Andres Andreu, CISSP, ISSAP, QTE

Unlock Superior Threat Protection: The Power of Identity Risk Intelligence in CTEM

Modern cyber defenses increasingly need to be identity-centric. Many industry thought leaders have honed in on this giving rise to the often heard “identity is the new perimeter”. Consequently, attackers do indeed now find it easier to log in rather than break in (https://www.tenable.com/webinars/embracing-identity-security-as-part-of-continuous-threat-exposure-management-ctem). In fact, some research shows that up to 80% of breaches involve compromised or stolen identities, typically due to poor identity hygiene (https://www.crowdstrike.com/en-us/resources/infographics/identity-security-risk-review/). As such, let’s aim to unlock superior threat protection: the power of identity risk intelligence in CTEM.

Recognizing this shift in reality, security leaders are embracing Continuous Threat Exposure Management (CTEM) as a proactive program. The goal here is to continuously uncover and mitigate all forms of risk exposure, including identity-related risks (https://www.oneidentity.com/learn/what-is-ctem.aspx). CTEM aims to move security from the reactive to a continuous, iterative cycle focused on what most threatens a given business.

Identity as the New Perimeter in CTEM

At this point it is clear that traditional security perimeters have dissolved with the rise of cloud services, mobile workforces, and remote access. As the new de-facto perimeter, verifying who is accessing assets is now foundational for trust. Attackers capitalize on identity systems like Active Directory (AD) and Azure AD to gain illicit access, monetize stolen data, and maintain persistence. A recent industry threat report found that 79% of detected attacks were “malware-free”, indicating adversaries are using valid credentials and living off the land instead of deploying malware (https://www.crowdstrike.com/en-us/blog/how-three-industry-leaders-are-stopping-identity-based-attacks-with-crowdstrike/).

In cloud ecosystem breaches, valid account abuse has become the top initial access method in over a third of incidents. These trends underscore that protecting identity systems (authentication, credentials, and privileges) is now mission-critical. Compounding matters, identity-driven attacks now readily bypass traditional network defenses. For example, in the Microsoft Midnight Blizzard breach, a nation-state actor gained access by password-spraying a test account that lacked multi-factor authentication (MFA). In another case, attackers used stolen Okta credentials to impersonate user sessions (bypassing MFA) and compromise multiple Okta customers’ data (https://www.savvy.security/blog/top-10-identity-security-breaches-of-2024-so-far/). Each of these illustrates how inadequate identity controls (e.g. weak passwords, absent MFA, or misconfigurations) can undermine an organization’s defenses. A CTEM program must treat identity as a primary attack surface and continuously scope, monitor, and harden it.

Attack Surface Expansion via Identity Sprawl

The challenge for defenders is magnified by identity sprawl. This is the proliferation of user and service accounts across external, on-premises, multi-cloud environments. Enterprises today use hundreds of SaaS applications with the average large organization using over 200 (https://www.idsalliance.org/blog/best-practices-to-ensure-successful-real-time-iga-2). This sprawl results in thousands of identity accounts and credentials that security teams must try to keep track of. Employee data is only one factor, there are also contractors, partners, customers, and a booming number of Non-Human Identities (NHI) (https://entro.security/blog/use-case-secure-non-human-identities/). Some research suggests that NHIs now outnumber human users by as much as 50 to 1 in many organizations. Each of these identities is a potential path of ingress to an organization. If these accounts and their access rights aren’t centrally visible and controlled, they become part of an expanding, fragmented attack surface.

Properly managing this sprawl is very difficult. Users often accumulate multiple accounts (e.g. separate logins for different cloud platforms or dev/test systems). Dormant or orphaned accounts frequently persist after employees leave or vendors finish contracts. Over time, over-permissioning creeps in – users and service principals gain far more access than necessary, violating least privilege principles. Hybrid and multi-cloud architectures contribute to this complexity leading to inconsistent security controls. As the Identity Defined Security Alliance warns, “identity sprawl and over-permissioning… is accelerating,” (https://www.idsalliance.org/blog/best-practices-to-ensure-successful-real-time-iga-2). Each unmanaged identity or excessive privilege expands an attack surface and needs to be accounted for in a CTEM strategy.

The CTEM Framework and the Identity Component

CTEM, as introduced by Gartner, is structured as an iterative five-stage cycle aimed at continuously reducing an organization’s exposure to threats (https://www.gartner.com/en/articles/how-to-manage-cybersecurity-threats-not-episodes). Rather than a one-time effort, CTEM is an ongoing program that repeats these stages to adapt to evolving threats. The five CTEM stages are:

