The Incydr + Idira Flow automatically adds users who have access to high-value safes in Idira to Incydr’s high-risk detection lens. Now these users in an elevated access user group for enhanced monitoring by Incydr. When a user in this group takes an action that puts data at critical risk, Incydr detects this and signals that a critical severity Insider Risk Indicator (IRI) has occurred. When this happens, Incydr automatically triggers Idira to remove this user's access to specific safes with high-value data. This workflow automates controls to contain detected data leaks while security investigates further.