What it means
Effective detection uses provider events and context that traditional endpoint or perimeter tools may not see, such as token use, role assumption, policy change, unusual API calls, or cross-account access.
Why it matters
Cloud attacks often rely on valid credentials and native services. Detection must therefore understand normal cloud behavior rather than look only for malware.
Practical focus
- Build detections around likely cloud attack paths
- Correlate identity, API, network, and data events
- Include account, region, resource, and session context
- Test response actions against real provider behavior
Common mistakes
- Sending every provider alert to analysts without triage
- Ignoring identity and control-plane activity
- Using on-premises detection assumptions unchanged
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: