TLDR: Identity threat detection and response (ITDR) focuses on detecting and responding to attacks against identity infrastructure: Active Directory, Entra ID, Okta, and the credentials and sessions they issue. It catches credential theft, privilege escalation, and lateral movement that endpoint and network tools miss. Its blind spots include everything upstream and outside the directory.
Attackers stopped breaking in a long time ago. Now, they just log in.
Once someone has valid credentials, your security stack goes silent:
- The endpoint agent sees an authorized user.
- The network tools see normal traffic from a normal account.
- The firewall doesn’t see anything at all.
Every control you built to spot an intruder is looking for a specific someone, but that someone now has a real username and password. And suddenly, you have no protection at all.
Identity threat detection and response (ITDR) exists for this scenario, and it’s not a hypothetical. It’s a real and persistent threat. ITDR is frequently sold as the answer to identity risk, but that’s not quite right either—which is why we have a bit to unpack before you know the nice-to-haves and need-to-haves in your stack.
What is identity threat detection and response (ITDR)?
Identity threat detection and response (ITDR) protects identity infrastructure across the directories, identity providers, and authentication systems that issue and validate credentials across your environment. It doesn’t fall into a broader security category because identity has become an attack surface in its own right—it needs dedicated detection and response rather than after-the-thought coverage of other tools.
An ITDR platform typically does three things:
- Continuously assesses the configuration of your identity infrastructure for weaknesses
- Detects attacks against (or using) identities in real time
- Responds by disabling accounts, forcing re-authentication, or revoking sessions
The attacks and threats ITDR catches
ITDR was purpose-built to stop these threats from escalating:
1. Credential-based attacks
Credential stuffing, password spraying, brute force attempts against your directory. ITDR spots the pattern (a surge of failed authentications across many accounts) before any single one succeeds.
2. Privilege escalation
An attacker with a foothold on a low-privilege account working toward administrative access. ITDR watches for suspicious group membership changes, permission grants, and role assignments that deviate from normal administrative patterns.
3. Lateral movement
Techniques like Pass-the-Hash, Pass-the-Ticket, Kerberoasting, and Golden Ticket attacks. This is where an attacker uses stolen authentication material to move between systems. These are directory-layer attacks that endpoint tools generally can’t see.
4. MFA bypass and session hijacking
MFA fatigue attacks, adversary-in-the-middle proxies that relay authentication in real time, and stolen session tokens used to skip authentication entirely. ITDR flags the behavioral markers like impossible travel, unfamiliar device registration, or anomalous session patterns.
5. Identity infrastructure misconfiguration
Stale privileged accounts, accounts with non-expiring passwords, excessive permissions, orphaned service accounts, and weak directory configurations. This is the posture-management half of ITDR, and it’s often where the most immediate value shows up.
ITDR vs. EDR, XDR, and IAM
ITDR shares a lot in common with EDR, XDR, and IAM, but they all have defensive nuances (and gaps where they don’t overlap).
| Category | What it watches | Primary question |
| EDR | Endpoints and devices | Is something malicious running on this machine? |
| XDR | Endpoints, network, cloud, email | What’s the full picture of this attack across surfaces? |
| IAM | Access provisioning and governance | Who should have access to what? |
| ITDR | Identity infrastructure and credential use | Is someone attacking or misusing an identity right now? |
IAM grants and governs access, while ITDR detects when that access is abused. One is a control plane, and the other is a detection layer watching it.
XDR and ITDR are closer cousins. XDR correlates signals across multiple surfaces including identity, while ITDR goes deeper on identity specifically. Many organizations run both, and several vendors now bundle ITDR capability into an XDR platform.
How to choose an ITDR solution
Before you commit to an ITDR solution, consider the following factors:
- Coverage across your actual identity estate. Most organizations run hybrid programs: On-prem Active Directory plus Entra ID (often with Okta or another IdP alongside). A tool that only covers one leaves gaps exactly where attackers pivot.
- Detection depth vs. posture management. Some platforms lead with configuration assessment, others with real-time attack detection. Both matter, but they’re different products.
- Response automation and its blast radius. Automatic session revocation is powerful but occasionally disruptive. Understand what the tool can do autonomously, and what you can scope.
- Integration with your SOC workflow. Identity alerts need to land where your analysts already work. A separate console is a console nobody opens.
