This article demonstrates how Beyond Identity’s risk and misconfiguration detections—such as baseline checks, threat indicators, and behavior changes—can be used in policy rules to enforce security controls and respond to anomalous or risky authentication events.
Below are examples of how you can leverage our risk and misconfiguration detections to enable security controls via the Beyond Identity policy engine. For information on using the Risk Dashboard, see Understanding the Risk Dashboard.
Risk Signal Types
Baselines - Risk signals that detect deviations from standard security practices, like enabling a firewall and keeping the OS up-to-date.
Threat indicators - Risk signals that detect indicators of compromise that could occur if an identity or device is stolen.
Behavior changes - Risk signals that detect anomalous behaviors. These are not "smoking guns" for malicious activity but could provide further evidence of an active threat.
Signal Name & Type | Description & Policy Controls |
|---|---|
Anomalous authentication interval (Behavior change) | Checks whether the time between authentication and trailing authentication is anomalously long, > 30 days. Example usage in policy |
Antivirus off (Baseline) | Checks whether the authenticating macOS or Windows device has antivirus disabled. Example usage in policy |
Biometric not (Baseline) | Checks whether the authenticating Android, iOS, Windows, or macOS device does not have biometrics set. Example usage in policy |
BitLocker disabled (Baseline) | Checks whether the authenticating Windows device has BitLocker disabled. Example usage in policy |
Fast travel (Threat indicator) | Checks whether consecutive authentication locations from the same user imply travel speed > 500 mph. Example usage in policy |
FileVault disabled (Baseline) | Checks whether the authenticating macOS device has FileVault disabled. Example usage in policy |
Firewall off (Baseline) | Checks whether the authenticating macOS or Windows device has a disabled firewall. Example usage in policy |
High frequency authentications (Behavior change) | Checks whether an authentication follows a string of 4 prior authentications from the same user in a period of less than a minute. Example usage in policy |
IP blocklists (Threat indicator) | Checks whether the authentication IP is part of a public blocklist, including known TOR exit nodes. Example usage in policy |
Jailbroken/ (Baseline) | Checks whether the authenticating device is jailbroken (iOS) or rooted (Android). iOS example usage in policy Android example usage in policy |
Moderate phishing resistance (Baseline) | Checks whether the authentication uses a launch mechanism that is sub-optimal still offers moderate phishing resistance. More specifically, this signal detects launch mechanisms that exclude origin information but still do an IP check. The following authentication launch mechanisms trigger detections:
Example usage in policy |
New geolocation (Behavior change) | Checks whether a user authenticates from a new location relative to their previous year of authentication history. Example usage in policy |
New passkey (Behavior change) | Checks whether a user authenticates from a new passkey. Example usage in policy |
No TEE (Baseline) | Checks whether the authenticating device does not have TEE (Trusted Execution Environment OR TPM/Secure Enclave). macOS example usage in policy Windows example usage in policy |
OS end-of-life (Baseline) | Checks whether the authenticating device OS is past end-of-life. Example usage in policy |
OS vulnerabilities (Baseline) | Checks whether the authenticating macOS or Windows device OS has more than a specified number of critical or high severity Common Vulnerabilities and Exposures (CVEs). Recommended values:
Example usage in policy |
Password not set (Baseline) | Checks whether the authenticating Android, iOS, Windows, or macOS device is not password or passcode-protected. Example usage in policy |
Roaming (Baseline) | Checks whether the authentication uses the roaming launch mechanism, which offers minimal phishing resistance. Roaming applies to authentications made from a secondary device that is enrolled with Beyond Identity. This option requires that Roaming Authentication is enabled. See Configure roaming authentication for more information. Example usage in policy |
Suspicious geolocation (Threat indicator) | Checks whether the authentication geolocation is from a country known for suspicious activity.
Example usage in policy |