Scoping: define the full attack surface of the organization, all systems, applications, data, and identities that could be targeted. This includes not only servers and devices but also things like corporate social media accounts, code repositories, and third-party services. Crucially, scoping must cover identity stores (e.g. AD/Azure AD, IAM systems) and credentials at play. It is important to note that credentials can be at play nefariously, this is part of a given scope.
Discovery: perform in-depth discovery of assets and exposures. This goes beyond traditional Operating System (OS) vulnerability scanning and penetration testing. It must factor in software vulnerabilities and resource misconfigurations. It must also include IAM issues such as weak configurations, excessive privileges, or unknown accounts. As One Identity notes, discovery “must also include IAM assets like identities and access rights” to build a complete matrix of assets, vulnerabilities, threats, and business impact (https://www.oneidentity.com/learn/what-is-ctem.aspx). In practice, this means identifying all user/service accounts and evaluating their overall risk profiles (e.g. are infostealers present, etc).
Prioritization: analyze and rank identified exposures based on urgency and impact. For example, take a critical vulnerability on a low-value system. It might rank below an “identity exposure” like an admin account with no MFA or an exposed credential. The CTEM framework calls for a risk-based list, considering threat likelihood, business impact, and the effectiveness of controls in place. Identity context is essential here. Security teams should prioritize exposures involving highly privileged or widely used identities (e.g., domain admins or SSO accounts) due to their potential impact if compromised.
Validation: rigorously test and validate the true exploitability of the prioritized exposures. Moreover, validate the relevant protective mechanisms that are in place. This may involve penetration testing or red-team exercises that simulate identity-based attacks (for instance, attempting lateral movement with a captured credential to see if detection tools trigger). Validation ensures that assumed risks are real, and that proposed mitigations (like stricter access controls) actually add protective value.
Mobilization: mobilize the organization to remediate and reduce exposure. This stage is about taking action. Action could take the form of patching vulnerabilities, addressing identity and access misconfigurations, closing policy gaps, or improving processes. It requires engaging stakeholders (IT, DevOps, business units) and implementing changes. Mobilization transitions CTEM findings into real risk reduction, after which the cycle repeats.

Gartner predicts that organizations who proactively adopt continuous exposure management will be 3× less likely to suffer a breach by 2026 (https://www.oneidentity.com/learn/what-is-ctem.aspx). Achieving that requires treating identity exposures on par with software vulnerabilities. CTEM provides the framework to do so, but it demands directed strategies, new practices, and intelligence focused on identities. This is where identity risk intelligence comes into play.

From Identity and Access Management to Identity Risk Intelligence: Big Difference

It’s important to distinguish Identity and Access Management (IAM) tools from identity risk intelligence capabilities. IAM (including identity governance and privileged access management) is primarily about enabling and restricting access:

Authentication: ensuring users are who they claim
Authorization: granting the right level of access to resources
Provisioning and Deprovisioning: managing the lifecycle of identity accounts and permissions

IAM solutions strengthen account hygiene and enforce policies upfront. For example this means requiring MFA, rotating passwords, or limiting who can access a sensitive database. These are critical preventive controls, but by themselves they don’t provide full visibility into active threats targeting identities.

Identity risk intelligence, by contrast, focuses on the threats and risk indicators associated with identities on an ongoing basis. Gartner has coined the term Identity Threat Detection and Response (ITDR) for the emerging security discipline that fills this gap. Identity risk intelligence is a key component of ITDR. Unlike traditional IAM, which might flag a policy violation or require periodic access reviews, identity risk intelligence is more proactive and context-driven. For example, IAM might ensure a user has a strong password; identity risk intelligence will alert if that password later appears in a public breach database or if the user suddenly logs in from an unusual location at some odd hour. In essence, IAM asks “Who should have access, and are they authenticated?” whereas identity risk intelligence asks “What is this identity doing, and does that behavior or configuration pose a risk?”.

Several areas may fall under identity risk intelligence:

Exposure of Credentials and Secrets: tracking if user passwords, API keys, or session objects have been leaked or are weak. For instance, monitoring dark web and breach data for any of an organization’s accounts can reveal stolen credentials before attackers use them. This goes beyond standard IAM by ingesting external threat intelligence relevant to identity compromise.
User Behavior Analytics (UBA): establishing baselines of normal user and service account behavior and detecting anomalies. Sudden privilege escalations, a typically dormant admin account becoming active, or active sessions from new geolocations could indicate account takeover. Identity-focused UBA aims to provide this continuous risk scoring of identities’ behavior.
Identity Threat Detection: real-time detection of attacks targeting identity infrastructure, such as brute-force/MFA fatigue attacks.

In summary, identity risk intelligence is about having unified visibility and analytics across all types of identities (software, human, and machine) and feeding that into some risk management program. It complements IAM by focusing on continuous monitoring, threat detection, and risk-based decision-making around identities. This unified approach lowers the risk of dangerous identity conditions slipping through gaps between siloed IAM, PAM, and governance tools. In a CTEM context, identity risk intelligence supplies the data needed to uncover and prioritize identity exposures. It also helps validate that identity-focused attacks are being detected, and ideally, stopped.

