Datasheet August 2024

Identity Threat Protectionwith Okta AI
Unify risk insights and continuously assess and respond to
identity threats in real-time, during and after login
Identity is a top attack vector. As organizations step up theirsecurity, leveraging signals from vendors that protect these

Identity security, threat actors are responding with new ways

diverse attack surfaces to eliminate silos and administrative

to breach defenses, including credential theft, privilege abuse,gaps. Effective response requires early action at the identity

and session hijacking. Focusing on a single threat surface

layer, controlling access, and Okta, as an identity provider,is not enough - just as attackers target multiple surfaces,delivers real-time inline protection to swiftly detect anddefenders must also take a holistic approach to identity

mitigate identity threats.

Datasheet August 2024

Overcoming Fragmented Security Views
and Balancing Security with Usability

Key Business Outcomes

Security teams often struggle with fragmented visibility acrossdisparate security solutions, making it challenging to effectively
detect and respond to identity threats. Siloed tools and lack ofintegration lead to blind spots, increased workload, and slower threat
response times. Additionally, organizations must strike a balance
between enforcing strong security measures and maintaining
a seamless user experience. Overly strict policies can hinder
productivity and cause user frustration, while overly lax policies leave
the organization vulnerable to attacks.

Stronger security posture
Use insights from Okta and your existing
security tools to continually assess users
and their sessions for risk and proactively
harden your identity security posture

Okta Identity Threat Protection (ITP) with AI addresses thesechallenges by providing holistic visibility into identity risk,
leveraging Okta's unique position as your IdP. With visibility into theauthentication patterns across diverse environments, Okta has an
informed understanding of what it believes is normal and anomalousbehavior. By applying advanced AI and machine learning to this richidentity data, Okta can detect even subtle changes in risk, such asvariations in IP addresses, to identify potential threats in real-time. It's
important to note that what Okta identifies as anomalous behavior
may turn out to be normal, and vice versa.

Faster threat detection and response
Leverage Identity threat analytics, Okta AI, andthird-party signals to detect Identity-related
threats like session hijacking in real-time andconfigure Identity Threat Protection to respondautomatically when it detects a threat.

Further, integrating insights from your existing security tools, allows
for a comprehensive view of risk, enabling streamlined investigations
and automated responses. Okta's scale and focus on being "always
on, always secure" for the world's largest organizations powers thisuniquely effective approach to identity threat detection and response.

Why Use Identity Threat Protection?
Part of Okta’s Workforce Identity Cloud, ITP is a suite of capabilities

Maximize value of security investments
Send and receive relevant security eventsfrom tools you already have to gain aholistic view of user risk and get morevalue out of your existing security stackin the Workforce Identity Cloud that strengthens your identity
security posture and enables continuous, real-time threat detection
and response throughout the user journey. Unlike other Identity
Threat Detection and Response (ITDR) solutions that rely solely on
integrations with the IdP, Identity Threat Protection is built natively
into Okta, which allows ITP to operate at the critical access control
point while still leveraging integrations with security providers toenhance threat visibility. By doing so, ITP expands your view acrossyour identity threat surface without relying exclusively on these IdP
integrations, providing more comprehensive threat detection andresponse. This unique position empowers Okta to detect identity
threats in real-time and allows you to rapidly remediate compromisedidentities. By enabling you to configure actions, such as blocking
users when a threat is detected, ITP significantly enhances yoursecurity posture with unmatched efficiency and effectiveness.

Better user experience
Enable long-lived sessions but use Identity
Threat Protection to help detect and automate
your responses to threats in real-time tominimize therisks associated with longlived sessions and tailor actions based onchanges in user or session threat levels
to balance security and convenience

Datasheet August 2024

How It Works
Okta’s Risk Engine
can detect threats like:

Identity Threat Protection leverages Okta risk signals alongsideintegrations with top security providers to provide real-time detection,
continuous assessment, and automated responses, as configured bySession

you, to identity threats, unifying risk insights and enhancing security athijacking

the identity layer.

