Today's credential based threats are complex, often touching many systems, using multiple log-ins, and spanning a period of several months. These insider threats involve the legitimate credentials and access privileges of real users, making them challenging for legacy security solutions to detect.