Identity drift
A verified worker signs in. Someone else takes over.
Manav watches typing cadence, mouse entropy, and the device fingerprint of every heartbeat. When the pattern diverges from the verified session baseline, we flag a ghost switch within seconds - long before fraud lands in an audit log.
Before: LOW
After: HIGH
The catchMid-session swap is caught the moment the typing changes.
JM
John Mercer
Backend Engineer (contractor) · CloudWorks
Baseline
Typing61 wpm · var 0.18
Mouseentropy 0.71
Devicefp-pc-john-01
Sessionses-john-01 · 09:01 CST
94 / 100
Presence
Heartbeat signal · live
Typing61 wpm
Δ vs baseline · 0%
Mouse entropy0.71
Δ vs baseline · 0%
Devicefp-pc-john-01
stable since 09:01
09:30 → 14:20. Five hours of consistent typing, mouse entropy near baseline, single device fingerprint. Presence score holds at 94.
14:21. Next heartbeat arrives. Typing cadence drops from 61 wpm to 24 wpm. Mouse entropy halves. Device fingerprint changes from fp-pc-john-01 to fp-pc-john-02 from the same IP.
14:21 + 1s. Three rules trigger together:
typingShift > 0.4, varianceShift > 0.5, deviceChanged. Manav opens an anomaly and pages the security team.Before · 09:30
Wpm61
Variance0.18
Mouse0.71
Devicefp-pc-john-01
Score94 / 100
After · 14:21
Wpm24 −61%
Variance0.51 +183%
Mouse0.31 −56%
Devicefp-pc-john-02
Score51 / 100
Anomaly opened
91% confidence
GHOST_SWITCH · severity high
Typing cadence dropped 61% and the device fingerprint flipped mid-session. Same IP - almost certainly a physical handover at the desk.
Open John's timeline
Detection result
{
"type": "GHOST_SWITCH",
"severity": "high",
"confidence": 0.91,
"evidence": {
"typingShift": 0.61,
"varianceShift": 1.83,
"deviceChanged": true,
"sameIp": true
}
}
Security review · 4 min
Keep the tour going.
Next: Parallel jobs - Same identity, two cities, same minute.