Techniques for detecting unauthorized access to cloud applications based on velocity events

A computer readable medium having stored thereon instructions for causing one or more processing units to execute a process for detecting unauthorized access to a cloud application hosted in a cloud-computing platform, the process comprising:

• identifying, by a managed proxy device, a first access attempt to a cloud application at a first time and from a first location;
• identifying, by a managed proxy device, a second access attempt to the cloud application at a second time and from a second location;
• computing a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location;
• checking if the computed velocity is greater than a velocity threshold;
• and
• generating a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized.

A system for detecting unauthorized access to a cloud application hosted in a cloud-computing platform, the system is connected between client devices accessing the cloud-computing platform hosting the first cloud application and the second cloud application, comprising:

• a processing unit;
• and
• a memory, the memory containing instructions that, when executed by the processing unit, configure the system to:
• identify a first access attempt to a cloud application at a first time and from a first location;
• identify a second access attempt to the cloud application at a second time and from a second location;
• compute a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location;
• check if the computed velocity is greater than a velocity threshold;
• and
• generate a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized.