Identity Threat Detection

Identity is the new perimeter · humans, services, machines

Risky identities
47
+6
Suspended today
9
+3
Privilege drift
14 users
over baseline
Insider risk score
Low
tenant-wide

Top risky identities

  • DI
    diane.k@fintech.io
    CFO · Impossible travel · MFA fatigue · 3 risky sessions
    91
    risk
    critical
  • SV
    svc-backup
    Service account · Interactive login · Kerberoast attempts
    88
    risk
    critical
  • J.
    j.pham@fintech.io
    Engineer · Off-hours S3 access · new device
    74
    risk
    high
  • CO
    contractor14@vendor.io
    Contractor · Privilege escalation · unusual repo pull
    68
    risk
    high
  • M.
    m.owens@fintech.io
    VP Sales · Consent grant to unknown app
    52
    risk
    medium

Dormant privileged accounts

No activity but still enabled

  • ex-employee-1042
    Idle 84dAdmin (AWS)
  • svc-legacy-etl
    Idle 220dRead (Prod DB)
  • intern-summer-23
    Idle 312dContributor (GitHub)

Behavioral baseline

Per-user model drift · outliers highlighted

nominalwatchanomalybreach candidate96 identities · 24h window