Inside the Modern SOC: Defending the Cross-Environment Pivot

The Cross-Environment Gap

Our series, Inside the Modern SOC: Trends and Insights from Unit 42 Managed Services, shares the operational patterns that Unit 42 experts observe, with today's challenge beginning after the initial foothold.

Across Unit 42 investigations, we continue to see adversaries move well beyond where an attack begins. They pivot across the enterprise, avoiding detection by exploiting the visibility gaps created by disconnected security tools.

According to the 2026 Unit 42 Global Incident Response Report, 43% of attacks involved activity across four or more attack surfaces, with some cases spanning as many as eight. As attacks move across cloud, endpoint, network, identity and software-as-a-service (SaaS) environments, analysts must connect activity across security domains before the complete attack path becomes clear.

Following the Attack Across Environments

The First Signal

An investigation may begin with what appears to be an isolated event. An endpoint generates an alert. A cloud administrator provisions a resource outside of normal activity. An unfamiliar application requests elevated permissions. On its own, none of these events necessarily signals a broader attack.

The Cross-Environment Pivot

As the attack progresses, related activity begins appearing elsewhere. Permissions may change within a SaaS application. Cloud resources may be provisioned or reconfigured. Sensitive data may be staged for exfiltration. New network connections may emerge between systems that rarely communicate.

When these signals are investigated separately, security teams can miss the connection between them and the larger attack taking shape across the environment.

Reconstructing the Attack Path

The complete picture often becomes clear only when activity across security domains is connected. AI-driven correlation connects signals that initially appear unrelated, helping analysts reconstruct how an adversary gained access, where they moved, what they accessed and what they were attempting to accomplish.

Because attackers don't operate within the boundaries monitored by individual security tools, security operations can't either. Defenders need to follow attacker activity across the enterprise and investigate the intrusion as one connected attack. Doing this consistently requires continuous monitoring and response, along with ongoing optimization of detections, correlation rules and workflows as threats and environments evolve.

How SOC Leaders Can Defend Across Attack Surfaces

Use AI to Investigate the Attack, Not the Alert

As attackers move across security domains, security leaders should evaluate whether their operations can reconstruct a complete attack path rather than respond to isolated alerts. The goal is to use AI-driven correlation to reveal how seemingly unrelated activity connects before an adversary reaches their objective.

Connect Evidence Across the Attack Path

To track adversarial behavior from the first signal across every stage of the attack lifecycle, organizations must connect evidence across their security environment through lateral movement, persistence and impact. True visibility requires cross-domain correlation, while threat hunting should test for attacker behaviors that may not yet have generated an alert. SOC leaders should ensure their platforms automatically correlate activity into unified incident storylines, giving analysts the context to investigate and respond without manually pivoting between tools or teams.

Continuously Test and Evolve Security Operations

Treat every investigation as an opportunity to improve the next one. Review where analysts lost context, where detections or correlation rules could be improved and which response steps created delays. Use those findings to refine detection logic, correlation rules, automation and response playbooks as attacker techniques and the environment evolve.

How Unit 42 Managed Services Applies These Principles

As attacks increasingly span multiple environments, AI-driven correlation and behavioral analytics in the Cortex SecOps platform bring related signals together into a unified investigation. Unit 42 analysts apply frontline expertise and threat intelligence to validate the attack path, investigate coordinated activity and accelerate response.

Our Managed Detection and Response (MDR) analysts continuously investigate suspicious activity while our threat hunters combine AI-powered insights with Unit 42 expertise to proactively search for attacker behaviors that may not yet have generated an alert. Insights from investigations and hunts help strengthen detections, refine correlation rules and improve response workflows across customer environments.

Organizations using Managed XSIAM extend this approach through continuous SOC engineering delivered by Unit 42 experts. Our teams continuously optimize:

• Data integrations
• Detection logic
• Custom correlation rules
• Automated response playbooks
• Investigation workflows

Continuous SOC engineering helps reduce investigation and response time by optimizing the detections, correlation rules, automation and workflows that power AI-driven security operations.

The Unit 42 Managed Services Edge

Unit 42 combines expert-led MDR, Managed Threat Hunting and Managed XSIAM to help organizations investigate attacks as one connected incident. Powered by AI-driven capabilities in the Cortex SecOps platform, our experts apply insights from thousands of investigations, threat hunts and incident response engagements to accelerate response and continuously improve security operations.

Learn more about Unit 42 Managed Services.