Notifications
Clear all
Topic starter
24/06/2026 10:45 pm
TL;DR: Identity Threat Detection and Response loses value when IAM programmes depend on backward-looking logs, because attackers move faster than analysts can sift terabytes of event data, according to Imprivata. Real-time behavioral context, not event accumulation, is what turns identity signals into usable detection and response.
NHIMG editorial — based on content published by Imprivata: Identity threat detection and response beyond logs
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams implement identity threat detection without relying on logs alone?
A: Use logs as input, not as the control itself.
Q: Why do logs fall short for identity threat response?
A: Logs are backward-looking and often too slow for attacks that unfold in minutes.
Q: When should organisations prioritise behavioral analytics over more logging?
A: When identity abuse can move faster than human triage, behavioral analytics should take priority.
Practitioner guidance
- Replace log-only detection with live behavioral correlation Tie authentication, access, device, and session signals together so the system can identify abnormal patterns before the session ends.
- Define baselines for high-value identities Establish normal access patterns for privileged users, service accounts, and other sensitive identities, then alert on deviations in geography, device posture, and resource sequence.
- Automate step-up response for risky behavior Trigger MFA, session restriction, or access blocking when behavior crosses a defined threshold.
What's in the full article
Imprivata's full blog post covers the operational detail this post intentionally leaves for the source:
- How its real-time identity graph is used to connect users, devices, and behaviors during active sessions
- How behavior-driven detection is positioned inside an enterprise access management and ITDR workflow
- How the platform handles scale without relying on manual log review
- How proactive access responses are triggered when a signal crosses a defined threshold
👉 Read Imprivata's analysis of identity threat detection and response beyond logs →
Identity threat detection and response: are your controls keeping up?
Explore further
25/06/2026 7:33 am
Log-centric identity defense is a backward-looking control model. Logs remain necessary for compliance and incident reconstruction, but they are not enough for live identity threat detection. By the time a team has correlated events manually, the attacker has often already used the session, the token, or the account to move farther than the logs can prevent. The implication is that IAM programmes must stop treating event capture as equivalent to threat response.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
A question worth separating out:
Q: What controls should trigger response when identity behavior turns risky?
A: Step-up authentication, session restriction, and access blocking are the most useful immediate responses when behavior deviates from the norm. These controls should be tied to live identity context so they activate before privilege abuse becomes broader lateral movement or data access.
👉 Read our full editorial: Identity threat detection needs behavior, not just logs