Real-World Breaches Underscoring Identity Risk

CTEM program designers should study real-world breaches to understand how identity weaknesses translate into business risk. Here are a few illustrative cases:

Lack of MFA: the Change Healthcare breach (2023) saw ALPHV/BlackCat ransomware actors exfiltrate 4 terabytes of health data after finding a VPN account that had no MFA (https://www.savvy.security/blog/top-10-identity-security-breaches-of-2024-so-far/). Absence of MFA made it trivial to exploit a stolen password. The incident disrupted healthcare operations nationwide and cost over $1B in recovery, all traced back to a single identity exposure. Similarly, the Midnight Blizzard attack on Microsoft’s environment (2023) exploited a non-production account without MFA. This showed that even test or service accounts can cause catastrophic breaches if not secured. These cases underscore the need to enforce MFA universally. Security teams must also audit for accounts left outside strong SSO or MFA coverage. This step is non-negotiable for reducing the attack surface.
Supply Chain Effect: in the 2024 Okta support system breach, attackers obtained an Okta support engineer’s credentials. With that access, attackers grabbed session cookies from the support portal. These cookies enabled them to impersonate Okta customers. The attackers bypassed MFA and escalated into those customers’ systems. This case highlights the risk that arises when attackers compromise an identity platform—such breaches can cascade across many organizations. A CTEM strategy must account for third-party identity risk and include vendors like Okta and Microsoft in regular risk assessments.
Privileged Account Compromise: an analysis (2024) by BeyondTrust noted that compromised privileged identities accounted for 33% of security incidents, up from 28% the year before (https://www.beyondtrust.com/blog/entry/the-state-of-identity-security-identity-based-threats-breaches-security-best-practices). One breach example is the Uber 2022 incident, where an attacker obtained an IT admin’s VPN password (likely via social engineering) and then spammed the user with MFA push requests (MFA fatigue) until the user approved one. This granted the attacker VPN access, leading to a major internal compromise. Such breaches show why defenders must secure administrative identities with extra safeguards. These include phishing-resistant MFA, risk-based authentication, and admin action monitoring. Just-in-time privilege adds another layer of protection. It limits risk by ensuring attackers can’t misuse stolen admin credentials outside a narrow time window.
Cloud Identity Misconfigurations: many cloud breaches stem from identity and access misconfigurations in multi-cloud environments. For instance, a leaky AWS access key or an overly permissive cloud IAM role can open the door to an attacker. CTEM must treat cloud entitlements (managed by Cloud Infrastructure Entitlement Management (CIEM) tools) as part of identity risk intelligence. A well-known example is the Capital One breach in 2019: a misconfigured AWS identity (EC2 role) allowed an attacker to perform actions and access data they shouldn’t have. While on the older side, this case set a precedent for cloud IAM review being vital. Modern CTEM programs use CIEM tools to continuously check for things like unused high-privilege roles, tokens without rotation, or cross-account trusts that could be abused.

In each of these scenarios, a failure in identity controls either enabled the breach or worsened its impact. They illustrate why identity exposures need to be surfaced and prioritized within an exposure management strategy. Either way, the message is clear: if you’re not actively looking for identity-related risks, your adversaries certainly are.

Identity-Centric CTEM Success Stories

Not all is gloom and doom, some organizations have embraced an identity-focused approach to CTEM and are reaping the benefits. By integrating identity risk intelligence into their security operations, they are catching attacks earlier and addressing gaps proactively. Here are two examples of companies that leveraged identity risk intelligence to strengthen their security posture:

Dark web credential monitoring – Texas Mutual, a large insurance provider, recognized that many of their user accounts (including those of infrequent users like board members or policyholders) could be targeted by attackers if their credentials were exposed. As part of their CTEM efforts, they deployed a commercial identity threat protection platform. One component continuously monitors dark web and criminal forums for any mention of Texas Mutual user credentials. When a leaked username/password is found, the security team is alerted immediately. They can then take action before any nefarious activity takes place. This approach transforms credential theft from a hidden danger into a manageable risk.
Risk-Based identity protection – Borden Ladner Gervais (BLG), Canada’s largest law firm, adopted an identity-centric security strategy to protect sensitive client data. Partnering with a managed service provider, they implemented 24/7 identity threat monitoring and real-time, risk-based conditional access. Each login attempt is evaluated using signals like device hygiene, user role, and location. High-risk events, such as privileged logins from unusual geographies, are blocked or escalated. An AI-driven engine continuously scores identity risk, flags exposed credentials, and enforces immediate password changes. It also detects dormant accounts and triggers their removal. BLG’s operationalized identity risk intelligence enables rapid detection and response to identity anomalies, directly supporting CTEM’s goal of continuous exposure reduction.

These case studies illustrate tangible benefits:

Early detection of credential compromise
Automated blocking of suspicious logins
Elimination of unnecessary privileges

They also show that technology and managed services are available to help achieve these outcomes. The key is integrating these tools and practices into a broader CTEM strategy – treating identity risks as first-class citizens alongside software vulnerabilities, OS, and network threats.

Recommendations for Leveraging Identity Risk Intelligence in CTEM

To build a CTEM program with strong identity-centric coverage, organizations should consider the following strategic and tactical recommendations:

