Know what happened, not what could happen.
Go beyond identifying potential Segration of Duty (SoD) conflicts and Critical Access (CA) risks. Sofy Did-Do helps organizations analyze whether users have actually performed critical actions or executed Segregation of Duties combinations in practice—turning theoretical access risks into actionable insight based on real user activity.
Client Story
Cross-system SoD Monitoring
Read our client story on gaining control over Cross-System Access Risks
The challenge
The Gap Between Access and Action
Traditional access risk and Segregation of Duties monitoring focuses primarily on potential exposure. It shows where users may have conflicting access or critical authorizations but often does not reveal whether those risks have actually materialized through executed transactions or activities.
THE SOLUTION
A data-driven approach to identifying what users actually performed
Sofy Did-Do extends traditional access risk and SoD monitoring by analyzing executed user activities against Critical Access and SoD rule sets. Instead of only showing where access could lead to risk, it provides insight into where users have performed critical transactions or conflicting actions.
1. Start from SoD and critical access data
Sofy uses existing SoD and critical access analyses as the foundation, identifying the access combinations and critical actions that require closer monitoring.
2. Analyze executed transaction activity
The solution checks which transaction codes have actually been performed by users (for example in SAP) so organizations can see whether critical or conflicting access has been used in practice.
3. Detect level 2 did-do scenarios
Level 2 did-do analysis compares performed transaction codes against the critical action and SoD rule list, helping identify where executed transactions match known risk scenarios. For example, has a user created and approved invoices?
4. Detect level 4 did-do scenarios
Level 4 did-do analysis goes one step further by analyzing what actions were actually performed using those transaction codes, giving deeper visibility into the nature and context of the activity. For example, has a user created and approved invoices for the same supplier?
5. Prioritize follow-up based on actual risk
By distinguishing between potential exposure and executed behavior, organizations can focus investigations and remediation efforts on the users and activities that matter most.
6. Strengthen broader fraud analytics and investigations
Did-do analytics can be used as part of a wider fraud monitoring approach, complementing transaction-based anomaly detection and helping organizations investigate suspicious behavior more effectively. Did-do analytics can be executed as part of the broader fraud-focused analytics library.
THE BENEFITS
Understand what users did, not just what they could do
Prioritize risks that matter most
Focus remediation and investigation efforts on users who actually performed risky or conflicting activities, rather than treating every access conflict equally.
Detect high-risk behaviors earlier
Identify executed critical actions and SoD violations based on real user activity instead of relying solely on entitlement analysis.
Reduce investigation effort
Replace fragmented log reviews, manual data extracts, and spreadsheet analysis with a structured and repeatable monitoring process.
Strengthen auditability and compliance
Create documented evidence of performed activities to support audits, investigations, control reviews, and remediation actions.
Why Sofy GRC