MFA

Continuous Risk Evaluation

brute force

While risk-based authentication and common ITDR approaches canconsider post-login factors, they often lack the depth, granularity,Application session

and inline action capabilities of a native, universally integrated cloud

cookie harvesting

IdP like Okta. Identity Threat Protection continuously evaluates therisk of all users and their sessions against policies configured by youradmins, using information such as:

Access attempts fromphishing infrastructure• Session Risk Detection
Advanced machine learning models continuously evaluate every
authentication request post-authentication to detect identity

User-reported
anomalous behaviorrisks, such as session hijacking attempts, leveraging Okta's vastvisibility into authentication patterns.
• Entity Risk detections
Protection against identity-based attacks like brute force andAttempts to achieve privilege
escalation from high-risk IPs

credential harvesting• Context-Aware Device and IP Protection
Risk analysis using device context continuously monitored by

Lateral movement informed by
3rd party signals

Okta, including re-evaluating existing Okta Verify configurations
and leveraging Device Assurance policies to ensurecomprehensive security.

Shared Signals Pipeline
Beyond continuously evaluating risk with its own data, Okta also
integrates insights from other best-in-class security technologies toexpand your visibility into potential risks. Identity Threat Protectionuses the OpenID Shared Signals Framework (SSF) to transmit andreceive security event information from SaaS apps and third-party
security technologies such as:• MDM• CASB• EDR/XDR• UEM• SASE

Datasheet August 2024

Identity Threat Protection has out-of-the-box integrations with a wide range of best-of-breed security tools to provide the mostcomprehensive view of identity risk. Information such as elevated user privileges in an app, malware on a device, or a phishing email
in a user's inbox could all signal the start of an Identity-related attack. With Identity Threat Protection continuously analyzing signals
from across your security ecosystem, you gain unparalleled real-time visibility.

Continuous Risk Re-Evaluation

Adaptive actions in Identity Threat Protection enable you totailor automated responses to changes in an entity’s session or• Dynamic Global Session & Auth Policy Re-evaluation
Persistently re-evaluates policies throughout the user's

user risk level or the risk level of a particular session. Available
adaptive actions include:

session to maintain security posture• Risk-Based Entity Access Policies
Enables granular, adaptive policies driven by real-time userand entity risk insights• Universal Logout
Immediately clears sessions of supported apps andrevokes tokens for a particular user upon detecting
credential theft or session hijacking attempts• Inline MFA

Precision Risk Response
As your identity provider controls the authentication flow,
Identity Threat Protection enables real-time, inline responses todetected threats. Identity threat response should be immediate,
automatic, and tailored to the level of risk, so you can stopthreats with minimal disruption to users and their work.

Prompts a user to re-authenticate and/or steps up
authentication for new sessions when risk levels increase• Security Workflows & Orchestration
Initiates workflows to respond to risk events, such as
kicking off an investigation or limiting user access to view
only in particular apps to contain potential threats.

Datasheet August 2024

As an SSF transmitter, Identity Threat Protection can also drive downstream actions in receiver systems. Just as partner
solutions send signals and alerts to Okta, ITP can transmit risk insights to trigger responses in downstream applications
and services. For example, ITP can instruct a workforce app to log out a high-risk user or signal to Apple Business Manager
to restrict a compromised account.

Observability & Insights
Leveraging Identity Threat Analytics, ITP delivers visibility intothreats and analyzes anomalies to enable rapid, effective
response. It strengthens threat mitigation capabilities throughactionable insights, giving security teams the tools they need toanalyze and act upon threat data in a timely manner.
• Risk Investigation Reports
Enable security analysts to efficiently triage and investigate
identity-based threats• Security risk dashboards
Provide high-level overviews of identity risk posture andkey metrics• Rich system logs
Capture detailed event data and the reasoning behind risk
assessments for auditing and forensics

Getting Started
Identity Threat Protection is available with Okta Identity Engine and only available for Workforce Identity Cloud.

About Okta
Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—
anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility
and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on
innovation and accelerate digital transformation, thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building
a world where Identity belongs to you. Learn more at okta.com.