Adopt an “Identity-First” security strategy – make identity security a leadership and board-level priority alongside application, data, API, endpoint and network security.
Embrace Zero Trust (ZT) principles – assume any identity could be compromised and require continuous verification of users and devices. Treat your identity providers (AD, Azure AD, IAM systems) as critical infrastructure and resource them accordingly. This strategic shift ensures that investments in identity risk intelligence are supported from the top down.
Enforce strong authentication everywhere – the “everywhere” part is essential here. This point deserves emphasis – enable MFA for all users and critical accounts, including service accounts where possible. Doing so eliminates easy credential stuffing attacks. Many known breaches, including Change Healthcare and Microsoft, could have been prevented with stricter authentication requirements. Wherever possible, push towards phishing-resistant methods (FIDO2 tokens, certificate-based auth, or app-based OTP) for high-privilege accounts to thwart phishing and MFA fatigue techniques.
Gain visibility into all identities and privilege levels – continuously inventory every identity in your environment. This includes human, software, service, application, across on-prem and multi-cloud. This type of inventory (https://www.plerion.com/cloud-knowledge-base/identity-inventory) is now becoming more important than the traditional notion of asset inventory. Map out what systems a given identity can access and what privileges they have. This intelligence is foundational for CTEM. Leverage tools to enumerate accounts in AD, Azure AD, SaaS apps, AWS IAM, etc., and centralize this data. Pay special attention to dormant accounts, shared accounts, default accounts, and third-party identities. Eliminate or disable what is not actually needed (especially legacy accounts) and tighten privileges for what remains. Reducing identity clutter will shrink the attack surface significantly.
Continuously monitor identity activity and risk – this cannot be overstated. The days of point in time snapshots are behind us. Things in this industry just move too fast and change too frequently. This requires an integration of identity telemetry into your security operations center (SOC) monitoring. Data signals must include breach data, cybercrime forum data, infostealer data, login logs, privilege use logs, IAM changes, and alerts from identity protection tools. Establish baselines and let automated systems flag outliers, or anomalies (e.g. an admin logging in from an unusual IP, or a service account suddenly accessing new resources).
Implement an ITDR solution – aim to get real-time detection of identity-based threats that IAM alone won’t catch. The goal is real-time response (e.g., if user credentials are detected on the dark web, immediately disable or step up stronger authentication for that account).
Integrate identity risk intelligence into risk assessments and incident response – when prioritizing risks (the CTEM Prioritization stage), include identity signals. Develop scoring or a posture rating that raises risk for identity assets that have been part of data leaks and/or have high-privilege access. Additionally, update incident response plans to account for identity compromise scenarios (have playbooks for rapid credential resets, terminating all sessions for a user, or evicting attackers from cloud accounts). Practicing these in drills (e.g. simulate a leaked password scenario) will improve resilience.
Apply the principle of least privilege – make it a continuous effort to adjust privileges. Privileges should no longer be a set and forget mechanism. Also, use identity analytics or governance tools to detect over-privileged accounts and roles, and then remediate them (via access reviews or automated role mining). When done properly, least privilege drastically limits what an identity compromise can achieve.
Apply Just-in-Time (JIT) access – consider JIT access as a replacement for static access rules. This way privileges are activated only when needed and expire automatically. In this model, even if an attacker compromises an account with elevated privileges, they cannot do damage unless they also compromise the privilege elevation process.
Address identity misconfigurations and hygiene issues proactively – treat misconfigurations in identity systems as seriously as OS or software vulnerabilities. Regularly audit configurations in identity stores and cloud IAM settings. Known attack paths often rely on poor configurations, security teams must find and fix them before attackers do. For example, avoid setting service account passwords to never expire. Also, remove any redundant admin accounts to reduce unnecessary risk. These hygiene improvements reduce the number of “easy wins” an attacker might find if they penetrate your ecosystem.
Leverage automation for identity risk analysis – the scale of identity data (thousands of accounts, millions of logins) demands automation. Invest in solutions that use machine learning to assess risk continuously (focusing on the patterns humans might miss or sheer volume alone make unrealistic). As an example, risk-based authentication systems automatically adjust requirements when they detect elevated risk. Add intelligence to some of these solutions and a model can surface a user whose behavior subtly changes following a phishing campaign, or flag a rarely used service account that suddenly starts querying a database.
Unify identity risk intelligence with CTEM programs – ensure that all the identity risk insights feed into your overall CTEM data sets. When you communicate exposure levels to executives, include identity metrics (number of known exposed accounts, high-risk accounts, SSO coverage gaps, etc.) alongside vulnerabilities and patch status. As part of your program metrics develop KPIs like:
Number of detected data breaches showing identities from this organization
- Average time to reset compromised credentials
- Number of identities from this organization with known infostealer infections
- Number of attempts to log in to our systems via exposed session objects
- MFA coverage percentage
- Number of stale identities from this organization removed this quarter

This reinforces that identity risk management is an integral part of exposure management.

CTEM should break down silos. For example, use CTEM’s Mobilization phase to bring together the IAM team (to implement policy changes) and the SOC team (to tune detections) when an identity risk needs mitigation. Over time, organizations build a culture of continuous improvement by addressing identity-related findings as routinely as OS and software patches.

By following these recommendations, organizations can significantly strengthen their security posture against identity-centric threats. The goal is to be proactive, don’t wait for an identity breach to force action. Instead, continuously hunt for identity weaknesses and address them on your own terms. This will reduce your overall attack surface and threat exposure while complementing all the other security efforts under your CTEM program.

In today’s threat landscape, protecting identities is as vital as patching servers or monitoring networks. Identities are the keys to the kingdom, the pathway into your ecosystems, and attackers know it. Their tactics prove this. CTEM provides a powerful framework to systematically reduce risk, but it only achieves its full promise when identity risk intelligence is brought into the fold. Identity risk intelligence is the missing piece that turns CTEM into a truly comprehensive defense strategy. Organizations can close the gaps attackers most eagerly exploit by continuously analyzing who has access to what, how they use that access, and where identity-driven weaknesses exist.

