Modern attackers move fast, and the earliest signs of risk often surface deep inside an organization’s own systems. Authentication anomalies, lateral movement attempts, and SaaS misconfigurations appear in real-time, yet most teams struggle to detect these signals quickly or understand which employees represent the highest exposure.
Dune Security and Abstract Security are partnering to change that. The integration brings together Abstract’s real-time technical telemetry with Dune’s user-level risk scoring and automated remediation, giving organizations continuous visibility into both the events unfolding in their environment and the users most likely to be impacted.
Together, we help security teams surface risky activity faster, prioritize the employees who matter most, and reduce user risk the moment it appears.
Why This Partnership Matters
Security teams collect more technical data than ever before, but extracting meaningful, user-focused action from that data is still difficult. Log pipelines, SIEM workflows, identity events, and cloud telemetry reveal high value activity, yet organizations often lack a clear way to connect these signals to the specific employees who present the greatest risk.
The partnership between Dune Security and Abstract Security closes this gap by combining two complementary strengths. Abstract Security identifies anomalies and high-value technical events in real-time by processing security data directly in stream. Dune Security ingests those events and aligns them with behavioral and contextual indicators to refine each employee’s risk score and expose the individuals who require immediate attention.
Integrating Abstract’s telemetry into Dune’s risk engine improves prioritization, strengthens accuracy, and gives teams immediate visibility into which users pose the highest exposure when a security event occurs. Remediation becomes targeted, automated, and grounded in verified technical and behavioral signals.
Abstract Security’s Role
Abstract Security provides a streaming-first security data platform that processes logs and telemetry as they flow, eliminating the delays associated with storing and indexing data. This allows organizations to detect high-value activity within seconds, shrinking the exposure window and giving analysts more time to focus on threats that matter.
Abstract surfaces events such as authentication anomalies, privilege escalation patterns, lateral movement signals, SaaS misconfigurations, and other indicators of malicious or risky behavior. By reducing noise and delivering real-time clarity, Abstract equips teams with the technical signals that warrant immediate attention.
This streaming detection model positions organizations ahead of attacks and creates a reliable pipeline for routing high-value signals to the systems best suited to analyze and act on them, including Dune Security.
Dune Security’s Role
Dune Security converts technical signals into user level insight and automated action. Every employee receives a dynamic risk score that reflects their exposure level across behavioral, contextual, and technical indicators.
When Abstract surfaces real-time anomalies or technical risk events, Dune ingests those signals directly into its scoring model. These indicators strengthen accuracy and reveal the individuals who present elevated exposure at that moment.
Once high-risk users are identified, Dune activates targeted remediation pathways that address their specific vulnerabilities. These include User Adaptive Training, access restrictions, dynamic enforcement, and performance management. Each intervention is guided by the combined intelligence of internal behavioral signals, contextual factors, and the streaming telemetry provided by Abstract.
This creates a continuous protection cycle that links real-time detection with automated user risk reduction.
Unified Strategy for Technical Detection and User Layer Defense
For organizations using Abstract Security, Dune turns real-time detections into real-time user level action. Abstract surfaces high-value technical events. Dune identifies which users represent the highest exposure and reduces that risk through automated remediation. This closes the gap between detecting a risky event and fixing the vulnerability behind it.
Together, the partnership helps enterprises:
• Detect risky activity earlier through streaming technical telemetry
• Map high-value events to refined user level risk scores
• Identify which users represent the greatest exposure when anomalies appear
• Trigger targeted, automated remediation in real-time
• Reduce the likelihood that technical missteps or malicious behavior becomes a security incident
By combining Abstract’s real-time detection with Dune’s user risk scoring and remediation engine, enterprises gain a complete and continuous strategy for managing both technical and user-driven risk.