* [Blog](https://www.paloaltonetworks.com/blog) * [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/) * [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security/) * Unifying Identity Posture... # Unifying Identity Posture and Threat Detection with the Cortex Platform [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Funifying-identity-posture-and-threat-detection-with-the-cortex-platform%2F) [](https://twitter.com/share?text=Unifying+Identity+Posture+and+Threat+Detection+with+the+Cortex+Platform&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Funifying-identity-posture-and-threat-detection-with-the-cortex-platform%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Funifying-identity-posture-and-threat-detection-with-the-cortex-platform%2F&title=Unifying+Identity+Posture+and+Threat+Detection+with+the+Cortex+Platform&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/cloud-security/unifying-identity-posture-and-threat-detection-with-the-cortex-platform/&ts=markdown) \[\](mailto:?subject=Unifying Identity Posture and Threat Detection with the Cortex Platform) Link copied By [Andrea Halsted](https://www.paloaltonetworks.com/blog/author/andrea-halsted/?ts=markdown "Posts by Andrea Halsted") and [David Trigano](https://www.paloaltonetworks.com/blog/author/david-trigano/?ts=markdown "Posts by David Trigano") Nov 05, 2026 3 minutes [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security/?ts=markdown) [Identity Security](https://www.paloaltonetworks.com/blog/cloud-security/category/identity-security/?ts=markdown) [ISPM](https://www.paloaltonetworks.com/blog/cloud-security/category/ispm/?ts=markdown) [ITDR](https://www.paloaltonetworks.com/blog/cloud-security/category/itdr/?ts=markdown) [Security Operations](https://www.paloaltonetworks.com/blog/cloud-security/category/security-operations/?ts=markdown) Identity has become a critical attack surface for modern enterprises. Human identities, non-human identities, secrets, and AI Agents operate across cloud, SaaS and on-premises environments. Excessive permissions, dormant accounts and misconfigured access policies leave organizations vulnerable to identity-based attacks. According to the[2026 Unit 42 Global Incident Response Report](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report?ts=markdown), identity weaknesses played a role in nearly 90% of investigations, highlighting how attackers continue to exploit gaps in identity security. Yet identity security remains divided between two disciplines. Cloud security teams focus on preventing risk by identifying and reducing excessive permissions, misconfigurations and exposed identities. Identity Security Operations teams focus on detecting suspicious activity and responding to identity-based threats. The challenge is that attackers don't operate within these boundaries. An overprivileged account identified by a cloud security team today could become the compromised identity a SOC analyst investigates tomorrow. Without shared context, security teams are left connecting the same identity risks across separate tools and workflows. Effective identity security requires understanding both where identities are exposed and when that exposure becomes an active threat. ## Bringing Identity Posture and Threat Detection Together Palo Alto Networks is introducing the new Unified Identity Security Dashboard on the Cortex platform, bringing together preventive identity posture management from Cortex Cloud and real-time identity threat detection and response from Cortex ITDR. ![Unified Identity Dashboard](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/screenshot-2026-09-27-at-11-28-29-png.png) Figure 1: Unified Identity Dashboard With a single operational view across cloud, SaaS and on-premises environments, security teams can monitor identity exposure, misconfigurations, active threats and authentication activity without switching between separate tools and dashboards. ## From Identity Exposure to Active Threats Consider an inactive administrator with excessive permissions and access to sensitive data. From a posture perspective, the account represents unnecessary exposure. But if that same identity begins exhibiting suspicious authentication activity, the risk becomes far more urgent. With the Unified Identity Security Dashboard, security teams can use interactive risk funnels to identify combinations of identity exposure and risky activity, then drill into individual identities to investigate findings and take action. High-risk rankings and custom watchlists provide additional context for monitoring identities that require closer attention. ![Prioritize Top Runtime Cases and Posture Issues](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/word-image-372234-2.png) Figure 2: Prioritize