In our last two posts, we talked about acting on identity risk: remediation that fits the finding, and previewing the blast radius before you revoke. Both assume something that’s easy to skip past. Before anyone can act on a finding, someone has to understand it.
That part takes longer than it should. A query comes back with 96,631 users. The number is real, but it isn’t an answer. Is that bad? Is it getting worse? Is the risk level still right? Which identities should you fix first? Answering means reading the query definition, pulling the trend, checking the risk profile, and doing the math yourself. Multiply that by every query in your library and you find the real bottleneck in identity security: findings that are technically visible and practically ignored.
A finding nobody understands is a finding nobody fixes.
Query Agent puts your team in conversation with the query. Ask what it means, change its severity, reclassify it, or ask what to fix first, all in plain language, with every change waiting for your approval.
The risk was visible. Nobody acted on it.
The breaches that hurt most rarely start with something no one could have known. They start with a gap that was sitting in a report, a policy, or an alert, waiting for someone to read it and decide.
The portal the policy said was covered
In February 2024, attackers used compromised credentials to log in to a Change Healthcare Citrix remote access portal that didn’t have multifactor authentication. UnitedHealth Group’s policy called for MFA on all external-facing systems, and lawmakers pressed its CEO on why this one was the exception. Nine days after that first login, ransomware was running across the network. The rule existed. The exception stayed invisible until it was the headline.
Hundreds of accounts, one missing control
In June 2024, Mandiant reported that a threat actor it tracks as UNC5537 had accessed Snowflake customer instances using credentials stolen by infostealer malware, some from infections dating back to 2020. The common thread was simple: the affected accounts didn’t have MFA enabled, so a valid username and password was all it took. This is exactly the kind of gap an MFA health query exists to find. Finding it is the easy part. Deciding what to do about it, before someone else does, is the hard part.
The alert that fired and waited
The 2013 Target breach is still the textbook case. A Senate Commerce Committee staff report found that Target’s anti-intrusion software triggered several alerts when attackers delivered their malware, and that the company didn’t follow up in time. The same report quoted a former Target vendor manager saying the company rarely required two-factor authentication from its low-level contractors. The attackers got in with a vendor’s stolen credentials.
Three different years, three different industries, one pattern. The signal existed. The time and expertise to turn it into a decision didn’t. More detection won’t fix that. Faster understanding will.
Where findings stall
Every query passes through the same four decisions on its way to a fix. Each one is a place where good findings go quiet.
|
Where it stalls |
What usually happens |
What Query Agent gives you |
|
Understanding the query |
Someone reads the definition, metadata, and results by hand, and the finding waits in a queue |
A plain-language explanation of scope, risk, and trend, pulled from the query itself |
|
Judging severity |
The risk level set at creation never gets revisited, even as the numbers change |
Change the risk level in one sentence, with a card that shows exactly what will change before it does |
|
Classifying the risk |
The query sits under the wrong risk profile and lands in the wrong report |
Reclassify under a different risk profile, and roll it back just as easily |
|
Deciding what to fix first |
Thousands of rows and no obvious place to start |
Top focus areas grounded in the query’s own counts and trends, with a recommended next step |
What’s new: Query Agent in Access AI
Query Agent lives in the Access AI panel on the query page. You ask in plain language. It reads the query’s metadata and trend history, answers with the numbers behind it, and proposes changes as cards you confirm or reject. Nothing changes on the query until you say so.
See it in action
Start with the question every analyst asks
In the demo, we open Test 19th Jun GM, an MFA Health query that returns 96,631 users. Choose Explain Query in the Access AI panel. Query Agent shows its work as it goes: it fetches the query’s metadata by ID, pulls its time-series trends, and analyzes what it finds.
Explain Query starts a visible chain of steps: metadata first, then trends, then analysis.
Get a readout, not a result set
The answer reads like a briefing from a colleague who has already done the homework. This is a public assessment query under the MFA Health risk profile at Medium risk. It spans more than 90 integration types, including AWS, Okta, Azure, Active Directory, Google, and Snowflake. About 96,568 of the 96,631 identities it evaluates are flagged, roughly 99.9 percent.
