A system for detecting unauthorized access to cloud applications, comprising: a processing unit; and a memory, the memory containing instructions that, when executed by the processing unit, configure the system to: identify a first access attempt to a cloud application at a first time and from a first location; identify a second access attempt to a cloud application at a second time and from a second location; compute a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location; check if the computed velocity is greater than a velocity threshold; and generate a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized, wherein the system is further configured to: compute a risk score using a decision tree; determine whether the velocity event is a false positive based on the risk score; upon determining that the velocity event is a false positive, determine that the second access attempt is authorized; and upon determining that the velocity event is not a false positive, determine that an access attempt is unauthorized. a processing unit; and a memory, the memory containing instructions that, when executed by the processing unit, configure the system to: identify a first access attempt to a cloud application at a first time and from a first location; identify a second access attempt to a cloud application at a second time and from a second location; compute a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location; check if the computed velocity is greater than a velocity threshold; and generate a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized, wherein the system is further configured to: compute a risk score using a decision tree; determine whether the velocity event is a false positive based on the risk score; upon determining that the velocity event is a false positive, determine that the second access attempt is authorized; and upon determining that the velocity event is not a false positive, determine that an access attempt is unauthorized. identify a first access attempt to a cloud application at a first time and from a first location; identify a second access attempt to a cloud application at a second time and from a second location; compute a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location; check if the computed velocity is greater than a velocity threshold; and generate a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized, wherein the system is further configured to: compute a risk score using a decision tree; determine whether the velocity event is a false positive based on the risk score; upon determining that the velocity event is a false positive, determine that the second access attempt is authorized; and upon determining that the velocity event is not a false positive, determine that an access attempt is unauthorized. compute a risk score using a decision tree; determine whether the velocity event is a false positive based on the risk score; upon determining that the velocity event is a false positive, determine that the second access attempt is authorized; and upon determining that the velocity event is not a false positive, determine that an access attempt is unauthorized. <EOS>