Notifications
Clear all
Topic starter
11/08/2026 3:24 pm
TL;DR: Identity attacks often blend into legitimate work because authentication succeeds, permissions are valid, and each system sees only part of the picture, according to Offroad AI. The real challenge is not spotting unusual events, but proving whether the behaviour still makes sense across identity, device, approvals, and business context.
NHIMG editorial — based on content published by Offroad AI: identity activity detection and investigation in context
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- Only 5.7% of organisations have full visibility into their service accounts.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: How should security teams detect attacks that look like normal user activity?
A: Teams should combine identity context, session analysis, and behavioural baselines instead of relying on static signatures alone.
Q: Why do successful logins not prove identity behaviour is legitimate?
A: Because authentication only proves that a session was accepted, not that the intent behind the session is valid.
Q: What do identity teams get wrong about unusual activity alerts?
A: They often treat anomaly as the same thing as risk.
Practitioner guidance
- Correlate identity with business context before triage Join IdP, SaaS, endpoint, ticketing, and ownership data so analysts can test whether an action still makes sense before escalating it as an incident.
- Define behavioural exceptions by role and process Document the legitimate patterns that create false positives, such as incident response access, quarter-end exports, and approved migrations, then encode them as contextual exceptions rather than broad allowlists.
- Review OAuth and service account purpose regularly Confirm that long-lived applications, service accounts, and tokens still map to an active business purpose, current owner, and approved system relationship.
What's in the full article
Offroad AI's full article covers the operational detail this post intentionally leaves for the source:
- How its agents connect identity activity with access, device, ownership, approvals, recent changes, and business purpose.
- The exact investigative workflow used to decide whether a suspicious action still makes sense for the identity involved.
- How the platform turns contextual investigation into response when policy permits action.
- Why the vendor believes traditional detection and investigation are converging in identity security.
👉 Read Offroad AI's analysis of identity activity in context →
Identity activity that looks normal: what should security teams do?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
11/08/2026 3:33 pm
Identity detection is now a context-validation problem, not an alert-volume problem. The article is right that a successful login or authorised API call rarely answers the security question on its own. What matters is whether the action still fits the identity's purpose, device, access history, and recent changes. That is as true for human accounts as it is for service accounts and OAuth integrations, because the analyst's task is to prove behavioural coherence, not merely to spot deviation.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: How do you know if identity threat detection is actually working?
A: Look for shorter mean time to detect and mean time to respond, plus fewer incidents where suspicious sessions persist for hours. Successful programmes also show accurate correlation between behavioural anomalies and real misuse, not just alert volume. If detection cannot trigger containment before damage spreads, the programme is still mostly observational.
👉 Read our full editorial: Identity attack detection fails when legitimate activity hides malicious intent
