What it does
Changes worth noticing.
Each of these is visible in most organisations already. The question is whether anyone sees it in time, and whether they know what to do about it.
Example: privilege appears quietly
Someone gains access outside the normal path
| What changed | Why it matters | Safe next step |
|---|---|---|
| An account is added to a group carrying significant access | It bypassed the request and approval process that exists for a reason | Confirm with the named owner whether it was intended, and reverse it if not |
Example: account recovery
Recovery activity that does not fit
| What changed | Why it matters | Safe next step |
|---|---|---|
| A recovery method is changed, then used, from an unfamiliar context | Recovery is a common route to account takeover and often looks legitimate | Verify with the account holder through a channel you already trust |
Example: a control is relaxed
A security setting changes without a request
| What changed | Why it matters | Safe next step |
|---|---|---|
| Enforcement on a sensitive application is weakened | The control was there for a reason, and nobody asked for it to change | Establish who made the change and whether it should stand |
Example: credential status
Something people rely on stops being valid
| What changed | Why it matters | Safe next step |
|---|---|---|
| A credential or entitlement is withdrawn, expires, or is issued unexpectedly | Downstream decisions may still be relying on it being current | Identify what depends on it and confirm the position with the issuer |
Example: dormant access
Access that outlived its reason
| What changed | Why it matters | Safe next step |
|---|---|---|
| An account with meaningful access shows no legitimate use for a long period | Unused access carries the same risk as used access, with nobody watching it | Confirm with the owner whether it is still needed, and remove it if not |
What makes a signal worth sending
Four things to check a candidate detection against before anyone builds it.
Someone would act on it
If the honest answer is that nobody would do anything differently, it is information rather than a signal.
There is a safe next step
A notice that raises alarm without saying what to do next produces anxiety, not security.
It has an owner
A named person or team who receives it and is expected to respond. Shared inboxes are where signals go to be ignored.
It stays rare
A signal that fires constantly stops being read within a fortnight. Rarity is a design requirement, not an accident.
Recognise one of these?
Tell us which change you would most want to catch, and how it would reach someone today.