- Detection quality on the attacks you’re likely to face. Ask for detection logic on specific techniques (Kerberoasting, AiTM, consent phishing) rather than general claims about coverage.
- Time to value. Behavioral detection needs a baseline period. Ask how long before detection quality stabilizes, and what coverage looks like in the meantime.
ITDR is necessary, but it has visibility gaps
ITDR does its job well, and every organization should have some version of it running. However, it has a narrow scope, and attackers are looking for those vulnerable edges:
- It starts after the attack begins. ITDR is detection and response. That means the clock starts once an identity is already under attack or already compromised. That’s not prevention or a guardrail—it’s the ambulance coming to the scene. Most identity attacks start with credential phishing, and by the time ITDR has a signal, someone has already handed over a password.
- It watches identities in your directory. That’s by design, and it makes sense. But the identity attack surface doesn’t stop at the directory boundary. Every third-party service authorized to send email as your domain holds a standing privilege, exercised without review on every send, recorded in DNS rather than in your identity platform. Those are non-human identities with real authority, and no ITDR console lists them.
- It doesn’t cover your outbound identity at all. ITDR protects the identities inside your organization, but it has zero visibility into someone impersonating your domain in email sent to your customers, partners, or suppliers. That traffic never touches your infrastructure, so there’s nothing for an identity tool to monitor or find.
Fixing these gaps isn’t straightforward, though. You can ask around at your company who owns email sender identity and you’ll find that marketing owns the campaigns, IT owns the domain, security owns the risk, and identity teams assume it belongs to whoever owns the directory.
It’s an identity control that falls between four job descriptions, which is generally how a control ends up unowned.
How to protect your business before an attack
You need ITDR, but better protection doesn’t necessarily mean better detection. You need to reduce how often an identity can get attacked in the first place.
Credential phishing is the initial access vector in most identity compromises, and a large share of it works by impersonating a domain your recipients trust. DMARC at enforcement blocks messages spoofing your domain outright, which means the phishing email aimed at your employees, customers, or partners never arrives.
If that email never arrives, credentials never get harvested, no session gets hijacked, and ITDR never has to fire an alert at all.
That’s a prevention control sitting upstream of a detection category. You need both:
| DMARC at enforcement | ITDR | |
| When it acts | Before the message is delivered | After an identity is attacked |
| What it protects | Your domain, and everyone who trusts it | Identities inside your directory |
| How it decides | Cryptographic verification | Behavioral detection |
| What it can’t do | Stop a compromised account or lookalike domain | Stop the phishing that caused the compromise |
Neither one covers the other’s ground. An identity program running ITDR without enforced email authentication is detecting attacks it could have prevented—and leaving its outbound identity entirely unmonitored.
Close the identity gap. Stop the attack.
Directory identities are well-covered ground, but the identities authorized to send as your domain usually aren’t. Fortunately, they’re easier to inventory than most teams expect.
Valimail Monitor is free and names every service sending email on your behalf. It’s the fastest way to find out how many identities hold authority over your domain that never appeared in an identity review. Check your domain for your current authentication status.
Detection is worth having. Preventing the attack is worth more.
Frequently asked questions
What does ITDR stand for?
ITDR stands for identity threat detection and response. It’s a security category covering tools that monitor identity infrastructure (directories, identity providers, and authentication systems) for attacks and misconfigurations, then respond by disabling accounts, revoking sessions, or forcing re-authentication.
What is ITDR in cybersecurity?
ITDR is the discipline of detecting and responding to attacks that target or abuse identities rather than endpoints or networks. It covers credential-based attacks, privilege escalation, lateral movement techniques like Pass-the-Hash and Kerberoasting, MFA bypass, session hijacking, and identity infrastructure misconfiguration.
What is the difference between XDR and ITDR?
XDR correlates threat signals across multiple surfaces (endpoints, network, cloud, and email) to build a unified picture of an attack. ITDR focuses specifically on identity infrastructure and credential misuse, going deeper on that surface than XDR typically does. Many organizations run both, and some vendors bundle ITDR capability inside an XDR platform.
Does ITDR replace IAM?
No. IAM governs who gets access to what, handling provisioning, authentication, and access reviews. ITDR monitors that system for abuse and attack. IAM is the control plane, while ITDR is the detection layer watching it. Organizations need both, along with prevention controls upstream that reduce how often identities come under attack.
