It's nice to see people putting effort into tackling things from the human side outside of phishing awareness campaigns and annual training. Even CrowdStrike noted in their annual report that something like 70% of successful attacks were interactive intrusions without malware.

I'm on my phone and can't dive deep right now, but are you able to create detections in SIEMs to identify these kinds of users and behaviors based on this research?