Identity Threat Protection
watches each user’s session for threats with AI-driven detections and can respond automatically
Keeps watching each user’s behaviour, device health and other signals throughout their session, with what Okta calls AI-driven detections, to spot threats such as session hijacking and token theft. When it finds one it can respond automatically, for example by asking for multifactor authentication again, ending the user’s sessions across supported apps and devices, or running a workflow such as restricting access to read-only. It also brings in signals from connected security tools and SaaS apps.
Where to turn off Identity Threat Protection: see below.
Something wrong here? Tell us ↓
Okta ThreatInsight
spots and can block sign-in traffic from suspicious IP addresses
Analyses sign-in activity across all Okta customers with machine learning to find IP addresses behind attacks such as password spraying and credential stuffing, and checks each sign-in request against them before the user is authenticated. An admin chooses whether it only logs these attempts or also limits and blocks them. Okta keeps collecting ThreatInsight data for aggregation even when no action is selected.
Where to turn off Okta ThreatInsight: see below.
Something wrong here? Tell us ↓
Bot protection
a machine-learning model that judges whether a sign-in request comes from a bot
A machine-learning model checks requests to the sign-in, sign-up and password-recovery screens and judges how likely each one is to come from a bot. Depending on the setting, it only logs detections or also makes suspected bots pass an Okta Challenge, which needs no input from the user. Admins choose how sensitive it is, trading more false alarms against more missed bots.
Where to turn off Bot protection: see below.
Something wrong here? Tell us ↓
Security access reviews AI summary
an AI-written summary of a user’s risky access for the reviewer
When a security access review is opened on a user, often after a security incident, each review includes an AI-generated summary of that user’s access, pointing the reviewer to the most sensitive apps with the most unusual access. Okta also adds AI-generated summaries for the five most severe anomalies in the org. The reviewer, a person, decides whether to keep or revoke access.
Where to turn off Security access reviews AI summary: see below.
Something wrong here? Tell us ↓
Governance Analyzer recommendations
machine-learning approve-or-revoke suggestions for access reviewers
In access certification campaigns, Governance Analyzer uses machine learning on the org’s access data to suggest whether each user’s access should be approved or revoked. Reviewers see the recommendations only if an admin also turns on the Recommendation option for the campaign before it launches. Okta says the recommendations are for information only and do not replace the reviewer’s own judgement.
Where to turn off Governance Analyzer recommendations: see below.
Something wrong here? Tell us ↓
Auth0 Bot Detection
machine-learning models that judge whether Auth0 sign-in, sign-up or password-reset traffic comes from a bot
For apps that use Auth0 for sign-in, Auth0 uses large amounts of data and statistical models to spot bursts of login, sign-up or password-reset traffic that are likely to come from a bot or script, such as credential stuffing. Users coming from IP addresses with a high likelihood of being part of such an attack must pass an extra verification step. Sign-up requests can use a separate machine-learning model from the one used for logins. If no response action is set, it only records its risk assessments in the tenant logs.
Where to turn off Auth0 Bot Detection: see below.
Something wrong here? Tell us ↓
Auth0 Guide
an AI chatbot that answers admins’ questions about Auth0
An AI chatbot that answers questions about Auth0 asked in plain language. It searches Auth0’s documentation, blog and community and writes a summarised answer with links to its sources, which may be incomplete or wrong. For Enterprise customers who set up security alerts in Security Center, it also suggests steps from incident playbooks. Auth0 lists it as Early Access, rolling out in the US public cloud region.
Where to turn off Auth0 Guide: see below.
Something wrong here? Tell us ↓