The convergence of IAM, ITDR, and CTEM practices represents a shift toward identity-first security. For security leaders and professionals, the message is clear: make identity a cornerstone of your continuous risk management. Those who do so will greatly enhance their resilience and stay ahead of adversaries who are relentlessly probing for that one weak login or forgotten account to open the door. By leveraging identity risk intelligence within CTEM, organizations can dramatically lower their odds of identity related breaches. Moreover, they can build a modern cyber defense that truly leaves attackers with no easy way in due to identity risk intelligence: the missing piece in continuous threat exposure management.

Identity Risk Intelligence and it’s role in Disinformation Security

Src: https://soundproofcentral.com/wp-content/uploads/2020/10/How-To-Block-Low-Frequency-Sound-Waves-Bass-e1602767891920.jpg.webp

From Indicators to Identity: A CISOs guide to identity risk intelligence and its role in disinformation security

The power of signals, or indicators, is evident to those who understand them. They are the basis for identity risk intelligence and it’s role in disinformation security. For years, cybersecurity teams have anchored their defenses on Indicators of Compromise (IOCs), such as IP addresses, domain names, and file hashes, to identify and neutralize threats.

Technical artifacts offer security value, but alone, they’re weak against advanced threats. Attackers possess the capability to seamlessly spoof their traffic sources and rapidly cycle through their operational infrastructure. Malicious IP addresses quickly change, making reactive blocking continuously futile. Flagged IPs might be transient The Onion Routing Project (TOR) nodes, not the actual attackers themselves. Similarly, the static nature of malware file hashes makes them susceptible to trivial alterations. Attackers can modify a file’s hash in mere seconds, effectively evading signature-based detection systems. The proliferation of polymorphic malware, which automatically changes its code after each execution, further exacerbates this issue, rendering traditional hash-based detection methods largely ineffective.

Cybersecurity teams that subscribe to voluminous threat intelligence feeds face an overwhelming influx of data, a substantial portion of which rapidly loses its relevance. These massive “blacklists” of IOCs quickly become outdated or irrelevant due to the ephemeral nature of attacker infrastructure and the ease of modifying malware signatures. This data overload presents a significant challenge for security analysts and operations teams, making it increasingly difficult to discern genuine threats from the surrounding noise and to construct effective proactive protective mechanisms. Data overload obscures critical signals, proving traditional intelligence ineffective. Traditional intelligence details attacks but often misses the responsible actor. Critically, this approach provides little to no insight into how to prevent similar attacks from occurring in the future.

The era of readily identifying malware before user execution is largely behind us. Contemporary security breaches frequently involve elements that traditional IOC feeds cannot reveal – most notably, compromised identities. Verizon’s 2024 Data Breach Investigations Report (DBIR) indicated that the use of stolen credentials has been a factor in nearly one-third (31%) of all breaches over the preceding decade (https://www.verizon.com/about/news/2024-data-breach-investigations-report-emea). This statistic is further underscored by Varonis’ 2024 research, which revealed that 57% of cyberattacks initiate with a compromised identity (https://www.varonis.com/blog/the-identity-crisis-research-report).

Essentially, attackers are increasingly opting to log in rather than hack in. These crafty adversaries exploit exposed valid username and password combinations, whether obtained through phishing campaigns, purchased on dark web marketplaces, or harvested from previous data breaches. With these compromised credentials, attackers can impersonate legitimate users and quietly bypass numerous security controls. This approach extends to authenticated session objects, effectively nullifying the security benefits of Multi-Factor Authentication (MFA) in certain scenarios. While many CISOs advocate for MFA as a panacea for various security challenges, the reality is that it does not address the fundamental risks associated with compromised identities. IOCs and traditional defenses miss attacks from seemingly legitimate, compromised users. This paradigm shift necessitates a proactive and forward-thinking approach to cybersecurity, leading strategists to pivot towards identity-centric cyber intelligence.

Identity intelligence shifts focus from technical IOCs to monitoring digital entities. Security teams now ask: ‘Which identities are compromised?’ instead of just blocking IPs. This evolved approach involves establishing connections between various signals, including usernames, email addresses, and even passwords, across a multitude of data breaches and leaks to construct a more comprehensive understanding of both risky identities and the threat actors employing them, along with their associated tactics. The volume of data analyzed directly determines this approach’s efficacy; more data leads to richer and more accurate intelligence. Unusual logins trigger checks for compromised credentials via identity intelligence. Furthermore, it can enrich this analysis by examining historical data to identify patterns of misuse. Recurring patterns elevate anomalies to significant events, indicating broader attacks. Data correlation provides contextual awareness traditional intelligence lacks.

Fundamentally, identity signals play a crucial role in distinguishing legitimate users from imposters or synthetic identities operating within an environment. In an era characterized by remote and hybrid work models, widespread adoption of cloud services, and the ease of leveraging Virtual Private Network (VPN) services, attackers are increasingly attempting to create synthetic identities – fictitious users, IT personnel, or contractors – to infiltrate organizations. They may also target and compromise the identities of valid users within a given environment.

