Attackers are increasingly targeting business processes, making security analytics an important part of a comprehensive defensive strategy. It is critical to track credential use and monitor cloud and SaaS activity to detect unauthorized actions. This talk will deep-dive into practical analytical strategies for long-term defense and demonstrate effective visualizations in which to present tactical feedback to both executives and analysts.