How to Choose an ITDR Solution in 2026
To choose an ITDR solution, name the identity incident you would struggle most to survive, then test each shortlisted platform against your own attack scenarios, your identity provider integration and its automatic response actions before you compare price. Identity threat detection and response (ITDR) is a broad category, and the leaders in Active Directory recovery are not the leaders in stolen-session detection.
Shortlist by problem (November 2026)
| The incident you fear most | Start with | Read next |
|---|---|---|
| Active Directory forest compromise and recovery | Semperis, Cayosoft | Best ITDR for Active Directory |
| Legacy protocols and service accounts with no MFA | Silverfort | Silverfort vs Semperis |
| Already on Microsoft 365 E5 or CrowdStrike Falcon | Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection | CrowdStrike vs Defender for Identity |
| Human and non-human identity activity across clouds, Okta shops | Permiso Security (now Okta) | Best ITDR for enterprises |
| Phishing and stolen sessions in SaaS | Push Security, Obsidian Security | Top identity threat detection platforms |
| Leaked credentials and infostealer logs | SpyCloud | Infostealer session hijacking |
| Directory attack paths and posture | Tenable Identity Exposure, Proofpoint | Best ITDR tools |
1. Know which problem you are solving
- Directory security and recovery for Active Directory and Entra (detection, posture, fast forest recovery).
- Runtime identity protection that extends MFA and risk analysis everywhere, including legacy and service accounts.
- SaaS identity risk and shadow access.
- Exposure intelligence on leaked credentials and infostealer logs.
Different leaders own different halves, so naming your priority narrows the field fast.
2. Test integration with your identity provider in both directions
ITDR both reads and acts. Confirm that the tool ingests sign-in, audit and risk events from your IdP, and that the IdP can act on its verdicts: block, step up, revoke sessions. Silverfort, for example, sits inside the authentication flow and instructs the identity provider to allow, deny or step up. Ask whether the product emits or consumes Shared Signals Framework events (CAEP), Final since 29 August 2025, so connected apps can end a session when ITDR flags it. Then check EDR and SIEM feeds so detections are actionable, not noise.
3. Test detections against your own scenarios
Vendor demos show the detections that work. Bring your own, drawn from real incidents:
- A valid sign-in that satisfies phishing-resistant policy but comes from a session the user did not start, for example a Windows Hello authentication with an empty device ID.
- A device code grant from a client with no business using one (device code phishing).
- A new OAuth consent grant to an unfamiliar application, the opening move in consent phishing.
- MFA methods removed and replaced within hours of a sign-in, the pattern in the Microsoft 365 token replay campaign against 79 organizations.
- A service account or application signing in from new infrastructure with a client secret, as in the Entra ID stolen app secrets campaign.
- A directory change that creates an escalation path, such as a vulnerable certificate template (AD CS template abuse).
If a tool cannot show you these, it is watching the wrong layer.
4. Hybrid coverage is not optional
Attackers pivot between on-premises Active Directory and the cloud identity provider. In intrusions Microsoft described on October 30, 2026, fake Teams help desk contacts led to AD CS certificates for 11 privileged accounts, and one privileged account excluded from automated response was used to copy data out. Confirm coverage of both sides, that it correlates in one view, and which accounts are excluded from response and why.
5. Ask about response, not just detection
Identity containment is different from endpoint containment. Revoking refresh tokens and sessions matters more than resetting a password (token replay). For each action, ask whether the product does it directly, hands it to the IdP, or leaves it manual:
| Response action | Why it matters |
|---|---|
| Revoke sessions and refresh tokens | A password reset leaves a stolen session alive |
| Remove new MFA methods and devices | Attackers register their own to survive resets |
| Disable or step up the account | Stops the next sign-in |
| Rotate service principal secrets and certificates | Application sign-ins do not use MFA |
| Notify IdP, SIEM and apps (CAEP) | Ends sessions in apps the ITDR cannot touch |
6. Check who owns the vendor
ITDR is consolidating into identity and XDR platforms. As of November 5, 2026: Okta closed its Permiso acquisition on 26 August 2026; Silverfort bought Fabrix Security on 28 April 2026; CrowdStrike closed SGNL on 20 February 2026; Imprivata bought Verosint in October 2025; JumpCloud bought Stack Identity in January 2025. Ask whether standalone licensing continues for your term.
7. Get a comparable price
ITDR scored 14 out of 100 in the Identity Pricing Transparency Index 2026. Published anchors checked October 30, 2026: Push Security at 5 dollars per user per month up to 500 employees; Nudge Security at 750 dollars a month up to 150 users, then 5 dollars per user; Silverfort's AWS Marketplace listing at 15,000 dollars for 12 months, billed on employee headcount. Scope quotes by headcount, Active Directory forests, IdPs and cloud tenants.