While traditional indicators like the source IP address of a login offer little value in determining whether a user truly exists within an organization’s Active Directory (AD) or whether that user is a genuine employee versus a fabricated identity, an identity-centric approach excels in this area. This excellence is achieved by meticulously analyzing multiple attributes associated with an identity, such as the employee’s email address, phone number, or other Personally Identifiable Information (PII), against extensive data stores of known breached data and fraudulent identities. Identity risk intelligence can unearth data on identities that simply appear risky. For example, if an email address with no prior legitimate online presence suddenly appears across numerous unrelated breach datasets, it could strongly suggest a synthetic profile.

Some advanced threat intelligence platforms now employ entity graphing to visually map and correlate these intricate and seemingly unrelated signals. Entity graphing involves constructing a network of relationships between various signals – connecting email addresses to passwords, passwords to specific data breaches, usernames to associated online personas, IP addresses to user accounts, and so forth. These interconnected graphs can become highly complex, yet they possess a remarkable ability to reveal hidden links that would remain invisible to a human analyst examining raw data.

An entity graph might reveal that a single Gmail address links multiple accounts across different companies and surfaces within criminal forums, strongly implicating a single threat actor who orchestrates activities across various environments. Often, these email addresses utilize convoluted strings for the username component to deliberately obfuscate the individual’s real name. By pivoting on identity-focused nodes within the graph, analysts can uncover associations between threat actors who employ obscure data points. The resulting intelligence is of high fidelity, sometimes pointing not merely to isolated threat artifacts but directly to the human adversary orchestrating a malicious campaign. This represents a new standard for threat intelligence, one where understanding the identity of the individual behind the keyboard is as critical as comprehending the specific Tactics, Techniques, and Procedures (TTPs) they employ.

The power of analyzing signals for threat intelligence is not a new concept. For example, the NSA’s ThinThread project in the 1990s aimed to analyze massive amounts of phone and email metadata to identify potential threats (https://en.wikipedia.org/wiki/ThinThread). ThinThread was designed to sort through this data, encrypt US-related communications for privacy, and use automated systems to audit how analysts handled the information. By analyzing relationships between callers and their contacts, the system could identify potential threats, and only then would the data be decrypted for further analysis.

Despite rigorous testing and demonstrating superior data-sorting capabilities compared to existing systems, ThinThread was discontinued shortly before the 9/11 attacks. The core component of ThinThread, known as MAINWAY, which focused on analyzing communication patterns, was later deployed and became a key part of the NSA’s domestic surveillance program. This historical example illustrates the potential of analyzing seemingly disparate signals to gain critical insights into potential threats, a principle that underpins modern identity risk intelligence.

Real-World Example: North Korean IT Workers Using Disinformation/Synthetic Identities for Cyber Espionage

No recent event more clearly underscores the urgent need for identity-centric intelligence than the numerous documented cases of North Korean intelligence operatives nefariously infiltrating companies by masquerading as remote IT workers. While this scenario might initially sound like a plot from a Hollywood thriller, it is unfortunately a reality that many organizations have fallen victim to. Highly skilled agents from North Korea meticulously craft elaborate fake personas, complete with fabricated online presences, counterfeit resumes, stolen personal data, and even AI-generated profile pictures, all to secure employment at companies in the West. Once these operatives successfully gain employment, data exfiltration, or at the very least the attempt thereof, becomes virtually inevitable. In some particularly insidious cases, these malicious actors diligently perform the IT work they were hired to do, effectively keeping suspicions at bay for extended periods.

In 2024, U.S. investigators corroborated the widespread nature of this tactic, revealing compelling evidence that groups of North Korean nationals had fraudulently obtained employment with American companies by falsely presenting themselves as citizens of other countries (https://www.justice.gov/archives/opa/pr/fourteen-north-korean-nationals-indicted-carrying-out-multi-year-fraudulent-information). These operatives engaged in the creation of entirely synthetic identities to successfully navigate background checks and interviews. They acquired personal information, either by “borrowing” or purchasing it from real citizens, and presented themselves as proficient software developers or IT specialists available for remote work. In one particularly concerning confirmed case, a North Korean hacker secured a position as a software developer for a cybersecurity company by utilizing a stolen American identity further bolstered by an AI-generated profile photo – effectively deceiving both HR personnel and recruiters. This deceptive “employee” even successfully navigated multiple video interviews and passed typical scrutiny.

In certain instances, the malicious actors exhibited a lack of subtlety and wasted no time in engaging in harmful activities. Reports suggest that North Korean actors exfiltrated sensitive proprietary data within mere days of commencing employment. They often stole valuable source code and other confidential corporate information, which they then used for extortion. In one instance, KnowBe4, a security training firm, discovered that a newly hired engineer on their AI team was covertly downloading hacking tools onto the company network (https://www.knowbe4.com/press/knowbe4-issues-warning-to-organizations-after-hiring-fake-north-korean-employee). Investigators later identified this individual as a North Korean operative utilizing a fabricated identity, and proactive monitoring systems allowed them to apprehend him in time by detecting the suspicious activity.

