Stop account takeover at the login.
Attackers don't break in anymore — they log in. Passwords get phished, leaked, and traded, and once someone has a valid one, most systems roll out the welcome mat. IdentityProtect blocks unauthorized logins and session hijacks the moment they happen — so a stolen password isn't enough to get in.
Part of the 1stProtect platform. One agent. No slowdown.
Direct answer
IdentityProtect applies runtime guardrails using user-space interception on the single SIGMA engine, so every action is evaluated before execution. It can enforce policy online or offline and coordinate with the on-host MCP gateway to preserve forensic context, reducing false positives while stopping unauthorized behavior at the action layer.
The front door is now the favorite way in. Attackers don't need an exploit when they can simply sign in as someone who already has access:
Credentials are phished, leaked in breaches, and bought in bulk every day. Sooner or later, an attacker has a valid one to your environment.
To most systems, the right password is the right person. An attacker who logs in with stolen credentials — or quietly hijacks a session that's already open — walks straight in looking completely legitimate.
IdentityProtect stops the unauthorized login itself — so having the password isn't the same as getting in.
How it works
IdentityProtect checks each login and session attempt against your policy, in real time — on the machine, as it happens.
When an attempt is unauthorized — like someone trying to take over a session that's already active — IdentityProtect cancels the logon on the spot. The right password isn't enough.
Every blocked attempt lands on the risks page with the details, so you can see exactly who tried to log in or hijack a session, and when.
One engine. 22 modules.
It runs on the same single SIGMA engine as the rest of 1stProtect — working alongside CredentialProtect to keep credentials from being stolen in the first place, and ADProtect to shut down Active Directory attacks. One agent, one policy, no conflicts — online, offline, or fully air-gapped.
What it stops:
See it in action
The setup. A Windows server runs with the 1stProtect agent installed and one real user already signed in and active.
The attack. An attacker who has stolen that user's password tries to hijack the active session. At the login screen, they enter the compromised password.
The block. IdentityProtect cancels the logon. The password is correct — and it still doesn't matter. The attempt is denied.
The record. On the risks page, an alert shows a login attempt matching the user who's already signed in — a session hijack — captured with the full details.
Deploy without breaking anything
IdentityProtect ships in Audit Mode by default. Watch exactly what's trying to log in across your environment — and exactly what would be blocked — without stopping a single thing. Baseline your environment, whitelist what's legitimate, then flip to Enforcement Mode with one config change.
No slowdown
<1% CPU overhead · <100ms enforcement latency
Works anywhere
Cloud · on-prem · Kubernetes · 100% offline / air-gapped
Your data stays on your metal
Raw telemetry never leaves the device · TLS 1.3 · SOC 2 Type II · ISO 27001
Built by the people who built the industry
1stProtect's team comes from CrowdStrike, SentinelOne, Check Point, Splunk, Cisco, Oracle, McAfee, Symantec, and NTT Data — the engineers who defined modern endpoint security, now building runtime protection for what comes next.
We'll deploy in Audit Mode and show you, in your own environment, exactly what's trying to log in today — then stop the attempts that don't belong.
Product FAQ
IdentityProtect blocks unauthorized logins and session hijacks in real time — even when the attacker presents the correct password. It enforces identity policy at the machine level so stolen credentials stop being a guaranteed way in.
IdentityProtect checks each login attempt against your policy, not just whether the password is valid. If someone tries to log in as a user who is already active on the machine — a classic session hijack — IdentityProtect cancels the logon on the spot, regardless of whether the credentials are correct.
Session hijacking is when an attacker with stolen credentials tries to connect to a machine where the legitimate user is already logged in, effectively taking over the session. IdentityProtect detects this pattern and cancels the unauthorized logon before it succeeds.
Yes. Lateral movement often relies on attackers logging in to new machines using compromised credentials that look legitimate. IdentityProtect enforces login policy on each machine independently, so valid-looking credentials from a compromised account can be blocked at every hop.
For your security & engineering team
IdentityProtect enforces identity policy on interactive logon and session-access attempts through the user-space SIGMA engine — blocking session hijacking and credential misuse even when valid credentials are presented, including connection attempts matching a currently logged-on user. Each denial is recorded by the on-host MCP AI Investigator and streams to your SIEM/SOAR (Splunk, Datadog, Elastic) via JSON, gRPC, MCP, or Syslog. <1% CPU, real-time enforcement, 100% offline-capable, with Audit and Enforcement modes.