8. Prevention and resilience are separate purchases
Runtime protection that extends MFA to protocols agents cannot reach, and directory resilience that recovers a forest cleanly, solve different halves. If budget allows only one, choose the one matching the incident you would struggle most to survive. See ISPM for the posture side.
9. Score and pilot
Compare with the capability checker, then run the scenarios in step 3 in a pilot tenant. As a planning estimate, not a measured figure, a 30-day pilot with at least one red-team exercise gives enough signal to compare false positives.
Where to start
Browse ITDR vendors, the best ITDR tools ranking, and Silverfort vs Semperis, and read about Zero Trust.
Frequently asked questions
- How do I choose an ITDR solution?
- Name the incident you most need to survive (directory compromise, stolen sessions, legacy protocols without MFA, SaaS account takeover), then test each shortlisted ITDR platform for integration with your identity provider, detection of your own attack scenarios, automatic response actions, hybrid Active Directory and Entra ID coverage, 2026 ownership and a comparable price.
- What is ITDR and what problem does it solve?
- Identity threat detection and response (ITDR) catches identity-based attacks that prevention controls miss. The category covers four different needs: directory security and recovery for Active Directory and Entra, runtime identity protection that extends MFA and risk analysis to legacy systems and service accounts, SaaS identity risk and shadow access, and exposure intelligence on leaked credentials. Name your priority first, because different vendors lead different halves.
- Which ITDR platforms integrate deeply with identity providers?
- Microsoft Defender for Identity is native to Active Directory and Entra ID. Okta now owns Permiso Security (closed 26 August 2026) as the Okta Platform's ITDR layer. Silverfort sits inside the authentication flow of Active Directory and cloud identity providers and can instruct them to allow, deny or step up. CrowdStrike Falcon Identity Protection added SGNL's continuous access evaluation in 2026. Test both directions: the tool reading IdP signals and the IdP acting on the tool's verdicts.
- What are the best ITDR solutions?
- In SWI's best ITDR tools ranking the top five are Silverfort, Semperis, CrowdStrike Falcon Identity Protection, Microsoft Defender for Identity and Vectra AI. The right pick depends on the problem: Semperis for Active Directory recovery, Silverfort for MFA on legacy protocols and service accounts, Defender for Identity if you hold Microsoft 365 E5.
- What response actions should ITDR trigger automatically?
- Revoke refresh tokens and active sessions, remove attacker-added MFA methods and devices, disable or force step-up on the account, rotate secrets for any service principal involved, and send the event to the identity provider and SIEM, ideally through Shared Signals (CAEP). A password reset alone leaves a stolen session alive.
- How do I test an ITDR product before buying?
- Bring your own scenarios instead of relying on the vendor demo. Good tests include a sign-in that passes phishing-resistant policy from a session the user did not start, an unexpected device code grant, a new OAuth consent grant to an unfamiliar app, MFA methods replaced after a sign-in, a service account's first privileged action, and a directory change that creates an escalation path.
- How much does ITDR cost?
- Mostly quote-only: 16 of 21 ITDR vendors in SWI's Identity Pricing Transparency Index (checked October 30, 2026) do not publish a price. Published anchors include Push Security at 5 dollars per user per month up to 500 employees, Nudge Security at 750 dollars a month up to 150 users, and Silverfort's AWS Marketplace listing at 15,000 dollars for 12 months billed on headcount. Defender for Identity is included in Microsoft 365 E5.
- Is identity posture management the same as ITDR?
- No. Posture tools such as ISPM find misconfigurations before an attack, detection tools spot attacks at runtime, and recovery tools help restore a directory afterwards. Some products cover one stage, some several. Runtime protection and directory resilience are effectively separate purchases, so if budget allows only one, choose the product that matches the incident you would struggle most to survive.
Related on Start with Identity
- GuideHow to Choose a PAM Solution in 2026: A Buyer's Checklist
To choose a PAM solution, count your standing privileged access first, decide whether you need vault-first PAM or infrastructure access, then test ownership, pa
- GuideHow to Choose an MFA Solution in 2026: Buyer's Checklist
To choose an MFA solution in 2026, start from one property: can it make phishing-resistant authentication (passkeys and FIDO2 security keys) mandatory for the p
- GuideHow to Choose a CIAM Platform in 2026: Decision Framework
To choose a CIAM platform, decide the architecture before you compare features: who your users are (consumers, business customers or both), whether you need a f
- GlossaryITDR
Identity Threat Detection and Response. Security tooling that detects and responds to identity-based attacks such as account takeover, privilege escalation, and
- BlogOkta buys Permiso Security to put ITDR inside the identity provider
Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of