HR, CISOs, CTOs: traditional security fails against sophisticated insider threats. Early detection of synthetic insiders is crucial for preventing late-stage damage. This is precisely where the intrinsic value of identity risk intelligence becomes evident. By proactively incorporating identity risk signals early in the screening process, organizations can identify red flags indicating a potentially malicious imposter before they gain access to the internal network. For example, an identity-centric approach might have flagged the KnowBe4 hire as high-risk even before onboarding by uncovering inconsistencies or prior exposure of their personal data. Conversely, the complete absence of any historical data breaches associated with an identity could also be a suspicious indicator. Consider the types of disinformation security that identity intelligence enables:

Digital footprint verification – by leveraging extensive breach and darknet databases, security analysts and operators can thoroughly investigate whether a job applicant’s claimed identity has any prior history. If an email address or name appears exclusively in breach data associated with entirely different individuals, or if a supposed U.S.-based engineer’s records trace back to IP addresses in other countries, these discrepancies should immediately raise concerns. In the context of disinformation security, digital footprint verification helps to identify inconsistencies that suggest a fabricated identity used to spread false information or gain unauthorized access. Digital footprint analysis involves examining a user’s online presence across various platforms to verify the legitimacy of their identity. Inconsistencies or a complete lack of a genuine online presence can be indicative of a synthetic identity.
Proof of life or Synthetic identity detection – advanced platforms possess the capability to analyze combinations of PII to determine the chain of life, or the likelihood of an identity being genuine versus fabricated. For instance, if an individual’s social media presence is non-existent or their provided photo is identified as AI-generated (as was the case with the deceptive profile picture used by the hacker at KnowBe4), these are strong indicators of a synthetic persona. This is a critical aspect of disinformation security, as threat actors often use AI-generated profiles to create believable but fake identities for malicious purposes. AI algorithms and machine learning techniques play a crucial role in detecting these subtle anomalies within vast datasets. Behavioral biometrics, which analyzes unique user interaction patterns with devices, can further aid in distinguishing between genuine and synthetic identities.
Continuous identity monitoring – even after an individual is hired, the continuous monitoring of their activity and credentials can expose anomalies. For example, if a contractor’s account suddenly appears in a credential dump online, identity-focused alerts should immediately notify security teams. For disinformation security, this allows for the detection of compromised accounts that might be used to spread malicious content or propaganda.

These types of sophisticated disinformation campaigns underscore the critical importance of linking cyber threats to identity risk intelligence. Static IOCs would fail to reveal the inherent danger of a seemingly “normal” user account that happens to belong to a hostile actor. However, identity-centric analysis – meticulously vetting the true identity of an individual and determining whether their digital persona has any connections to known threat activity – can provide defenders with crucial early warnings before an attacker gains significant momentum.

This is threat attribution in action. Prioritizing identity signals, the attribution of suspicious activity to the actual threat actor becomes possible. The Lazarus Group, for instance, utilizes social engineering tactics on platforms like LinkedIn. Via Linkedin they distribute malware and steal credentials, highlighting the need for identity-focused monitoring even on professional networks. Similarly, APT29 (Cozy Bear) employs advanced spear-phishing campaigns, underscoring the importance of verifying the legitimacy of individuals and their digital footprints.

The Role of Identity Risk Intelligence in Strengthening Security Posture

To proactively defend against the evolving landscape of modern threats, organizations must embrace disinformation security strategies and seamlessly integrate identity-centric intelligence directly into their security operations. The core principle is to enrich every security decision with valuable context about identity risk. This means that whenever a security alert is triggered, or an access request is initiated, the security ecosystem should pose the additional critical question: “is this identity potentially compromised or fraudulent?”. By adopting this proactive approach, companies can transition from a reactive posture to a proactive one in mitigating threats:

Early compromised credential detection – imagine an employee’s credentials leak in a third-party breach. Traditional security misses this until active login attempts. Identity risk intelligence alerts immediately upon detection in breaches or dark web dumps. This early warning allows the security team to take immediate and decisive action, such as forcing a password reset or invalidating active sessions. Integrating these timely identity risk signals into Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) systems enables such alerts to trigger automated responses without requiring manual intervention. Taking this further, one can proactively enrich Single Sign-On (SSO) systems and web application authentication frameworks with real-time identity risk intelligence. The following table illustrates recent high-profile data breaches where compromised credentials played a significant role:

Table 1: Recent High-Profile Data Breaches Involving Compromised Credentials (2024-2025)

Organization	Date	Estimated Records Compromised	Attack Vector	Reference
Change Healthcare	Feb 2024	100M+	Compromised Credentials	Reference
Snowflake	May 2024	165+ Orgs	Compromised Credentials	Reference
AT&T	Apr 2024	110M	Compromised Credentials	Reference
Ticketmaster	May 2024	560M	Compromised Credentials (implied)	Reference
UK Ministry of Defence	May 2024	270K	Compromised Credentials (potential)	Reference
New Era Life Insurance Companies	Feb 2025	335K	Hacking	Reference
Hospital Sisters Health System	Feb 2025	882K	Cyberattack	Reference
PowerSchool	Feb 2025	62M	Cyberattack	Reference
GrubHub	Feb 2025	Undisclosed	Compromised Third-Party Account	Reference
DISA Global	Feb 2025	3.3M	Unauthorized Access	Reference
Finastra	Nov 2024 & Feb 2025	400GB & 3.3M	Unauthorized Access	Reference
Legacy Professionals LLP	Feb 2025	215K	Suspicious Activity	Reference
Bankers Cooperative Group, Inc	Aug 2024	Undisclosed	Compromised Email	Reference
Medusind Inc.	Jan 2025	112K	Data Seizure	Reference
TalkTalk	Jan 2025	18.8M	Third-Party Supplier Breach	Reference
Gravy Analytics	Jan 2025	Millions	Unauthorized Access	Reference
Unacast	Jan 2025	Undisclosed	Misappropriated Key	Reference

