Absolutely, and it’s a key part of what we watch. The cloud brings its own set of signals worth paying attention to, like a login coming from an unusual location, behaviour that doesn’t match a user’s normal habits, or the early signs that an account has been compromised. Those are often subtler clues than a classic break-in, but just as telling once you know what to look for.
