Turn Oracle Cloud HCM activity into real-time access intelligence—so you can spot risky behaviour in minutes, not days.
Built for enterprises and the public sector, MKSK’s Access Intelligence extends native audit visibility, enriches every login with geo and device context, and alerts the right people immediately.
At a glance
- Designed for Oracle Cloud HCM (no code changes to core HR)
- Extended visibility beyond the native 7-day view (hot storage with long-term archive options)
- Geo-velocity & “impossible travel” detection
- IP reputation enrichment (datacentre/VPN/Tor indicators)
- Device consistency & new-device alerts
- Configurable email notifications (inbox, Teams via email, distribution lists)
- Roadmap: native ServiceNow and Jira / Jira Service Management integrations available for early access customers
- Compliance by design: UK/EU hosting options, RBAC, immutable audit trail
Results and metrics vary by environment; we can share an evaluation plan and demo dataset to validate in your context on metric which matter to your enterprise
Why organisations choose MKSK
Make investigations fast and repeatable
Correlate logins, locations, IPs, and devices into a single Session Timeline—cutting the back-and-forth between systems.
Reduce noise, catch the unusual
Focus on meaningful signals (distance, time, implied speed, device changes) and suppress the routine (known locations and work patterns).
Prove compliance with confidence
In-region hosting, fine-grained roles, and an immutable audit trail make reviews straightforward for internal audit and regulators.
What it does (capabilities)
- Extended log retention
Go beyond the native 7-day audit window with configurable hot storage and long-term archive options. - Geo-velocity & location analytics
Calculate travel between consecutive logins and flag “impossible travel.” - IP reputation & network context
Enrich events with signals such as datacentre/VPN/Tor‐like ranges and ASN/ISP attributes. - Device consistency
Alert on first-seen devices and unusual user-agent shifts. - Trusted locations / allowlists
Define offices, stores, DCs, or campuses to reduce false positives. - Real-time notifications (email)
Route high-priority alerts to shared mailboxes, distribution lists, or Teams via email gateways.
Roadmap: native workflow integrations for ServiceNow and Jira/JSM.
How it works
- Ingest Oracle Cloud HCM audit/login events.
- Enrich & Fuse: Adaptive Risk Model builds a proprietary signals graph and business specific context
- Score sessions with rules tuned to your working patterns (e.g., UK trading hours, public-sector schedules).
- Notify owners via email and provide an investigation view with full timeline and evidence.
- Retain & report for audits, with exportable summaries and evidence packs.
Use cases
- Security Operations / IAM – Detect account misuse, credential sharing, or suspicious travel.
- Audit & Compliance – Produce evidence packs quickly with preserved context and trails.
- HRIS / IT – Validate access from new locations or devices during joiner/mover/leaver events.
- Public Sector & Regulated – In-region hosting and RBAC to support strict data handling.
Architecture & deployment
- Deployment options: UK/EU/US/Asia cloud regions available.
- Security: tenant isolation, encryption in transit and at rest, RBAC.
- Data handling: event-only—no HR attributes beyond what’s needed for context (optionally enhanced with department/manager/holiday calendars if you approve).
- Interoperability: email alerts today; ServiceNow and Jira/JSM connectors on the roadmap.
Getting started
- Live demo & sample dataset – See geo-velocity, device changes, and alerting with your scenarios.
- Pilot in weeks – Connect, calibrate rules, agree retention, run side-by-side with existing processes.
- Rollout – Enable for priority populations (e.g., payroll admins, HR super users) then scale.
Frequently asked questions
Does this change Oracle Cloud HCM configuration?
No. We ingest and enrich events; core HR configuration stays unchanged.
How do alerts work today?
Email notifications to individuals, shared mailboxes, or Teams via email gateways. ServiceNow and Jira/JSM connectors are available to our early access customers.
Where is data stored?
UK/EU regions available. Data is encrypted in transit and at rest, with RBAC and audit logging.
What personal data is processed?
Primarily login metadata (timestamps, IPs, user agents) and minimal user identifiers required for investigations. Optional enrichment (e.g., department/manager) is configurable.
How long do you keep logs?
Retention is customer-defined (e.g., 90+ days hot with longer archive). We’ll align to your policies.