It reads the trend too. The total grew by about 190 identities over seven days while the flagged count held steady, which points either to a lag in evaluation or to newer identities that do meet the MFA requirement. And it calls out what’s missing: the query has no stored risk explanation or remediation steps, so the next responder would have no guidance on what to do.
Scope, severity, and the share of identities at risk, in a few sentences.
Change severity in a sentence
When 99.9 percent of identities lack healthy MFA, Medium undersells the risk. So we ask: Set the risk level of this query to HIGH. Query Agent doesn’t just flip a field. It returns a confirmation card that states the change, notes that every risk this query produces will reflect the new severity, and drafts a risk explanation to go with it.
Every change arrives as a card you confirm or reject. Nothing happens until you choose.
Approve it, and it’s live
Choose Confirm and the query updates in place. Risk Level now reads High, and the query carries a risk explanation and remediation guidance: enforce MFA enrollment for every flagged identity through your identity provider, remove or suspend accounts that can’t enroll, and set conditional access policies that block sign-in without a valid second factor. The gap Query Agent pointed out a minute earlier is closed, and the context now travels with the query.
The risk level and its rationale update on the query the moment you approve.
Reclassify, and roll back just as easily
Risk profiles decide where a query shows up and who looks at it. Ask Query Agent to update the profile to Access Risk and the confirmation card explains the effect: the query will focus on standing access threats rather than authentication strength. Confirm, and the profile changes on the query.
Changed your mind? Ask it to revert to MFA Health. Same card, same approval, back where you started. When undoing a change is this cheap, people make the right call faster.
Reclassifying a query is one request and one approval. Reverting is the same.
Ask what to fix first
Then the question that matters most: Tell me the 3 top things I should focus on for this query. The answer is specific and grounded in the query’s own data.
- Near-total MFA coverage gap. 96,568 of 96,631 identities are flagged, more than 99.9 percent. This isn’t a pocket of bad hygiene. It’s organization-wide exposure to credential-based attacks.
- The gap is widening. About 190 identities joined the query in the past week, and new accounts are being provisioned without MFA enforced at onboarding.
- Systemic breadth across 90+ integrations. The gap spans AWS, Azure, Okta, Salesforce, Snowflake, GitHub, Google, Workday, and more, so fixing one system at a time won’t close it.
It closes with a recommended next step: enforce MFA through your identity provider with conditional access policies that block authentication without a valid second factor, and suspend accounts that can’t enroll.
Three focus areas and a next step, drawn from the query’s own counts and trends.
How this strengthens your identity security posture
You understand a finding in seconds. The explanation, the share of identities at risk, and the trend arrive together, so no one has to reverse-engineer a query before deciding what to do.
Severity keeps up with reality. When the data says High, you make it High in one sentence, and every risk the query produces follows.
People stay in control. Every change is a card you confirm or reject. Query Agent proposes. You decide.
Mistakes are cheap to undo. Reverting is the same one-sentence request, so trying the right classification never feels risky.
Context travels with the query. The risk explanation and remediation guidance live on the query, ready for the next analyst, approver, or auditor.
You start where it matters. Focus areas come ranked and backed by numbers, so the first hour goes to the biggest exposure, not the longest list.
Where this is going
Query Agent reflects a simple idea we’re building into Access Intelligence: the fastest path from finding to fix runs through a conversation, and people approve every step. Understanding a query, adjusting it, and deciding what comes next shouldn’t take three tools and an afternoon.
We’re extending the same ask, understand, approve pattern across Access Intelligence, so more of the path from finding to fix happens in one place, with your team in the loop.
Try it today
Open a query in Access Visibility, open the Access AI panel, and choose Explain Query. Then ask the questions you’d ask a teammate. Is this risk level right? Does this belong under a different profile? What should we fix first? Confirm the changes you agree with and leave the rest.
A finding only matters once someone decides what to do about it. Now that decision is one conversation away.
About the author
