If an account signs in from the office and twenty minutes later from another country, one of those sign-ins is probably not the real person. Impossible travel is one of the clearest signs that a password or session has been stolen.
It needs context to be useful. VPNs, mobile networks and real business trips all create false alarms, so a good check also asks whether the device and the session match the person's normal.
How Centeye handles it
Centeye Gatewatch learns each person's usual places, devices and hours, marks an impossible trip, checks the session against their laptop and ends the foreign session.
Gatewatch: identity protection (ITDR) →