u/Fickle-Dirt4

When I'm in a new place and i've run out of the obvious stuff, I always end up stuck scrolling random pages and half the listings look terrible or dead I want the kind of local tour or activity that feels worth the time, not just the usual tourist filler.

Do you just check the big booking sites or is there some better way I'm missing? feeling a bit lost with this one tbh, thanks in advance.

Classic setup here: IdP + MFA, conditional access, endpoint/VPN/SaaS controls stitched together, periodic access reviews, static risk scoring, lots of manual investigation It works but feels reactive. Leadership wants to know if we should look at AI identity platforms doing behavioral baselines, continuous risk scoring, anomaly detection, and dynamic policy. Trying to cut through the marketing.
What we need:
Enrichment layer alongside our IdP (reading IdP/EDR/SaaS logs), not a full replacement.
Workforce + SaaS + VPN coverage. Treating service accounts/NHI as a separate track, since human behavioral baselines don't map well to 24/7 non human traffic.
Risk signals that enrich existing alerts, not a second alert universe.
Reports auditors and engineers can both use. A score needs to trace back to a specific control, not just look pretty.
A clear advisory vs enforcement split: new detections start analyst facing, get proven on false positive rate, then graduate to blocking/step-up. Otherwise dynamic policy and don't annoy users fight each other.
Detection latency and response latency measured separately, since fast detection with no automated containment path doesn't reduce risk.
Concerns:
A lot of "AI" is z-scores in a trench coat. Want to test this in POC, not take it from a slide.
Platforms that want the whole identity plane are a big commitment to walk back if it fails.
No dedicated data science team here, needs to be manageable by a small team.
I've only been thinking about false positive/friction cost. Need the flip side too: our current false-negative rate is unmeasured. Want to replay historical logs through a POC to see what our current process actually misses.
If you've gone down this path already: which platform actually reduced real risk instead of just generating more alerts, and how did it hold up once it hit production?