Identity threat detection now depends on five-minute MTTD

At a glance

What this is: This is an analysis of why identity threat detection now has to measure speed after authentication, with five-minute MTTD presented as the practical operating benchmark.

Why it matters: It matters because IAM, NHI, and SOC teams now need to detect misuse of valid identities before escalation or lateral movement completes, not just flag bad logins.

By the numbers:

• 82% of detections in 2025 were malware-free, according to CrowdStrike's 2026 Global Threat Report cited by Unosecur.

👉 Read Unosecur's analysis of why five-minute MTTD now defines identity threat detection

Context

Identity threat detection is the practice of spotting misuse after authentication, not just blocking failed logins. In this article, the core governance gap is that valid credentials, trusted sessions, and SaaS access can all look legitimate while an attacker is already moving through the environment.

For IAM and NHI programmes, that changes the control problem. The issue is no longer only who authenticated, but what the identity did next, what privileges it gained, and how quickly defenders can see and contain that behaviour.

The article frames five-minute MTTD as an operational benchmark for identity attacks, not as a formal compliance threshold. That makes detection and response speed part of identity architecture, especially where human, service, and cloud identities share the same trust surface.

Key questions

Q: What breaks when identity teams rely on static login thresholds?

A: Static thresholds are easy for attackers to work around and often too rigid for legitimate users. Five failed logins, a new country, or an off-hours access event may mean very different things depending on role, travel, or device. When thresholds are fixed, teams either miss real compromise or drown in false positives.

Q: When should organisations treat five-minute MTTD as a security target instead of a reporting metric?

A: They should treat it as a target when attackers can move through trusted identity paths faster than analysts can correlate logs. If the environment includes SaaS, cloud access, tokens, or service accounts, response speed becomes part of control design. The benchmark matters when delayed containment leaves an attacker room to escalate or pivot.

Q: What are the signs that identity threat detection is too slow?

A: Common signs include alerts that arrive after privilege changes have already occurred, separate tools holding authentication and entitlement data, and analysts needing to stitch together the incident manually. If detection depends on later reconstruction instead of live context, the programme is operating behind attacker speed.

Q: How should SOC and IAM teams split responsibility for identity threat response?

A: SOC teams should own detection, triage, and containment decisions, while IAM teams should provide the identity context and control paths that make those actions possible. The two functions need shared telemetry and approved response actions. If they are separated, the organisation loses time at the exact point when identity abuse is moving fastest.

Technical breakdown

Why valid credentials defeat login-based detection

Identity attacks often succeed because the credential itself is valid. When an attacker reuses passwords, refresh tokens, browser cookies, OAuth grants, service accounts, or cloud credentials, authentication succeeds and the event no longer looks like a classic intrusion. That shifts detection away from the login gate and toward post-authentication behaviour. Real-time identity monitoring has to evaluate privilege changes, resource access, and session context together. In practice, the relevant question is not whether the user signed in, but whether the resulting activity fits the identity's normal trust pattern.

Practical implication: build detection rules that key on post-authentication behaviour, not only failed authentication.

How MTTD and MTTR shape identity containment

Mean time to detect and mean time to respond become meaningful identity metrics because attackers can move quickly inside trusted paths. The article's five-minute benchmark reflects how little time defenders may have once a valid session is abused. MTTD measures how fast malicious activity is identified, while MTTR measures how quickly containment follows. If response actions lag detection, the attack window stays open. Fast ITDR therefore depends on detection, investigation, and containment being linked as one workflow rather than three separate queues.

Practical implication: measure detection and containment as one end-to-end identity response process.

Why SIEM alone is not enough for identity threat detection

A SIEM can collect identity logs, but it does not by itself resolve the identity context needed to judge risk. The article's core distinction is that ITDR focuses on permissions, sessions, authentication, privilege shifts, trust relationships, and behaviour as a connected problem. That matters because one suspicious login only becomes actionable when it is correlated with entitlement changes, unusual resource access, or abnormal activity across SaaS and cloud systems. Without that context, analysts spend their time reconstructing the incident instead of containing it.

Practical implication: join identity context before analyst review, or the SOC loses the speed advantage.

Threat narrative

Attacker objective: The attacker aims to move through trusted identity paths quickly enough to access sensitive data and expand reach before defenders react.

