> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-security-posture.md). # Identity security posture DoControl’s Identity and Risk Management solution determines the risk profile for each identity in your SaaS ecosystem. The risk profile is based on comprehensive data collection including data access patterns, user permissions, and relevant business context from HRIS or Okta. {% hint style="info" %} Identities is a beta module and is being released gradually. For more information, please contact Customer Support. {% endhint %} DoControl’s Identity security posture allows you to: * Discover and monitor your SaaS identities to protect your organization from identity threats * In a single view, easily discover who are your riskiest internal users, and [drill-down](#identity-card) to investigate {% hint style="warning" %} * **Prerequisite**: Make sure you integrate DoControl with an HRIS app (HiBob, Workday, SAP SuccessFactors, BambooHR, Deel HR) or Okta to view your identity data. These integrations are mandatory. If DoControl is not integrated with HRIS/Okta and Google Workspace, you cannot access the Identity Risk Management solution. See [Prerequisites](/docontrol-user-guide/risk-management/identities.md#prerequisites). * If a user does not exist in an HRIS app (HiBob, Workday, SAP SuccessFactors, BambooHR, Deel HR) or Okta, s/he will **not** be created as an identity. {% endhint %}

DoControl provides Identity Risk Management in a single view

{% hint style="success" %} By default, internal users are displayed from the riskiest (highest risk score) to the least risky (lowest risk score). {% endhint %} ## Identity mini-dashboard The mini-dashboard for identities provides your organization with an overview of your risky identity posture. At a glance, you can view your organization's: * [Total number of risky identities](#total-risky-identities) * [User personas](#user-personas) * [Top risky user spikes ](#top-risky-user-spikes) * [Top risky departments](#top-risky-departments) * [Organizational access map](#organizational-access-map)

{% hint style="success" %} **The identity dashboard is interactive**: Click any value to display filtered results in the table below. {% endhint %} ### Total risky identities View the total number of risky identities in your organization:

* **Risky/ total identities** - Number of critically risky users (with a score of 80 and above) out of the total number of identities in your organization. * **Risk bracket breakdown** - View the percentage and number of risky identities in each risk bracket: * **Critical** - Users with a risk score between 80-100 * **High** - Users with a risk score between 50-79 * **Medium** - Users with a risk score between 30-49 * **Low -** Users with a risk score between 0-29 {% hint style="success" %} **Interactive tip**: Click any risk bracket to display all filtered identities in that risk bracket. {% endhint %} ### User personas View the total number of risky user types in your organization:

* **Watchlist -** User is being monitored for risky behavior * **VIP** - User is director, Vice President, or head of department (active users only) * **Admin** - User is an admin for at least one SaaS app (active users only) * **Terminated** - A user is no longer employed * **Departing** - A user is about to leave the organization * **Dormant** - User has been inactive for at least 30 days {% hint style="success" %} **Interactive tip**: Click any user persona to display all users in that category. {% endhint %} ### Top risky user spikes View the top risky users with the greatest risk score increase over the past 7 days.

* **Left column** - Indicates user's risk score 7 days ago * **Right column** - Indicates user's current risk score {% hint style="success" %} **Interactive tip**: Click any user to display their risk tab with a breakdown of all risk elements contributing to that user's score. {% endhint %} ### Top risky departments View the risk scores for the riskiest departments in your organization, with an indication if the risk score increased or decreased, or remained the same, in the last 30 days.

{% hint style="success" %} **Interactive tip**: Click any department to display all users belonging to that department. {% endhint %} ## Identity posture elements Data for Identity and Risk Management is displayed according to these parameters:

Parameter	Description
Risk	User's total risk score, based on multiple risk elements. The arrow indicates an increase or decrease in the user's risk score compared to the last 30 days. For more info, see Risk score logic.
User name	Clicking the user's name opens the Identities drawer for that user. Special users with increased risk are indicated with these icons: VIP - A VIP user has an executive status, such as a director, Vice President, head of department, or C-level manager Admin - The user is an admin in at least one SaaS app
Employment status	User's employment status as updated by Okta or HRIS: Active About to leave Terminated
Job title	User's role or title
Department	User's organizational department, such as Sales, Customer Success, or Product Management.
Exposure	Breakdown of the user's attack surface in terms of shared Google and Slack assets: Internal - Assets shared within your organization External - Assets shared with external collaborators Public - Assets publicly open to the world
Triggered	Total number of alerts and workflows triggered by the user. Clicking the icon opens the Triggered entities window for alerts and workflow executions triggered in the last 30 days.
Risk trend	Change in user's risk score over the last 30 days
Last activity	Most recent event triggered by a user or app acting in a user’s name

## Identity filters You can use these quick filters to filter identities: {% hint style="success" %} * Leverage DoControl's **auto-complete** function to quickly search for and locate identities by user name, department, employment type, or job title. * For investigation purposes, you can also filter [risky events](/docontrol-user-guide/saas-data-monitoring/events/filtering-events.md#risky-events). {% endhint %}

Quick filter	Description
User name	Start typing to filter users with that string, which can appear anywhere in the user's name.
Risk score	Select a risk bracket to filter users by: Critical: 80-100 High: 50-79 Medium: 30-49 Low: 0-29
Employment status	Filter identities according to one or more employment statuses (based on HRIS data): Active Terminated About to leave
Department	Start typing to filter departments with that string, which can appear anywhere in the department name.

Additional filter options for identities include:

Filter	Comparator	Description
Admin	Equals	True, false
Email	String	Work or personal email: Equals, doesn't equal, starts with, ends with, contains, doesn't contain, includes, excludes
Employment type	String	Name of employment position, such as part-time: Equals, doesn't equal, starts with, ends with, contains, doesn't contain, includes, excludes Start typing to filter employment types with that string.
Exposure	Includes, excludes	Public, external, internal
Job title	String	Name of role: Equals, doesn't equal, starts with, ends with, contains, doesn't contain Start typing to filter job titles with that string.
Last activity	Date	Date of most recent event triggered by a user or app acting in a user’s name: Equals, after, before, is between
Triggered	Includes, excludes	Workflows, alerts
VIP	Equals	True, false

{% hint style="success" %} With the **email** filter, you can search for identities by work or personal email. {% endhint %} ## Organizational access map View the geographical distribution of access events for all internal users over the last 90 days. Hover over the frequently accessed countries to see the accessed cities in that region.

{% hint style="success" %} Click the **Expand** ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FiRgC0aQyp3q1E1pMTc9X%2Fexpand%20icon.png?alt=media\&token=63311cb6-22c1-432f-b9f1-7b3aadc7d40c) icon to view global access details with a breakdown according to locations, users and events. {% endhint %}

View the geographical distribution of access to your organization according to these parameters:

Access parameter	Description
Location	City and country where the access event took place
Percentage	Number of access events in a specific location as a percentage out of the total number of global access events
Events	Number of access events in a specific location

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-security-posture.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.