AI detects identity-based threats by monitoring login patterns, device behavior, and access requests. It flags anomalies such as unusual locations, abnormal login times, or privilege misuse, enabling early detection of account takeovers, phishing attacks, and credential stuffing attempts.