Unit 42 uses behavioral clustering to identify cloud identity roles, covering over 40,000 identities across 125 cloud environments

Unit 42 proposes a behavioral clustering model based on cloud audit logs, using UMAP and HDBSCAN to map cloud identities into functional roles such as administrator, backup service, security tool, and DevOps. The data comes from 125 cloud environments, over 40,000 identities, over a two-month period.