind spots, AiTM bypass, deepfake helpdesk, hardware supply chain, hybrid Kerberos blindspots.
Week 6 — Risk assessment integration: Point-in-time assessments vs continuous monitoring. Identity drift is invisible between cycles.
Week 7 — Session token vulnerability: 207 days to detect. 50% of incidents at the weekend. Device-bound tokens close the gap.
Week 8 — Boardroom accountability: NIS2 Article 20 personal liability. Five documents every CISO must deliver to their board.
Week 9 — Signal orchestration: Two tools, same attacker, ten minutes apart, no correlation. The entity model is the fix.
Week 10 (next): Your building access control and your IT security tools are separate systems. An attacker who badges in at 02:00 generates a log entry your SOC will never see.
|
Coming up next week
Week 10 — Convergence of physical and logical access
Your building access control system and your IT authentication stack are separate. A valid badge entry at 02:17 from a user whose cloud account authenticated from a different country at 02:09 is a critical incident. Without the physical signal in the same correlation engine, you will never see it. Week 10 closes Pillar 2.
|
Free passwordless audit
Do your security tools share an entity model — or is each one using a different identifier for the same user?
In a free 30-minute passwordless audit we'll review your current authentication stack, map how your identity signals flow across your tools, and show you what a unified entity model looks like operationally — with a hardware key as the anchor.
No sales deck. No follow-up unless you ask.
|
The best security stack in the world generates the right signals. The question is whether anything connects them before the attacker reaches their objective. The answer is almost never yes — and the fix starts with a single identity anchor that every tool in your stack can resolve to the same person.
Mikael Rodin
Managing Director, Ciptor
P.S. If your identity provider, EDR, and SIEM are each using a different identifier for the same user — book a free 30-minute audit. That gap is the most common reason cross-tool correlation fails, and it is the most preventable.
New to the series? Start at ciptor.com/zero-assumptions/zero-assumptions-vol-1/
