Threat Detection

VeraID’s Identity Threat Detection and Response (ITDR) continuously monitors non-human identity behavior, detects anomalies, and scores threats in real time. By learning baseline patterns for each identity, ITDR surfaces suspicious activity before it escalates into a breach.

Behavioral Anomaly Detection

ITDR analyzes every action performed by managed identities and flags deviations from established behavioral baselines. Four categories of anomalies are tracked:

Unusual Time

Actions performed outside an identity’s normal operating hours. A CI/CD runner that only triggers during business hours but suddenly makes API calls at 3 AM is flagged.

{
  "anomalyType": "UNUSUAL_TIME",
  "identity": "svc-github-actions",
  "detail": "Action performed at 03:14 UTC. Baseline: 09:00–18:00 UTC weekdays.",
  "severity": "MEDIUM",
  "confidence": 0.87
}

Unusual Location

Requests originating from geographic regions or IP ranges where the identity has never operated.

{
  "anomalyType": "UNUSUAL_LOCATION",
  "identity": "svc-data-pipeline",
  "detail": "Request from 203.0.113.45 (SG). Baseline: 10.0.0.0/8 (US-EAST).",
  "severity": "HIGH",
  "confidence": 0.94
}

Unusual Model Usage

For AI agent identities, ITDR tracks which models are invoked and flags unexpected model access. An agent that normally uses gpt-4 suddenly calling a fine-tuned model or a different provider’s API is flagged.

{
  "anomalyType": "UNUSUAL_MODEL_USAGE",
  "identity": "agent-customer-support",
  "detail": "Model 'claude-3-opus' invoked. Baseline: 'gpt-4o-mini' only.",
  "severity": "MEDIUM",
  "confidence": 0.82
}

Unusual Frequency

Significant spikes or drops in activity volume. A service account that averages 200 requests/hour suddenly generating 5,000 requests may indicate credential compromise or a runaway process.

{
  "anomalyType": "UNUSUAL_FREQUENCY",
  "identity": "svc-payment-processor",
  "detail": "4,832 requests in last hour. Baseline mean: 215, stddev: 42.",
  "severity": "HIGH",
  "confidence": 0.96
}

Note

Confidence scores range from 0.0 to 1.0 and reflect how far the observed behavior deviates from the baseline. Scores above 0.8 indicate high-confidence anomalies that warrant investigation.

Behavioral Baselines

ITDR builds a behavioral baseline for each identity by analyzing historical activity over a rolling window. Baselines are learned automatically and adapt over time.

What Is Baselined

Dimension	Metrics Tracked
Temporal	Typical hours of operation, day-of-week patterns, seasonal trends.
Geographic	Source IP ranges, cloud regions, countries.
Volumetric	Request rate (mean, median, standard deviation), burst patterns.
Operational	API endpoints accessed, resources touched, action types.
Model usage	AI models invoked, token consumption, prompt patterns (AI agents only).

Baseline Learning Period

New identities enter a learning period during the first 14 days of activity. During this window:

• Anomaly detection is active but operates in observation mode — anomalies are logged but do not trigger alerts.
• The baseline model is refined with each observed action.
• After 14 days (or 1,000 actions, whichever comes first), the baseline is promoted to active mode and alerts begin firing.

Tip

You can manually end the learning period early via the API if you have high confidence in the identity’s expected behavior — for example, if it mirrors an existing identity you have already baselined.

curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  https://app.veraid.io/api/v1/threats/baselines/{identityId}/promote

Baseline Drift

Baselines are not static. ITDR uses an exponentially weighted moving average to adapt to gradual changes in behavior:

• Gradual shifts (e.g., a CI/CD pipeline that slowly increases in frequency over weeks) are absorbed into the baseline without triggering false positives.
• Sudden shifts (e.g., a 10x spike in one hour) trigger anomaly detection because they deviate sharply from the weighted average.

Threat Assessment

ITDR computes a threat score for each identity based on the severity, frequency, and recency of detected anomalies. The threat score is distinct from the posture-based risk score — it reflects active, real-time threat signals rather than static configuration issues.

Threat Score Computation

Threat Score = Σ (anomaly_severity × recency_weight × confidence)

Factor	Description
anomaly_severity	Weight assigned to the anomaly type (CRITICAL=4, HIGH=3, MEDIUM=2, LOW=1).
recency_weight	Exponential decay — recent anomalies weigh more than older ones.
confidence	The anomaly detection confidence score (0.0–1.0).

Threat Score API

Retrieve the current threat assessment for a specific identity:

curl -H "Authorization: Bearer $API_KEY" \
  https://app.veraid.io/api/v1/threats/assessment/{identityId}

Response:

{
  "identityId": "id_svc_payment_processor",
  "threatScore": 72,
  "level": "HIGH",
  "activeAnomalies": [
    {
      "type": "UNUSUAL_FREQUENCY",
      "firstDetected": "2026-03-19T14:22:00Z",
      "lastDetected": "2026-03-19T14:58:00Z",
      "occurrences": 12,
      "severity": "HIGH",
      "confidence": 0.96
    },
    {
      "type": "UNUSUAL_LOCATION",
      "firstDetected": "2026-03-19T14:25:00Z",
      "lastDetected": "2026-03-19T14:25:00Z",
      "occurrences": 1,
      "severity": "HIGH",
      "confidence": 0.94
    }
  ],
  "baselineStatus": "ACTIVE",
  "recommendation": "Investigate immediately. Multiple high-confidence anomalies detected concurrently suggest possible credential compromise."
}

Threat Levels

Score Range	Level	Recommended Action
0–20	LOW	No action needed. Normal variance.
21–40	MODERATE	Monitor. Review if score persists.
41–60	ELEVATED	Investigate within 24 hours.
61–80	HIGH	Investigate immediately. Consider restricting access.
81–100	CRITICAL	Automatic policy enforcement recommended. Rotate credentials.

Danger

A CRITICAL threat score indicates a high probability of active compromise. VeraID can automatically apply a DENY policy to the identity when the threat score exceeds a configurable threshold. See Alerts for automated response configuration.

Correlating Threats Across Identities

ITDR does not analyze identities in isolation. When anomalies are detected across multiple identities that share an owner, a credential source, or a permission boundary, ITDR correlates the signals and escalates:

• Same owner, multiple anomalies — If three service accounts owned by the same engineer all exhibit unusual behavior within an hour, the combined threat score for the owner is elevated.
• Same credential source — If multiple identities provisioned from the same secret store show anomalies, the secret store itself may be compromised.
• Same resource target — If multiple identities are making unusual requests to the same resource, it may indicate a coordinated attack.

Integration with Policy Enforcement

Threat detection feeds directly into the policy evaluation engine. You can create policies with risk score conditions that automatically restrict access when an identity’s threat score exceeds a threshold:

{
  "name": "block-high-threat-identities",
  "effect": "DENY",
  "subjects": ["group:all-identities"],
  "resources": ["prod:*"],
  "actions": ["*"],
  "conditions": [
    {
      "type": "RISK_SCORE",
      "maxRiskScore": 60
    }
  ],
  "priority": 900,
  "isActive": true
}

This policy automatically denies production access to any identity with a risk score above 60, providing automated containment while your security team investigates.

Next Steps

• Blast Radius Analysis — Understand the potential impact of a compromised identity.
• Alerts — Configure alert rules and automated responses for detected threats.
• Security Posture — Review your organization’s overall identity security health.