Access & Identity Anomaly Detection

Compromise usually shows first in access, an unusual login, a privilege change, a session at the wrong time, but those signals are buried across systems and found only after the fact.