Credential stuffing detection on the logins you already record
Stolen passwords are tried across accounts in a burst. Each failure looks like a user who forgot a password.
CYBERDETECT reads the login events you already produce and treats a burst of failed attempts, shared timing, and a repeated client as credential stuffing.
It sits in the identity pack with account takeover, impossible travel, a new device, and OTP relay, so a stuffing run that then succeeds is one incident rather than a list of bad passwords.
Alerts go to Slack, Teams, or your SOAR. It can go live the same day from those logs. It does not read or store the passwords themselves.