Consent Phishing & OAuth Grant Risk Ring (2D)

Detection Controls

Risk threshold 62

Malicious-app share 22%

New consent requests / min 18

Live Telemetry

Active grants

Pending review

Detection rate

—

Mean time-to-revoke

—

Active OAuth grant

Flagged — step-up auth pending

Revoked (token killed)

Cleared (false positive resolved)

How it works

Every new OAuth app requesting access to the identity hub gets three hidden signals — scope sensitivity S, inverse publisher trust D = 1 − T, and request-velocity anomaly V, each in [0,1]. A weighted risk model scores it:

risk = 100 · (0.40·S + 0.35·D + 0.25·V)

Apps above the risk threshold are flagged and enter step-up authentication. Genuinely malicious grants almost always fail that challenge and get revoked; legitimate apps pass roughly 90% of the time and are cleared, mirroring the false positives every real ITDR/UEBA pipeline has to tolerate. With automated response off, flagged apps queue for manual review instead of an immediate staged action — click "Process review queue" to resolve them by hand, the same trade-off SOC teams make between speed and human-in-the-loop safety.

Risk threshold — raise it to catch fewer false positives but let more real attacks slip through as active grants; lower it and the reverse.
Malicious-app share — how much of the incoming traffic is actually hostile (consent phishing, token-theft apps).
New consent requests / min — arrival rate of fresh OAuth grant attempts against the hub.
Detection rate — the fraction of truly malicious apps that were correctly revoked; mean time-to-revoke is the flagship ITDR KPI, tracked live from flag to kill.

This 2D companion view lays every OAuth grant on a ring around the identity hub — drag horizontally to spin it, drag vertically to tilt the ellipse — while a scrolling risk scope beneath plots each app's score against the live threshold line as time scrolls past. This is the same underlying pattern used to defend against consent phishing: an attacker tricks a user into approving an OAuth app's scope request, then abuses the issued token instead of ever touching a password — so defense has to watch the grant graph, not the login form.

t = 0.0s

drag to rotate ring

risk score scope — dashed line = threshold