UEBA
User and Entity Behavior Analytics. Machine-learning analysis of normal behavior to flag anomalies that signal compromise or insider risk. A common building block of identity threat detection.
UEBA is the analytic layer under most identity detection, and its value depends entirely on the baseline: a model trained during a period that already contained the intrusion learns the intrusion as normal. It works best on high-signal identity events (impossible travel, first-time privileged action, unusual consent grant) and worst as a general anomaly firehose that buries the analyst.
See also: what is ITDR, account takeover, lateral movement, ITDR vendors
Related on Start with Identity
- GlossaryITDR
Identity Threat Detection and Response. Security tooling that detects and responds to identity-based attacks such as account takeover, privilege escalation, and
- GlossaryAttack Path
A chain of individually legitimate permissions and relationships that together let a low-privileged identity reach a high-privileged one. Each link is a valid c
- GlossaryEntity Analytics
Entity analytics is the behavioural analysis of every identity in an environment, human and non-human, to learn what normal activity looks like for each one and
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.
- BlogOkta buys Permiso Security to put ITDR inside the identity provider
Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of
- PodcastSemperis
Semperis' biweekly show for defenders of hybrid Active Directory and Entra ID environments, hosted by 15-time Microsoft MVP Sean Deuby.