LLM-based identity risk scoring exposes the limits of IAM heuristics

At a glance

What this is: Okta outlines an LLM-based identity risk scoring experiment that reads authentication and session logs as sequences, with peak perplexity used to flag events that do not fit an identity's recent behavioural profile.

Why it matters: This matters because IAM teams increasingly need to evaluate context, sequence, and deviation, not just individual events, when deciding when to challenge access or step up authentication.

Context

Okta is testing whether identity risk scoring can move beyond hand-engineered features and treat authentication logs as native text sequences. The core problem is familiar to IAM teams: a single login event often looks harmless until it is read in the context of the user's recent history, device patterns, and location patterns.

In this approach, the model is conditioned on a per-identity profile built from prior events, then scored on how surprising the next event is. That shifts the question from whether a field is unusual in isolation to whether the full event fits the identity's behavioural narrative, which is increasingly relevant for adaptive access controls and risk-based MFA.

The article is about a human IAM control problem, not autonomous behaviour or NHI lifecycle. The practical issue is whether existing risk engines can still distinguish normal from abnormal when the signal is distributed across event sequences rather than encoded in a small set of static features.

Key questions

Q: How should IAM teams use LLM-based risk scoring without replacing existing controls?

A: Use it as an additional behavioural signal, not as a stand-alone decision engine. The strongest pattern is to let sequence-aware scoring inform step-up authentication, analyst review, or session interruption while keeping policy rules, device trust, and federation controls in place for enforcement and auditability.

Q: What breaks when identity risk scoring only looks at feature snapshots?

A: Behavioural context breaks first. A snapshot can show a valid IP or device while hiding the fact that the current session contradicts the user's recent sequence, so the control misses anomalous combinations that only appear across time and across events.

Q: When should organisations prioritise sequence-aware scoring over more hand-built features?

A: Prioritise it when risk decisions depend on order, co-occurrence, or behavioural drift rather than on a single field being new or missing. If the meaningful signal lives in the session story, adding more static features usually gives diminishing returns.

Q: How do security teams know whether perplexity-based scoring is actually working?

A: Check whether high scores correlate with sessions that are genuinely inconsistent with user history, and whether low scores remain stable for normal behaviour. The model should improve detection precision without flooding the team with alerts on routine travel, device changes, or business-hours variation.

Technical breakdown

Why sequence-based risk scoring changes identity telemetry

Traditional identity risk scoring compresses logs into feature vectors such as new IP, new ASN, or unusual user agent. That works when the signal is mostly local, but it discards temporal order, which matters when behaviour is only suspicious as a sequence. A sequence model can read the event trail as a narrative, preserving the order in which countries, devices, and session transitions appear. In IAM terms, that means risk is no longer a point-in-time judgment alone; it becomes a behavioural consistency problem across the session lifecycle.

Practical implication: review whether your risk engine can evaluate event order, not just per-event attributes.

How peak perplexity turns log surprise into a risk score

The article's method uses next-token prediction to estimate how likely the next event text is, given the user's historical profile. Perplexity is the standard measure of surprise, but raw logs include boilerplate that can blur the signal, so peak perplexity focuses on the most surprising tokens in the event, such as country, device, or network context. That makes the score more sensitive to the identity attributes that actually matter for access decisions. The model is not replacing policy, but producing a probabilistic anomaly signal for downstream policy enforcement.

Practical implication: if you consume model output, anchor response thresholds to the most informative identity fields rather than whole-log averages.

Why IAM heuristics struggle with adaptive behaviour

Heuristic IAM controls are strongest when the shape of normality is stable and easy to encode. They weaken when the important question is whether a login makes sense relative to an identity's recent sequence, not whether one field is technically valid. The article shows that an event can look internally consistent while still contradicting the user's established behavioural pattern. That is a control design issue, not merely a modelling issue: static rules cannot easily reason about contextual contradiction, while sequence-aware scoring can. This is especially relevant to risk-based authentication pipelines that rely on sampled indicators rather than narrative context.

Practical implication: treat sequence awareness as a complement to rules, not a cosmetic feature on top of them.

NHI Mgmt Group analysis

Sequence-aware identity scoring exposes the limits of snapshot-based risk. The article shows why event-by-event heuristics miss the part of identity behaviour that actually matters: order, context, and contradiction across a session. Risk engines built on isolated counters assume the relevant signal survives compression, but much of it disappears when logs are flattened into features. The practitioner conclusion is straightforward: behavioural consistency must be assessed across the full interaction history, not only at the current login.

