Identity Guard logo
SASETY service · Identity Guard

A security posture that adapts to the risk of each identity

Identity Guard conducts SASETY's 5 security technologies: it brings their signals together, assesses the risk of each identity and coordinates the response across all technologies at once. Then it gradually brings protection back to normal.

SASETY analyst running Identity Guard: alerts, dashboard and team coordination
The facts

Attackers no longer break in. They log in.

MICROSOFT DIGITAL DEFENSE REPORT 2025

+32 %

increase in identity-based attacks in H1 2025

MICROSOFT DIGITAL DEFENSE REPORT 2025

97 %

of identity attacks target passwords

VERIZON DBIR 2025

22 %

of breaches start with stolen or misused credentials

CNIL, 2025 ANNUAL REPORT

6 167

breaches notified to the CNIL in 2025 (+9.5% in one year)

How it works

A continuous loop, 24/7

Detection, immediate hardening, remediation, then a controlled return to normal.

1

Assess

Each identity receives a DEFCON score. Signals from the 5 technologies and Entra ID, correlated continuously.

2

Trigger

Protection evolves with risk. Graduated, targeted measures, orchestrated through APIs.

3

Verify

Remediation is proven.

4

Restore

The user gets access back. Controls relaxed, gradual return to trust.

Orchestration

Technologies that work together, orchestrated by Identity Guard

With SASETY, the 5 technologies share their signals with Identity Guard, which decides on the response and has it applied consistently everywhere, through APIs, within minutes.

Identity Guard logoIdentity GuardCorrelates signals · calculates the DEFCON score · orchestrates the response
Cato Networks logo
Access & usage
ReportsUnusual logins, location, SaaS and AI usage
AppliesLimit traffic, restrict SaaS, cut off an AI agent
Silverfort logo
Authentication
ReportsAbnormal authentications, service accounts
AppliesStronger MFA, temporary account block
Mimecast logo
Email & collaboration
ReportsCompromised mailbox, targeted phishing
AppliesReinforced mailbox protection, isolated messages
Halcyon logo
Ransomware
ReportsEncryption behaviour on an endpoint
AppliesEndpoint isolated, data restored
Pentera logo
Security validation
ReportsExposed credentials, attack paths
AppliesNew test to prove remediation
The DEFCON score

Graduated, targeted and reversible measures

Constraints apply only to the identity concerned, for as long as needed.

DEFCON 5 Trust Standard policies
DEFCON 4 Vigilance Targeted controls reinforced
DEFCON 3 Confirmed risk Stronger MFA and remediation
DEFCON 2 Containment Traffic and usage strongly limited
DEFCON 1 Crisis Identity blocked
Identity Guard logo
Identity Guard orchestration

One alert detected, every technology mobilises to protect the digital identity

Signal · MimecastCompromised mailbox
→
Identity GuardMoves the identity to DEFCON 3
→
Coordinated responseSilverfort strengthens MFA, Cato restricts access to SaaS applications
Signal · PenteraExposed password
→
Identity GuardMoves the identity to DEFCON 4
→
Coordinated responsePassword change enforced, authentications monitored by Silverfort
Signal · CatoAI agent showing risky behaviour
→
Identity GuardMoves the identity to DEFCON 2
→
Coordinated responseAgent rights suspended, traffic limited during remediation

Then Identity Guard verifies remediation and restores trust, step by step.

Identity Guard dashboard: users, technical identities, orphaned accounts, alerts by severity and source, remediation actions
Identity Guard dashboard

The risk of each identity, clear at a glance

  • DEFCON score per identity and trend over time
  • Weak signals and alerts consolidated from the 5 technologies
  • Measures applied, remediation and return to normal tracked step by step
  • A shared view for internal teams and our experts
SOC partner

“The SOC sees the alert. Identity Guard understands the identity, measures its risk and adapts its protection.”

Client SOC

Detect & investigate

  • Monitor the entire IT estate
  • Correlate alerts
  • Qualify incidents
  • Lead the overall response
+

Identity Guard

Adapt protection

  • Consolidate risk per identity
  • Contextualise by role and usage
  • Orchestrate coordinated controls and actions across the 5 technologies
=

Reduced risk

The SOC keeps the overall view. Identity Guard tracks remediation and manages the gradual return to trust.

What you gain

Between “let everything through” and “shut everything down”

Graduated response

Steps between “let everything through” and “shut everything down”.

Action in minutes

Decisions orchestrated and applied automatically across technologies.

Less noise

Moderate risk is handled, internal teams focus on what matters.

Back to normal

Less friction for users and fewer support tickets.

SASETY mascot under an umbrella

A step‑by‑step approach

Scoping workshop, prioritised protection plan, then continuous operations.

Book a demo →