Key Insights
Last month at Black Hat, Abnormal brought Identity Threat Protection to general availability, extending the same behavioral AI that protects email into the identity layer. Identity Security Posture Management is one of the included capabilities, and it exists because visibility into identity misconfigurations was never really the hard part.
Every identity carries a posture: whether MFA is enforced, whether a privileged account has gone dormant, whether a service account holds more access than its job requires. Remediating these postures proactively helps reduce the likelihood of costly identity breaches, which cost an average of $5 million per incident and take months to identify and contain. However, knowing that you have a long list of posture gaps leaves security teams overwhelmed with what to fix first.
Why a Checklist Isn't a Strategy
Most traditional posture tools provide some form of visibility, but not prioritization. They scan an environment for misconfigurations like:
MFA gaps on privileged and non-privileged users alike
Dormant admin accounts that were never deactivated
Over-permissioned roles and stale access grants
Sign-ins from unmanaged devices or unapproved networks
Then they hand back a list categorized by policy severity, where a critical finding and a low-severity finding both look equally urgent because the tool has no way to know which one an attacker would actually use. A dormant admin account with excessive access is a bigger risk than a low-privilege user missing a device policy, but a checklist scored on violation count alone can't tell the difference. Most security leaders are not confident in their identity security posture and lack full insight into where their vulnerabilities actually sit. A backlog scored by severity alone is part of why. The gap between "non-compliant" and "actually exploitable" is where real risk hides.
Posture Built on the Same Behavioral Model as Detection
Identity Threat Protection already maps identity attacks to a threat library: a continuously updated catalog of named attack scenarios, like help desk identity fraud or session hijacking through a compromised vendor, that Abnormal tracks and correlates against each customer's own environment. ISPM uses that same threat library to score posture, so instead of ranking a misconfiguration by generic policy severity, it ranks it by real attack susceptibility: how many relevant violations an identity has, combined with how large a blast radius its compromise would create, weighted against which named attacks that specific gap actually enables.
That scoring runs on the same per-identity behavioral baseline that already powers Identity Threat Protection's detection, capturing what normal looks like for a specific person or service account rather than applying a population-wide threshold. Because posture and detection share one behavioral foundation, the two continuously inform each other: a posture gap tied to an active attack scenario surfaces above one that represents a policy violation but carries little real-world risk, and a live detection points straight back to the gap that made it possible.
Signals from Microsoft, Google, Okta, and Entra feed directly into a per-identity behavioral baseline and identity graph, covering human and non-human identities alike. From there, risky events and configurations are scored, surfacing the specific users who carry the most risk. Each finding comes with clear steps to remediate the underlying misconfiguration, so fixing it moves the tenant's overall posture score in a direction the team can see.
What This Looks Like in Practice
Picture a security team facing an environment of thousands of identities, spanning employees and service accounts, with thousands of policy violations logged across three platforms. Without a way to prioritize, that volume alone makes decisive action nearly impossible. Abnormal’s ISPM helps streamline this process by providing:
Overall Grade and Top Grade Impactors
ISPM narrows things down immediately by giving you one overall security grade and a short list of the specific actions that would move it the most, so instead of "100 identities are bypassing MFA," the team sees that those 100 identities increase exposure to three specific identity attack scenarios and that fixing them is worth more toward the grade than any other available action.
Posture Gaps Mapped to Specific Identity Attacks
Based on the behavioral understanding Abnormal builds for your environment, it spots how you may be vulnerable to trending identity attacks. For example, Payroll Redirect via Help Desk Identity Fraud is an attack scenario in which an attacker socially engineers the help desk into resetting MFA and redirecting a payroll deposit. In this environment, eight identities remain exposed, with four of six related gaps already closed and ten points still recoverable.
A List of High-Risk Users
Per-identity behavioral models surface the highest-risk users among thousands of identities. In this case, Brian Potter stands out with a Threat Exposure Score of 87 out of 100, driven by 41 policy violations and direct exposure to three named attack scenarios, including the same help desk fraud pattern above and a delegated admin abuse scenario tied to a vendor compromise. A team working from a generic violation count might never surface Brian ahead of an identity with more raw findings but far less real exposure.
A Drift Log
Posture is not static, so every policy regression and improvement across the environment is tracked continuously and tagged by risk, which means a newly opened gap gets caught the moment it appears rather than being rediscovered at the next quarterly audit.
Posture tells a team the door is open, and detection shows when someone walks through it. Abnormal’s ISPM makes sure the door that actually matters gets closed first.
To learn how Identity Threat Protection can help your organization reduce identity risk, connect with your Abnormal team or request inside access.