Identity risk posture for users – leading providers offer something like an “Identity Risk Posture” Application Programming Interface (API). This yields a categorized value that represents the level of exposure or risk associated with a given identity. Meticulous analysis of a vast amount of data about that identity across the digital landscape derives this score. For instance, the types of exposed attributes, the categories of breaches, and data recency are all analyzed. A CISOs team can strategically utilize such a posture value to prioritize decisions and security actions. For example, a Data Security Posture Management (DSPM) solution identifies a series of users with access to specific data resources. If the security team identifies any of those users as having a high-risk posture, they could take action. Actions could include investigations or the mandate of hardware MFA devices. Or even call for more frequent and specialized security awareness training.
Threat attribution and hunting – identity-centric intelligence significantly empowers threat hunters to connect seemingly disparate signals, security events, and incidents. In the event of a phishing attack, a traditional response might conclude by simply blocking the sender’s email address and domain. However, incorporating identity data into the analysis might reveal that the phishing email address previously registered an account on a popular developer forum, and the username on that forum corresponds to a known alias of a specific cybercrime group. This enriched attribution helps establish a definitive link between attacks and specific threat actors or groups. Knowing precisely who is targeting your organization enables you to tailor your defenses and incident response processes more effectively. Moreover, a security team can then proactively hunt for specific traces within a given environment. This type of intelligence introduces a new dimension to threat attribution, transforming anonymous attacks into attributable actions by identifiable adversaries.

Integrate identity risk signals via API into security tools: a best practice. Effective solutions offer API access to vast identity intelligence datasets. These APIs provide real-time alerts and comprehensive risk posture data based on a vast data lake of compromised identities and related data points (e.g. infostealer data, etc). Tailored intelligence feeds continuously provide actionable data to security operations. This enables security teams to answer critical questions such as:

Which employee credentials have shown up in breaches, data leaks, and/or underground markets?
Is an executive’s personal email account being impersonated or misused?
Is an executive’s personal information being used to create synthetic, realistic looking public email addresses?
Are there any fake social media profiles impersonating our brand or our employees?

These identity risk questions exceed traditional network security’s scope. They bring crucial external insight – information about internet activity that could potentially threaten the organization – into internal defense processes.

Furthermore, identity-centric digital risk intelligence significantly strengthens an organization’s ability to progress towards a Zero Trust (ZT) security posture. ZT security models operate on the fundamental principle of “never trust, always verify” – particularly as it relates to user identities. Real-time information about a user’s identity compromise allows the system to dynamically adjust trust levels. For example, if an administrator account’s risk posture rapidly changes from low to high, a system can require re-authentication until investigation and resolution. This dynamic and adaptive response dramatically reduces the window of opportunity for attackers. Proactive interception of stolen credentials and fake identities replaces reactive breach response.

Embracing Identity-Centric Intelligence: A Call to Action

The landscape of cyber threats is in a constant state of evolution, and our defenses must adapt accordingly. IOCs alone fail against modern attackers; identity-focused threats demand stronger protection. CIOs, CISOs, CTOs: identity-centric intelligence is now a critical strategic necessity. As is understanding identity risk intelligence and it’s role in disinformation security. This necessary shift does not necessitate abandoning your existing suite of security tools; rather, it involves empowering them, where appropriate, with richer context and more identity risk intelligence signals.

By seamlessly integrating identity risk data into every aspect of security operations, from authentication workflows to incident response protocols, security teams gain holistic visibility into an attack, moving beyond fragmented views. Threat attribution capabilities then become significantly enhanced, as cybersecurity teams can more accurately pinpoint who is targeting their organization. Identifying compromised credentials or accounts speeds incident response, enabling faster breach containment. Ultimately, an organization can transition into both proactive and disinformation security strategies.

Several key questions warrant honest and critical consideration:

How well do we truly know our users and their associated identities?
How quickly can we detect an adversary if they were operating covertly amongst our legitimate users?

If either of these questions elicits uncertainty, it is time to rigorously evaluate how identity risk intelligence can effectively bridge that critical gap. I recommend you begin by exploring solutions that aggregate breach data and provide actionable insights, such as a comprehensive risk score or posture, which your current security ecosystem can seamlessly leverage.

Identity-centric intelligence is vital against sophisticated attacks, surpassing traditional methods for better breach detection. CISOs enhance breach prevention by viewing identity risk holistically, moving beyond basic IOCs. North Korean attacks and data breaches highlight the urgent need for identity-focused security. Implement identity risk, entity graphing, and Zero Trust for a proactive, resilient security posture. Understanding and securing identities equips organizations to navigate complex future threats effectively. Fundamentally, this requires understanding identity risk intelligence and it’s role in disinformation security.