diff --git a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/key_insights_panel/privileged_users_tile/esql_query.tsx b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/key_insights_panel/privileged_users_tile/esql_query.tsx
index fdb7f075a9d6b..02d0619dd0dd3 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/key_insights_panel/privileged_users_tile/esql_query.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/privileged_user_monitoring/components/key_insights_panel/privileged_users_tile/esql_query.tsx
@@ -11,4 +11,4 @@ export const getPrivilegedUsersEsqlCount = (
   namespace: string
 ) => `FROM ${getPrivilegedMonitorUsersIndex(namespace)}
       | WHERE user.is_privileged == true
-      | STATS count = COUNT_DISTINCT(user.name)`;
+      | STATS count = COUNT(*)`;