Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
Palo Alto Networks, Monday, September 14th, 2026
Unit 42 applies behavioral clustering to cloud identity activity to automate detection of anomalous principals.
Unit 42 presents a method for profiling cloud identities by clustering their observed API behavior rather than relying on static role definitions.
The research shows that machine and human principals fall into recognizable behavioral groups, and that deviation from a cluster is a strong signal of compromise or misuse.
It describes how the approach was turned into automated detections and the false-positive tradeoffs encountered.
The post is aimed at cloud security teams struggling with over-permissioned identities at scale.