What is a security identity?
A security identity is a user or service account that anchors access, activity, and investigations—enriched with context about privilege and relationships that changes how findings are interpreted.
What is a security identity?
Short answer
A security identity is a user or service account in your environment—human users, service principals, machine accounts, and similar—that anchors access, activity, and investigations. It is a decision lens, not just a directory record.
Explanation
Identities matter because security work attaches to who or what acted: the same alert on a contractor account is not the same decision as the same alert on a privileged administrator. Context—identity privilege (KID-GLS-0031), access relationships, and environment—changes what analysts prioritize and how they explain blast radius.
Guide: Understanding Security Identities (KID-CON-0090).