Identity heuristics were designed for rules that can be enumerated up front. That assumption weakens when the scoring method has to infer whether a sequence makes sense from text-level context rather than from fixed indicators. A login can be syntactically valid and still be semantically improbable for that identity, which is why simple allow and deny logic is no longer enough. The implication is that IAM programmes should separate validation, policy, and anomaly interpretation more cleanly.

Peak perplexity is a useful concept because it names the part of the log that carries the real risk signal. Most identity telemetry is noisy, and average-level scoring often hides the field transitions that matter most for access decisions. By focusing on the most surprising tokens, the model shifts attention to the exact attributes that reveal behavioural drift. The practitioner conclusion is to design detection and response around the highest-signal fields, not around the full log line.

Adaptive risk scoring does not remove the need for policy, it changes where the policy boundary sits. Risk engines still need governance over when a model's output can trigger MFA, step-up checks, or session interruption. The article makes clear that the model is an additional signal, which means the real issue is how identity teams calibrate trust in probabilistic outputs. The practitioner conclusion is to align model thresholds with explicit access policy outcomes.

Human IAM is becoming more narrative-aware, and that has operational consequences. When identity telemetry is interpreted as a sequence, the control plane has to handle context windows, not just event stamps. That changes how teams tune false positives, validate anomalies, and explain decisions to users and auditors. The practitioner conclusion is that explainability now has to cover the sequence, not only the alert.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Ultimate Guide to NHIs — Why NHI Security Matters Now

What this signals

Behavioural identity risk is moving toward sequence-aware interpretation. IAM programmes that still rely on isolated feature checks will struggle to detect anomalies that only appear when login events are read as a story. The operational question is no longer whether a field is valid, but whether the session makes sense in context.

Peak perplexity is a useful signal because it highlights contradiction rather than volume. That matters for practitioners who are tuning risk engines, because the model's job is to surface the most surprising part of the event, not to average away the signal. The programme implication is that step-up logic should be tied to the highest-signal identity attributes, not to every log line equally.

For practitioners

• Tune risk-based MFA to sequence signals Test whether your authentication policies can consume behavioural sequence scores, then map high-risk outcomes to step-up authentication for sensitive applications and privileged sessions.
• Preserve event order in identity telemetry Keep session timelines intact in your logging and detection pipeline so that user, device, country, and user-agent changes remain evaluable as a sequence rather than only as isolated fields.
• Separate noisy tokens from identity context Strip or normalise high-entropy values such as IDs and hashes before they reach scoring models so that the model can focus on the identity attributes that matter for anomaly detection.
• Define model-to-policy thresholds explicitly Document which score bands trigger MFA, alerting, or analyst review, and make those thresholds part of access governance rather than an informal tuning decision.
• Validate explanations against user history Use the model's output to explain why a login is unusual in the context of prior sessions, then confirm that the explanation references the same fields the policy engine can actually act on.

Key takeaways

• Identity risk scoring is shifting from static feature engineering toward sequence-aware evaluation of user behaviour.
• The article shows why log context, event order, and per-identity history can reveal anomalies that single-event heuristics miss.
• IAM teams should treat model output as an additional risk signal and tie it to explicit authentication and session policy decisions.

Key terms

• Sequence-based Risk Scoring: Sequence-based risk scoring evaluates identity behaviour as an ordered series of events instead of a single login snapshot. This approach can detect context shifts that aggregated counters miss, especially when the order and timing of events carry the real security signal.
• Peak Perplexity: Peak perplexity is a risk-scoring method that focuses on the most surprising tokens in an identity event rather than averaging the whole log line. It helps surface unusual context changes, such as a new country or device, while reducing noise from repetitive system text.
• Constrained-Context Prompting: Constrained-context prompting is a workflow where an AI agent is limited to a small set of files, a narrow task, or a tightly fenced scope. This reduces risk and keeps work supervised, but it also restricts the agent’s ability to reason about the broader system, customer need, or root cause of a problem.
• Risk-Based Authentication: An access model that changes verification requirements based on the estimated risk of the request. It combines identity assurance, device posture, application sensitivity, and contextual signals to decide whether to allow, block, or step up verification before access is granted.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.