An Indicator of Attack that involves a user having multiple login sessions concurrently. A sudden spike can indicate a breach.