The alert that looked noisy but was not

A login alert looked like normal VPN noise at first. Same user, same country, nothing dramatic. The odd part was the device fingerprint changing twice in ten minutes, then a failed MFA push from a browser we had never seen. What helped was not a fancy dashboard. It was having enough boring context: normal device list, recent password reset history, and which apps the account could actually reach.…