Topic starter
16/04/2026 7:17 pm
TL;DR: An experiment that feeds raw identity event sequences into an LLM, then uses token-level surprise and peak perplexity to score anomalous logins and sessions instead of relying only on engineered features, according to Okta. The shift matters because IAM controls that assume risk can be inferred from snapshots and counters may miss sequential behaviour and context collapse.
Editorial analysis by NHI Mgmt Group, based on content published by Okta: “The Next Frontier in Identity Security with LLM-Driven Risk Scoring”.
Key questions
Q: How should IAM teams use LLM-based risk scoring without replacing existing controls?
A: Use it as an additional behavioural signal, not as a stand-alone decision engine.
Q: What breaks when identity risk scoring only looks at feature snapshots?
A: Behavioural context breaks first.
Q: When should organisations prioritise sequence-aware scoring over more hand-built features?
A: Prioritise it when risk decisions depend on order, co-occurrence, or behavioural drift rather than on a single field being new or missing.
Practitioner guidance
- Tune risk-based MFA to sequence signals Test whether your authentication policies can consume behavioural sequence scores, then map high-risk outcomes to step-up authentication for sensitive applications and privileged sessions.
- Preserve event order in identity telemetry Keep session timelines intact in your logging and detection pipeline so that user, device, country, and user-agent changes remain evaluable as a sequence rather than only as isolated fields.
- Separate noisy tokens from identity context Strip or normalise high-entropy values such as IDs and hashes before they reach scoring models so that the model can focus on the identity attributes that matter for anomaly detection.
Bottom line: Identity risk scoring is shifting from static feature engineering toward sequence-aware evaluation of user behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:17 pm
Sequence-aware identity scoring exposes the limits of snapshot-based risk. The article shows why event-by-event heuristics miss the part of identity behaviour that actually matters: order, context, and contradiction across a session. Risk engines built on isolated counters assume the relevant signal survives compression, but much of it disappears when logs are flattened into features. The practitioner conclusion is straightforward: behavioural consistency must be assessed across the full interaction history, not only at the current login.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How do security teams know whether perplexity-based scoring is actually working?
A: Check whether high scores correlate with sessions that are genuinely inconsistent with user history, and whether low scores remain stable for normal behaviour. The model should improve detection precision without flooding the team with alerts on routine travel, device changes, or business-hours variation.
👉 Read our full editorial: LLM-based identity risk scoring exposes the limits of IAM heuristics