Sentra's DDR engine uses identity, location, behavior, and sensitivity to detect and prioritize insider threats. It monitors log and configuration changes, prioritizes risk by severity, and catches threats traditional posture tools miss—like data exfiltration or abnormal privilege use.