Early Warning
Every Blocked Attempt
Is Intelligence.
A request that gets rejected is not just a request that failed. Somebody tried to do something they were not entitled to do — and you should know who, what, and how often.
Why it is worth more here
A Firewall Sees An Address.
We See An Identity.
Protection runs after the caller has been authenticated, so every signal is attributable to somebody. A subscriber probing an operation they have no entitlement to is a very different event from an anonymous scan — and only one of them is worth waking up for.
Who tried
Named consumer, partner system or AI agent — not a source address. Attribution is the difference between an alert and a lead.
What they tried
The operation, and which control refused it: an entitlement they do not hold, a payload the contract does not permit, or a limit they exceeded.
How persistently
Severity rises with volume. A few refusals are usually a misconfigured integration. A burst is somebody looking for a way in.
Not a separate product
You Are Not Buying
Another Console.
These signals are produced by serving the request. There is no agent to install, no log pipeline to build, and no correlation step where somebody joins a gateway log to an identity provider log and hopes the timestamps line up.
The same record becomes your evidence for NIS2, DORA and the EU AI Act — because it was never a separate logging exercise.
- 01Identity — the consumer or agent, and the human it acted for
- 02Operation — what was being attempted, per operation rather than per API
- 03Control — entitlement, contract, or limit
- 04Severity — escalating with volume, so noise stays quiet and patterns surface
Where it goes next
A Signal Today
Is Blast Radius Tomorrow.
These events are recorded, and they form part of blast radius analysis. So the question stops being "was anything alerted last night" and becomes the one that actually matters: if this consumer were compromised, what could it reach — and if we change this operation, who is affected.
Before a change lands
Who depends on this operation, what they are entitled to, and how they have been behaving. Impact assessed against what is actually happening rather than against a dependency diagram someone drew last year.
After something looks wrong
The reach of a single credential, expressed in the operations and data it could touch — which is the first question asked in an incident and usually the slowest to answer.