Coordinated Abuse Across Cloud-Native Services: Why Per-Service Signals Miss the Attack

Coordinated cyber attacks frequently evade detection by existing security measures on cloud-native platforms. These platforms often operate with siloed systems for identity, payment, and messaging services, each evaluating events independently. Attackers exploit these gaps, mixing low-risk actions into larger schemes that only become apparent when viewed as a whole.

A key weakness in current approaches is the lack of connection between events across different services. By examining fraud detection solely at the service level, companies miss the larger picture. Fraud campaigns rarely appear as such when analyzed in isolation. For instance, a single service might recognize a few password resets, another might see small transactions, and a third might detect a burst of messaging activity. Each service applies its own risk models and moves on, failing to recognize the coordinated abuse.

The solution involves connecting the dots without sharing sensitive data. A system can identify related activities using pseudonymous identifiers and shared risk indicators, without exposing complete customer records. By grouping events into "episodes" that occur within a specific timeframe and share identifiable evidence, the platform can detect coordinated attempts without fully exposing user identities.

Key signals such as event counts, timestamps, and risk indicators from each service can help identify a pattern. These signals, which include event types and risk levels already calculated by the originating service, are shared among services. They enable a comprehensive evaluation of the situation without requiring access to the full data set.

Implementing this approach requires careful consideration of data privacy. Sensitive information like message contents, payment details, and raw request payloads must remain within their respective services. Only necessary signals should be shared to maintain a balance between privacy and security. Defining service boundaries early in the process helps manage access controls and prevents the system from becoming a broad data source.

Once episodes are identified, a combined scoring model evaluates the collected evidence. It considers factors like the number of services involved, the sequence of events, and the risk indicators. This model can detect patterns that would otherwise go unnoticed, allowing the platform to respond to coordinated threats more effectively. By aggregating these signals, the system can deliver a more robust defense against sophisticated attacks while preserving user privacy.