Most security tooling is built to spot things that shouldn't be happening. Malware executing. An unrecognised device joining. Traffic to a known-bad domain.
Identity attacks don't look like that. An attacker with valid credentials logs in the way your employees log in, from a browser, through your identity provider, during working hours. Nothing malicious executes. Nothing unusual traverses the network. From every angle your existing tools are watching, it's a normal Tuesday.
ITDR exists for that gap - detecting attacks that use legitimate access rather than breaking anything.
Identity threat detection and response is the discipline of monitoring identity-related activity to detect, investigate and contain attacks that abuse legitimate credentials and access rights.
It sits on a specific problem: the majority of intrusions no longer begin with an exploit. They begin with a login. Credentials get phished, bought, reused from another breach, or lifted by infostealer malware - and once an attacker holds them, they're not breaking in. They're signing in.
Traditional controls struggle with this by design. Endpoint tools look for malicious execution; there isn't any. Network tools look for anomalous traffic; there isn't any. Access control checks whether the credential is valid; it is. ITDR asks a different question: is this identity behaving the way it normally behaves?
These overlap enough to cause procurement confusion, and the distinctions are worth getting right.
The clean way to think about it: IGA decides who gets keys. PAM controls the most dangerous keys. ITDR notices when someone is using a key in a way its owner never would.
Three shifts, and they compound.
The perimeter dissolved. When applications lived in a data centre behind a firewall, network position meant something. With SaaS, a valid credential is sufficient from anywhere - there's no interior to be inside of.
Credentials are cheap and plentiful. Infostealer malware and breach corpora have made working credentials a commodity. Buying access is easier, quieter and more reliable than developing an exploit.
MFA is bypassable in practice. Not broken - bypassable. Push fatigue, adversary-in-the-middle phishing kits, session-token theft and help-desk social engineering all work well enough often enough. MFA raises the cost of an attack; it doesn't remove the attack path.
The result is that the most sophisticated part of many intrusions is the social engineering, not the malware. That's an identity problem, and it needs identity-layer detection.
ITDR generates enormous volumes of data and only a narrow band of it is worth waking someone for. These are the signals with the best ratio of real findings to noise.
Authentication from two locations too far apart for the time elapsed. Classic, still useful, and noisier than it looks - VPNs and mobile networks generate false positives constantly. Best used as a contributing signal rather than a standalone alert.
Repeated push notifications until someone approves one out of irritation. The signal is the pattern - a burst of denied prompts followed by an approval is far more meaningful than any single event. Also watch for MFA method changes, particularly a new device enrolled shortly after a password reset.
An account with no activity for months that suddenly authenticates is among the highest-signal, lowest-noise alerts available. It requires knowing which accounts are dormant - which requires an inventory, and is exactly why detection depends on governance hygiene. Identity risk management covers building that inventory.
An account gaining permissions it didn't previously hold. Legitimate when it follows an approved request. When there's no corresponding ticket or approval record, it's one of the strongest indicators of an active intrusion. Privileged access and user monitoring goes deeper on privileged signals specifically.
A user reaching systems they've never touched, or pulling volumes far outside their pattern - the finance analyst suddenly exporting the entire customer database. This is where behavioural baselining earns its cost, and where alerting without a baseline just produces noise.
Changes that quietly weaken identity controls: an MFA exemption added, a conditional access policy loosened, a logging setting disabled. Attackers do this deliberately, and it also happens accidentally. Either way you want to know. Configuration drift detection covers detection.
One rule that matters more than any individual signal: combinations beat singles. A dormant account waking up is interesting. A dormant account waking up, from a new location, then escalating privilege, is an incident. Scoring should compound rather than alert on each in isolation.
ITDR is two words joined by "and," and organisations consistently buy the first one.
Detection without response produces a queue. If a compromised account is flagged at 2am and a human acts at 9am, the attacker had seven hours - comfortably enough to establish persistence, exfiltrate, or move laterally.
Responses worth automating, roughly in order of how safely they automate:
The design question is which of these run without approval. Automate too aggressively and you'll lock out executives during board meetings and lose organisational support. Automate too little and detection is theatre. A reasonable default: let the system revoke sessions and force re-authentication on its own, but require a human to approve a full account suspension. Keep a faster path for your most critical accounts.
ITDR quality is mostly a function of input quality, and this is where implementations disappoint.
Which leads to an uncomfortable but useful conclusion: if your identity hygiene is poor, ITDR will underperform regardless of the tool. Orphaned accounts, unowned service accounts and incomplete inventory degrade detection directly. Governance isn't a prerequisite you can skip.
One question that separates vendors quickly: "When you detect a compromised identity, what happens in the next sixty seconds without human involvement?" Vague answers are informative.
Josys monitors identity activity across your SaaS estate - including accounts and applications that were never provisioned through your identity provider - and pairs detection with entitlement context, so an alert arrives with what that identity can actually reach rather than just the fact of a suspicious login. Because identity, application and device data sit in one model, response can act on the full access profile in a single workflow.
To know more, check out identity threat monitoring, the identity security and risk, or book a demo to see Josys in action.
ITDR - identity threat detection and response - is the discipline of monitoring identity and access activity to detect, investigate and contain attacks that abuse valid credentials rather than exploiting software. It covers detections such as impossible travel, MFA abuse, dormant account reactivation and privilege escalation, paired with automated response like session revocation.
EDR monitors endpoints for malicious activity - processes, files, memory. ITDR monitors identity behaviour across authentication and access. The distinction matters because an attacker using stolen credentials from an unmanaged browser generates no endpoint signal at all; there is nothing malicious executing for EDR to find.
No, though they overlap. A SIEM aggregates and correlates logs from across the environment and can detect identity attacks if someone has written and tuned the detections. ITDR is purpose-built for identity telemetry, arrives with identity-specific detections, and typically includes response actions such as session revocation that a SIEM would need to orchestrate elsewhere.
The highest-value signals are impossible travel and session anomalies, MFA fatigue patterns and MFA method changes, dormant accounts becoming active, privilege escalation without a matching approval, anomalous data access volumes, and drift in identity configuration such as MFA exemptions being added. Combinations of these carry far more weight than any single signal.
Yes. MFA raises the cost of an attack but does not remove the path - push fatigue, adversary-in-the-middle phishing, session token theft and help-desk social engineering all bypass it in practice. ITDR detects the abuse of access that has already been obtained, including through a successfully bypassed MFA prompt.
An ITDR platform ingests identity telemetry from identity providers, SaaS applications and cloud platforms, applies identity-specific detections, and executes response actions such as revoking sessions, forcing re-authentication or reducing entitlements. The important evaluation criteria are estate coverage, detection quality rather than count, and whether response is genuinely automated or only alerting.
