Inside the Modern SOC: Defending the Cross-Environment Pivot
Palo Alto Networks, Thursday, September 17th, 2026
Unit 42 walks through how attackers pivot across endpoint, identity and cloud, and how a SOC can catch it.
Unit 42 describes the cross-environment pivot, where an intrusion that begins on an endpoint moves through identity systems into cloud infrastructure.
The post argues that siloed detection tooling routinely misses these transitions because each environment sees only part of the chain. It walks through incident patterns drawn from Unit 42 casework and the correlation signals that reveal the pivot in progress.
Recommendations focus on unified telemetry and detection engineering that spans all three domains.