Identity-based attacks the quiet cloud threat

​

Hi all,

Stolen cloud credentials are probably the most dangerous runtime threat. Attackers can move laterally and perform actions that look legitimate unless you’re watching behavior closely.

Here’s a blog that explains the different runtime vectors: [link](https://www.armosec.io/blog/cloud-workload-threats-runtime-attacks/)

How do you detect unusual activity caused by compromised credentials?