Not all impersonation attempts are equal. Some attacks are opportunistic, while others are deliberate, planned, and executed over time. imper.ai distinguishes between these behaviors by evaluating both risk and premeditation.
In this article
Understanding risk
In imper.ai, risk represents the likelihood that an interaction involves impersonation, social engineering, or unauthorized access.
Risk is derived from the correlation of multiple contextual signals, including network characteristics, device attributes, and behavioral patterns. These signals are evaluated continuously during live interactions.
A high-risk score indicates that an interaction deviates significantly from what is expected for the claimed identity.
What is premeditation?
Premeditation refers to the degree of preparation and intent behind an attack.
Premeditated attacks are not accidental or reactive. They are typically planned in advance and involve deliberate steps to bypass controls, mimic legitimate users, and sustain access.
Unlike simple credential misuse, premeditated attacks often succeed because attackers invest effort in appearing legitimate across multiple dimensions at once.
Signals of premeditated attacks
imper.ai identifies premeditation by detecting patterns that indicate deliberate setup rather than incidental anomalies.
Examples include:
Use of specialized or disposable environments designed to evade detection
Consistent geographic alignment with a target user despite indirect routing
Repeated rehearsal or probing of verification workflows
Behavior that evolves over time to better mimic legitimate usage
Individually, these signals may appear benign. When correlated over time, they reveal intent and preparation.
Why premeditation matters
Premeditated attacks represent a higher threat level than opportunistic attempts. They are more likely to:
Target sensitive workflows such as helpdesk access or executive communications
Persist across multiple sessions or channels
Adapt in response to verification friction
By evaluating both risk and premeditation, imper.ai can distinguish between accidental anomalies and coordinated impersonation attempts. This enables more accurate decisions and proportional remediation.
Note: Premeditation is not determined by a single signal. It emerges from the correlation of behavior over time and context.