Identity signals are account and access indicators that show how a user or service is behaving. They include login times, device fingerprints, IP addresses, MFA challenges, session tokens, role changes, and unusual privilege use. Security teams compare these signals with normal patterns to decide whether activity looks legitimate or suspicious.
They matter because many attacks succeed by abusing valid accounts rather than breaking systems directly. A stolen password, hijacked session, or phishing-backed MFA approval can look normal at first glance, but identity signals may expose anomalies such as impossible travel, new devices, repeated failed logins, or access from uncommon locations. In defense, these signals help verify whether a public claim, alert, or victim listing aligns with real account activity before conclusions are drawn.