SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-impossible-travel

A user signs in from Nashville and, ten minutes later, from Tokyo. Which indicator of compromise is this?

Impossible travel, two sign-ins too far apart to be the same person.

Start playing free

  1. Resource consumption
  2. Impossible travel ✔
  3. Out-of-cycle logging

Why: No one can move that far in that time, so the account is probably being used by someone else. Security tools raise an alert to investigate.

Huh, didn't know that: Microsoft's detection uses a machine-learning algorithm that ignores obvious false positives, such as VPNs and locations other users regularly use.

The dad joke
Why didn't the IT team set up their remote office from the beach? It was too cloudy.
Like this card?
Play the game

References

Answer: Impossible travel. No one can move that far in that time, so the account is probably being used by someone else. Security tools raise an alert to investigate.

  1. Microsoft Learn, Defender for Cloud Apps anomaly detection policies learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
    originating from geographically distant locations within a time period shorter than the time it would have taken the user to travel
    Checked 2026-10-10.
  2. Microsoft Learn, Defender for Cloud Apps anomaly detection policies learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
    uses a machine-learning algorithm that ignores obvious "false positives" contributing to the impossible travel condition, such as VPNs
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyIn syslog (RFC 5424), which severity code is the most severe?Security & PrivacyWhat does a SIEM mainly do with the log data it collects?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?

That's stuff everyone should know.