Home / Platform / Identity threat remediation
Identity threat remediation
Identity threat remediation is the control that detects a compromised or over-entitled identity, ends the live privileged session, and rotates the credential, with a person approving any write action. Quantlyx Security ranks the entitlement, shows the evidence, and routes the fix to an owner.
Ranked worklist: the entitlement, the evidence and the proposed fix on one line.
What identity threat remediation means
Most identity tools stop at detection. They tell you a service account is over-entitled, a token outlived its owner, or a session looks wrong, and then the work moves to a ticket. Identity threat remediation is the part after the alert: contain the session, rotate the credential, remove the standing grant, and prove that the source system agrees the change happened.
The same control covers every actor that can reach your data: people, service accounts, build identities, release bots and coding agents. A compromised bot token is the same kind of problem as a compromised administrator, and it has to land on the same worklist.
How identity threat remediation works in Quantlyx
1. Detect the identity that matters
The threat library reads the approval record and the lifecycle record side by side and raises only the lines where they disagree: a revoked grant still in use, an automation identity with a role nobody approved, a token with no owner.
2. Rank and attach evidence
Each finding is ranked by risk and carries a plain-language definition and the commit, build, deployment or checkout that produced it. The accountable owner gets the evidence, not a score.
3. Remediate with approval
QuantQFix proposes a playbook per finding: remove the elevated role, reduce the identity to read, contain and rotate, or open a change record. A person other than the proposer approves it.
4. Contain the session
Access management analyses the privileged session and can terminate high-risk activity, so a compromised identity does not keep working while the ticket waits.
5. Rotate the credential
The playbook rotates the token or secret the revoked entitlement depended on, so the record and the pipeline finally agree. Every reversible playbook captures the state first, so it can be undone.
6. Close only on proof
A case closes when the next collection from the source system shows the change, not when a playbook reports success. The proposal, approvals and each action sit in one hash-chained trail.
Identity threat remediation versus PAM session recording
Session recording tells you what a privileged user did after the fact. It is evidence, and it is useful in an audit. Identity threat remediation works earlier and acts on the cause: it finds the entitlement that should not exist, ends the session that is using it, and rotates the credential so the access cannot be reused.
The two are complementary. Keep the privileged access platform you run today as the system of record. Quantlyx sits on top of it, reads from it, and carries the finding to the owner. It does not become another identity store and it does not grant access.
Remediation with a person on every write action
Read-only by default
The reconciliation core has no write access. It cannot change a pipeline, block a build or break a release.
One credential, one action
QuantQFix runs under a credential scoped to a single action, and you can withdraw its permission without losing your findings.
Two approvals where it matters
Production or critical cases need two approvals, one from an independent security approver. The proposer cannot approve their own playbook.
Anything that cannot be undone, or that could stop a release, such as revoking a signing key or a deploy key, stays a proposal that the owning team carries out. QuantQFix is ready for pilot and not yet generally available.
Identity threat remediation: common questions
What is identity threat remediation?
It is the control that detects a compromised or over-entitled identity, ends the live privileged session, and rotates the credential, with a person approving any write action.
How is identity threat remediation different from PAM session recording?
Session recording documents what happened. Identity threat remediation finds the entitlement behind it, ends the session and rotates the credential so the same access cannot be used again.
Does Quantlyx write to production systems without approval?
No. Quantlyx is read-only unless you approve a QuantQFix action. Nothing leaves your tenant, and an action runs only after a person other than the proposer approves it.
Where to go next
ID entitlement. Rank by risk. Remediate.
Start with a two-week, read-only pilot against one lifecycle path. If nothing turns up, you keep a clean report.