Signal fidelity, not alert volume, defines initial access detection

At a glance

What this is: This is an analysis of why initial-access detection fails when identity tooling treats all sign-in anomalies as equal risk, and why cost-weighted baselines improve fidelity.

Why it matters: IAM, SOC, and NHI teams need detection that distinguishes cheap-to-fake sign-in change from compromise indicators that are costly for attackers to reproduce.

By the numbers:

• sophisticated compromises surfaced by Vectra AI were buried among roughly 200 native risk alerts an analyst would otherwise need to triage

Context

Initial access detection fails when identity systems treat every unusual sign-in as equally important. In real environments, attackers can imitate common attributes such as geography, browser, and device type, while legitimate users also generate frequent change that looks suspicious on paper.

For IAM and SOC programmes, the issue is signal fidelity. If your alerting model cannot separate cheap-to-fake sign-in changes from organisation-specific history, it will either drown teams in noise or miss the compromise that matters.

This article focuses on initial access across human and non-human identities, with the core lesson that the strongest signals are those attackers cannot easily reproduce.

Key questions

Q: What breaks when initial access alerts only use generic anomaly signals?

A: Teams lose the ability to distinguish cheap, attacker-controlled sign-in changes from behaviour that is genuinely hard to reproduce. The result is either alert fatigue or blind spots, because common attributes such as geography and browser are easy to fake while organisation-specific history is not.

Q: Why do cheap-to-fake sign-in attributes create more risk than useful signal?

A: Because attackers can reproduce them with commodity proxies and public information, they stop telling defenders anything meaningful about compromise. The useful signal is the one that depends on private tenant history, trusted devices, and application behaviour that outsiders cannot easily mimic.

Q: How can security teams tell whether initial-access detection is actually working?

A: Look for detections that correlate with confirmed compromise outcomes, not just unusual logins. If real incidents are consistently rated as low or medium while analysts still spend time on benign travel or device changes, the model is not separating risk well enough.

Q: Should organisations treat human and non-human SaaS access the same way?

A: They should apply the same governance standard, even if the operational details differ. Human users, service accounts, and application identities can all accumulate excess permissions, so approval, review, and revocation discipline should cover each of them. The key difference is frequency and automation, not whether least privilege applies at all.

Technical breakdown

Why native risk signals fail at initial access

Native identity alerts usually rely on attributes that are easy to spoof, such as IP reputation, geography, browser, and operating system. Those signals are useful only when they are anchored to local context, because attackers can buy or imitate them quickly and test them across tenants. The problem is not that the signals are false, but that they are cheap to manufacture. When alerting logic treats all deviation as equal, defenders inherit attacker economics instead of reversing them.

Practical implication: prioritize signals tied to organisation-specific history, not generic anomaly markers.

How cost-to-fake weighting improves sign-in detection

A stronger model scores sign-ins by surprisal, then weights that score by how expensive the attribute would be for an attacker to reproduce. A new country is easy to fake, but a device already trusted by the organisation or a network history that only exists inside the tenant is much harder. This approach does not ignore novelty; it ranks novelty by attacker effort. That is why the most useful detections come from multi-dimensional baselines rather than single-attribute thresholds.

Practical implication: design detections around attributes that cannot be rehearsed externally.

What multi-dimensional baselines change for human and NHI identities

A multi-dimensional baseline learns how each identity normally behaves across network history, device posture, client attributes, and application access patterns. For human users, that reduces false positives from travel or routine mobility. For NHI sign-ins, it matters even more because service accounts, tokens, and workload identities often have narrower but more predictable patterns that can be scored against local history. The key insight is that initial access becomes a context problem, not just an authentication problem.

Practical implication: baseline human and NHI sign-ins separately, then correlate them against organisation-specific behaviour.

Threat narrative

Attacker objective: The attacker wants to turn a valid login into durable access before analysts recognise the compromise.

1. Entry occurs through a valid sign-in where the attacker presents stolen credentials and relies on authentication behaving normally.
2. Escalation is avoided by staying under native anomaly thresholds through cheap-to-fake sign-in attributes such as geography, client, and device shape.
3. Impact follows when the compromised session is missed and the attacker moves on to persistence, mailbox rules, or exfiltration.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Initial access is a signal fidelity problem, not an authentication problem: authentication can be working exactly as designed while the identity is already compromised. That distinction matters because the control failure sits in detection fidelity, not login correctness. In practice, teams that only watch for obvious anomaly lose the ability to separate benign change from attacker-manufactured change.

Cost-to-fake is the right lens for initial access: geography, browser, and operating system are weak discriminators because they are cheap to imitate. Network history and application behaviour are harder to reproduce and therefore more defensible as trust signals. The implication is that teams should judge alerts by attacker effort, not by how unusual the event looks in isolation.

Signal ranking must reflect local identity history: a detection model that cannot see organisation-specific patterns will always trail the attacker. History inside the tenant cannot be practised against in advance, which makes it more valuable than globally available reputation data. Practitioners should treat tenant-specific context as the primary input to initial-access governance.

Contextual baseline drift: The useful detection boundary changes as organisations add offices, cloud services, and NHI estates. A static rule set cannot keep pace with that movement, which is why initial-access governance has to be continuously evaluated against real outcomes. The practitioner takeaway is to manage detection as a living control, not a one-time policy decision.

Multi-dimensional scoring is becoming the minimum viable defence: single-signal triage scales badly once attackers can buy proxies, residential IPs, and plausible client fingerprints. Correlation across identity, device, network, and application context is what restores trust in the alert pipeline. Security teams should expect their SOC workflows to privilege correlated compromise over isolated novelty.

What this signals

Initial access detection becomes more defensible when it is built on tenant-specific history rather than universally available sign-in attributes. The practical shift is away from asking whether a login looks unusual and toward asking whether the attacker could have cheaply manufactured the same appearance. That changes SOC tuning from novelty hunting to effort-based risk ranking.

Cost-weighted baselines are the better model for mixed human and NHI estates. Human mobility creates noise, while machine and workload identities create predictable patterns that can be heavily overfit by simple anomaly logic. Security teams should expect the detection boundary to move as business travel, remote work, and NHI usage patterns evolve.

The broader programme implication is that identity telemetry must be judged by the compromises it surfaces, not the volume of alerts it generates. When a control only works after the analyst has already seen the story, it is not a control boundary, it is a triage queue.

For practitioners

• Prioritise tenant-specific history over generic anomaly signals Use local network, device, and application history as the primary context for sign-in scoring, and downgrade alerts that rely only on geography or client fingerprinting.
• Reweight alerts by attacker effort Treat attributes that are cheap to imitate, such as IP region or browser type, as weak evidence unless they co-occur with harder-to-fake history tied to the identity.
• Baseline human and NHI identities separately Model service accounts, tokens, and human users as distinct identity populations so that routine behaviour does not mask compromise or create false confidence.
• Validate detections against confirmed compromises Compare alert outcomes to known compromise cases and adjust thresholds when native signals repeatedly rate real incidents too low.

Key takeaways

• Initial access is often visible before an incident becomes a compromise, but only if the detection model can separate cheap imitation from meaningful identity history.
• The article shows that sophisticated compromises can be buried among roughly 200 native alerts, which is a signal fidelity problem rather than a lack of data.
• Practitioners should weight sign-in evidence by attacker effort and local context, then tune controls against confirmed compromise outcomes.

Key terms

• Signal Fidelity: Signal fidelity is the degree to which a detection actually distinguishes compromise from ordinary operational change. In identity security, low-fidelity signals generate noise because they rely on attributes attackers can mimic and users naturally change.
• Surprisal: Surprisal is a measure of how improbable an event is given the behaviour a model has already learned. In this context, it helps rank sign-ins by how unexpected they are in the organisation's own history, rather than by generic anomaly alone.
• Cost-to-Fake Weighting: Cost-to-fake weighting ranks signals according to how hard they are for an attacker to reproduce. A geography or browser can be copied quickly, but tenant-specific history or trusted device presence is much harder to manufacture and therefore more meaningful.
• Multi-dimensional Baseline: A multi-dimensional baseline is a behavioural model built from several signals at once, such as device, network, location, and application history. It is stronger than single-attribute rules because it compares each event to the broader identity context the organisation actually sees.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.