How to Build Impossible Travel Detection Without Costly UEBA Platforms

Impossible travel detection, long considered an enterprise-only security feature, can be implemented using basic math and existing sign-in log data. The method relies on the haversine formula to calculate the great-circle distance between two consecutive login locations for the same account, then divides that by the time elapsed to derive an implied travel speed. If the speed exceeds a set threshold — such as 500 km/h — the login pair is flagged as suspicious, requiring no machine learning or behavioral baselines. Azure AD logs provide geolocation data directly, while other formats can use IP-based enrichment, though VPNs and proxies can reduce accuracy. False positives from VPN node switches or border-area mobile users are a known limitation, so experts recommend treating these alerts as one risk signal among many rather than an automatic trigger for account lockouts.