One thing I’ve learned from working on identity security is that some of the hardest activity to investigate is not the activity that looks obviously malicious. It is the activity that looks completely reasonable.
A login succeeds, MFA passes, the user opens an application they normally use, and the action itself is something their role is allowed to do. Maybe they export customer data, change an administrative setting, create a token, connect an application, or add a privileged user. If you look at any one of those events on its own, there may be very little to investigate.
The problem starts when the identity is legitimate but the intent behind the activity is not.
That is what makes identity attack detection difficult. The difference between normal work and malicious activity is often not inside the event itself. You have to understand who is using the identity, what they were expected to be doing, what changed recently, and what was happening around the same time in other systems.
Every system knows something, but not enough
In most environments, the information needed to answer those questions already exists. It is just spread everywhere.
The identity provider knows that authentication succeeded. The SaaS application knows that the action was authorized. The endpoint tool knows something about the device. A ticket may explain why a change was expected. HR knows whether the employee is still active, while the business owner understands what that person or application was actually supposed to be doing.
Each system can explain its own piece of the activity, but rarely the full picture. A login may be valid, the application may be authorized, and the device may look familiar while the intent behind the activity is completely different. A compromised employee account can behave almost exactly like the real user, an OAuth application can keep using permissions granted months ago, and an attacker using a stolen session may never generate another login event.
The signals are there. The difficult part is connecting them well enough to understand whether the activity still makes sense.
“Unusual” is a pretty weak signal on its own
Real work is messy, engineers go into production during incidents. Finance teams pull large datasets at quarter-end. Administrators make sensitive changes during migrations. Someone may access a system they have barely touched for months because today happens to be the day they actually need it.
At the same time, malicious activity can look surprisingly normal. Someone using a valid session may access the same applications and data as the employee they compromised, while a compromised integration may continue calling the same APIs it has always used.
So when I think about identity activity, I find “is this unusual?” much less useful than “does this make sense?”
Does it fit what this identity is supposed to be doing? Does the device and session make sense? Is there a ticket or approved project that explains the action? Did the identity recently receive new access? Did something else happen around the same time that changes how we should interpret it?
That is harder than matching an event against a rule, but it is much closer to the question the security team actually needs answered.
Detection increasingly looks like investigation
There are still cases where traditional detection works well. If a login comes from a location that policy explicitly prohibits or a known malicious credential is used, the condition is clear.
The more interesting cases are the ones where the same activity could be completely legitimate or genuinely dangerous depending on the context.
A new administrator could be part of approved onboarding or attacker persistence. A large download could support a customer project or represent data theft. A new OAuth permission could come from a planned product update or from a compromised integration.
The event gives you a reason to start looking, but it cannot answer the question on its own. You still need to connect the identity to its access, activity, device, ownership, recent changes, tickets, policies, and business purpose before you can make a useful judgment.
That is why I think the boundary between detection and investigation is becoming less meaningful in identity security. If an alert cannot tell you enough to understand whether something actually matters, somebody still has to do the investigation afterward.
I don’t think security teams need another alert
Security teams already have plenty of signals. What they often do not have is enough time to put them together.
Ideally, I should be able to describe the behavior I care about in the same language I would use with another person on the team: tell me when a contractor downloads sensitive information to an unmanaged device, look for administrators changing critical settings outside an approved project, or show me when an OAuth application starts accessing information outside its intended purpose.
Finding the activity should only be the beginning. The useful output is an explanation of what happened, why it matters, whether the surrounding context supports the activity, what could be affected, and what should happen next.
That is also a big part of what we are trying to build at Offroad.
Our agents connect identity activity with the context around it, including access, devices, ownership, approvals, recent changes, and business purpose. The goal is not simply to decide whether an event matches a rule. It is to investigate whether the activity makes sense for that identity in that moment.
When the evidence is clear and policy allows, that investigation can move into response. When someone needs to make the judgment, they should get the context and the completed investigation rather than a collection of disconnected signals they need to piece together themselves.
For me, that is the interesting part of identity security right now. The attacks we need to worry about will not always look obviously malicious. Sometimes the authentication will succeed, the permissions will be valid, and every individual system will behave exactly as designed.
The job is to understand when all of those legitimate-looking actions stop adding up to legitimate behavior.
