Identity has become a critical attack surface for modern enterprises. Human identities, non-human identities, secrets, and AI Agents operate across cloud, SaaS and on-premises environments.
Excessive permissions, dormant accounts and misconfigured access policies leave organizations vulnerable to identity-based attacks. According to the 2026 Unit 42 Global Incident Response Report, identity weaknesses played a role in nearly 90% of investigations, highlighting how attackers continue to exploit gaps in identity security.
Yet identity security remains divided between two disciplines. Cloud security teams focus on preventing risk by identifying and reducing excessive permissions, misconfigurations and exposed identities. Identity Security Operations teams focus on detecting suspicious activity and responding to identity-based threats.
The challenge is that attackers don't operate within these boundaries. An overprivileged account identified by a cloud security team today could become the compromised identity a SOC analyst investigates tomorrow. Without shared context, security teams are left connecting the same identity risks across separate tools and workflows.
Effective identity security requires understanding both where identities are exposed and when that exposure becomes an active threat.
Bringing Identity Posture and Threat Detection Together
Palo Alto Networks is introducing the new Unified Identity Security Dashboard on the Cortex platform, bringing together preventive identity posture management from Cortex Cloud and real-time identity threat detection and response from Cortex ITDR.
With a single operational view across cloud, SaaS and on-premises environments, security teams can monitor identity exposure, misconfigurations, active threats and authentication activity without switching between separate tools and dashboards.
From Identity Exposure to Active Threats
Consider an inactive administrator with excessive permissions and access to sensitive data. From a posture perspective, the account represents unnecessary exposure. But if that same identity begins exhibiting suspicious authentication activity, the risk becomes far more urgent.
With the Unified Identity Security Dashboard, security teams can use interactive risk funnels to identify combinations of identity exposure and risky activity, then drill into individual identities to investigate findings and take action. High-risk rankings and custom watchlists provide additional context for monitoring identities that require closer attention.
By connecting posture and runtime insights, security teams can better understand how existing identity risks relate to active threats and accelerate investigation and remediation.
The Power of Cortex Cloud and Cortex ITDR
Identity security requires more than preventing risk or responding to threats in isolation. Organizations need both, working together.
By bringing Cortex Cloud and Cortex ITDR together, the Cortex platform connects preventive identity security with real-time threat detection and response, giving cloud security and SOC teams the context to act before risks become incidents and respond when attacks occur.
The new Unified Identity Security Dashboard is available with existing Cortex Cloud Posture, Cortex Cloud Runtime and/or Cortex ITDR purchases, with capabilities based on existing licenses.
See Unified Identity Security in Action
Identity security shouldn't stop at identifying risk. Bring preventive posture management and real-time threat response together with Cortex Cloud and Cortex ITDR.
Request a demo to see how the Cortex platform helps your teams identify identity exposure, investigate active threats and accelerate remediation across the enterprise.