Top Runtime Cases and Posture Issues ![Funnel Risk Summer \& Conditional Access](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/screenshot-2026-09-27-at-11-29-27-png.png) Figure 3: Funnel Risk Summer \& Conditional Access By connecting posture and runtime insights, security teams can better understand how existing identity risks relate to active threats and accelerate investigation and remediation. ## The Power of Cortex Cloud and Cortex ITDR Identity security requires more than preventing risk or responding to threats in isolation. Organizations need both, working together. By bringing Cortex Cloud and Cortex ITDR together, the Cortex platform connects preventive identity security with real-time threat detection and response, giving cloud security and SOC teams the context to act before risks become incidents and respond when attacks occur. The new Unified Identity Security Dashboard is available with existing Cortex Cloud Posture, Cortex Cloud Runtime and/or Cortex ITDR purchases, with capabilities based on existing licenses. ## See Unified Identity Security in Action Identity security shouldn't stop at identifying risk. Bring preventive posture management and real-time threat response together with Cortex Cloud and Cortex ITDR. [Request a demo](https://www.paloaltonetworks.com/cortex/cloud/demo?ts=markdown) to see how the Cortex platform helps your teams identify identity exposure, investigate active threats and accelerate remediation across the enterprise. *** ** * ** *** ## Related Blogs ### [CIEM](https://www.paloaltonetworks.com/blog/cloud-security/category/ciem-2/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Identity Security](https://www.paloaltonetworks.com/blog/cloud-security/category/identity-security/?ts=markdown), [Identity Security Posture Management](https://www.paloaltonetworks.com/blog/cloud-security/category/identity-security-posture-management/?ts=markdown), [ISPM](https://www.paloaltonetworks.com/blog/cloud-security/category/ispm/?ts=markdown) [#### Introducing Unified Human Identities: See the Person Behind Every Account](https://www.paloaltonetworks.com/blog/cloud-security/unified-human-identities-identity-risk-context/) ### [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security/?ts=markdown), [CNAPP](https://www.paloaltonetworks.com/blog/cloud-security/category/cnapp/?ts=markdown) [#### Cortex Cloud 2.3: Advancing Autonomous Cloud Defense](https://www.paloaltonetworks.com/blog/cloud-security/cortex-cloud-2-3-advancing-autonomous-cloud-defense/) ### [AI Security](https://www.paloaltonetworks.com/blog/cloud-security/category/ai-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/cloud-security/category/data-security/?ts=markdown), [Identity Security](https://www.paloaltonetworks.com/blog/cloud-security/category/identity-security/?ts=markdown), [SaaS Security](https://www.paloaltonetworks.com/blog/cloud-security/category/saas-security/?ts=markdown), [SSPM](https://www.paloaltonetworks.com/blog/cloud-security/category/sspm/?ts=markdown) [#### Introducing Cortex Cloud SaaS Security: Secure the Entire Attack Surface Across SaaS and Cloud](https://www.paloaltonetworks.com/blog/cloud-security/introducing-cortex-cloud-saas-security/) ### [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Software Supply Chain Security](https://www.paloaltonetworks.com/blog/cloud-security/category/software-supply-chain-security/?ts=markdown), [Vulnerability Management](https://www.paloaltonetworks.com/blog/cloud-security/category/vulnerability-management/?ts=markdown) [#### How Cortex Cloud Protects Against PHP2Shell Vulnerabilities From Code to Cloud](https://www.paloaltonetworks.com/blog/cloud-security/how-cortex-cloud-protects-against-php2shell-vulnerabilities-from-code-to-cloud/) ### [AppSec](https://www.paloaltonetworks.com/blog/cloud-security/category/appsec/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security/?ts=markdown), [Software Composition Analysis](https://www.paloaltonetworks.com/blog/cloud-security/category/software-composition-analysis/?ts=markdown) [#### Securing Open-Source Software in the Frontier AI Era](https://www.paloaltonetworks.com/blog/cloud-security/securing-open-source-software-in-the-frontier-ai-era/) ### [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Identity Security](https://www.paloaltonetworks.com/blog/cloud-security/category/identity-security/?ts=markdown), [Secure Browser](https://www.paloaltonetworks.com/blog/sase/category/secure-browser/?ts=markdown) [#### From Identity Blind Spots to Automated Governance with Prisma Browser](https://www.paloaltonetworks.com/blog/sase/from-identity-blind-spots-to-automated-governance-with-prisma-browser/) ### Subscribe to Cloud Security Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language