1. An attacker enters through a stolen session token or other valid credential, so the initial access appears legitimate.
2. The attacker assumes a privileged role and begins using trusted identity flows to reach sensitive resources.
3. The attacker pivots into another connected system before the SOC has enough context to contain the session.
4. The impact is continued privilege escalation and lateral movement inside trusted identity paths while detection is still pending.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Five-minute MTTD is now an identity governance threshold, not a SOC preference. Once attackers operate through valid sessions and trusted credentials, the governing question becomes how quickly the organisation can recognise misuse while the identity is still active. That shifts identity security from alert production to interruption speed, and it exposes programmes that still treat authentication as the end of the control path.

The assumption that post-authentication behaviour remains reviewable long enough for human-paced investigation has collapsed. Access review cadences, ticket queues, and manual correlation models were designed for slower identity misuse. When attackers can move from sign-in to privilege use in minutes, those governance rhythms no longer match the threat pace. The implication is not more review, but a different control assumption about when trust expires.

Identity threat detection now depends on joining session, privilege, and resource context into one operational picture. A login event by itself says little about compromise. What matters is whether the identity just gained a role, reached an unusual resource, or started behaving outside its established pattern across SaaS and cloud systems. Practitioners should treat identity context as a primary detection layer, not a post-incident enrichment step.

ITDR is becoming the control plane for trusted-path abuse across human and non-human identities. The article correctly points to users, service accounts, keys, and tokens as part of the same trust surface. That means the field is moving toward identity-first containment, where revocation, session termination, and privilege rollback matter as much as alert fidelity. Practitioners should align governance, telemetry, and response around that shared identity plane.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: Identity Threat Detection and Response (ITDR) Guide

What this signals

Identity threat detection now needs to operate inside the active session window. The programme question is no longer whether an identity is authenticated, but whether abuse can be recognised and contained before the session becomes the attacker's bridge to other systems. That requires tighter coupling between detection, session control, and privilege rollback than many IAM stacks currently expose.

Five-minute MTTD is a useful planning signal because it forces control design to match attacker speed. If detection only works after manual correlation across SaaS, cloud, and identity logs, the programme is already behind. Practitioners should assume that trusted identity flows are part of the attack surface and design monitoring around behaviour, not just access granted.

For practitioners

• Prioritise post-authentication behaviour analytics Correlate session activity, privilege changes, and resource access so that a valid login is only one signal in the detection chain.
• Set a five-minute containment objective Define an operational target for identity abuse that links detection to containment, including session revocation, token invalidation, and privilege rollback.
• Unify identity telemetry across SaaS and cloud Bring identity provider events, entitlement changes, and application activity into one investigation workflow so analysts do not reconstruct the attack manually.
• Treat valid credentials as a starting point for scrutiny Assume successful authentication can still precede abuse, especially where OAuth grants, service accounts, and cloud credentials are in play.

Key takeaways

• Identity attacks increasingly succeed through trusted credentials and sessions, which makes post-authentication behaviour the decisive detection surface.
• The five-minute benchmark is less about compliance and more about whether the SOC can interrupt privilege escalation before the attacker expands access.
• Teams that split identity context across separate tools will continue to lose time reconstructing incidents instead of containing them.

Key terms

• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Mean Time To Detect: Mean Time To Detect, or MTTD, measures how long it takes to identify a security issue after it begins. It is a useful SOC performance indicator because AI should shorten this interval only if it improves signal correlation and analyst comprehension.
• Session abuse: Session abuse is the misuse of an already established browser session to perform actions that were not intended by the legitimate user or system owner. It can include token theft, consent misuse, hijacked navigation, or post-authentication actions that bypass the original access decision.
• Identity context: The entitlement, ownership, and purpose information that explains why an action occurred and whether it was expected. For security operations, identity context turns raw alerts into decisions by showing which human or non-human identity acted and what it was allowed to do.

What's in the full article

Unosecur's full blog post covers the operational detail this post intentionally leaves for the source:

• How the five-minute MTTD benchmark maps to real SOC workflows and containment timing
• The article's explanation of how identity context changes the value of SIEM alerts
• Examples of containment actions such as session revocation, token invalidation, and privilege rollback
• The vendor's description of its unified identity fabric and runtime forensic context

👉 Unosecur's full post covers the identity context, containment flow, and metric implications in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.