ITDR stands for Identity Threat Detection and Response: tooling and practice for detecting and containing attacks that use identity itself, such as stolen credentials and session tokens, MFA manipulation, privilege escalation in Active Directory and Entra ID, and lateral movement through trusted accounts.

How is ITDR different from EDR?

EDR watches endpoints for malicious processes. ITDR watches the identity layer: directories like Active Directory and Entra ID, sign-ins, sessions, tokens, MFA changes and privileged actions. An attacker replaying a stolen token runs no malware, so EDR sees nothing while ITDR can flag the session.

What is the difference between ITDR, ISPM and CIEM?

ISPM (identity security posture management) finds risky configurations before an attack. CIEM right-sizes cloud permissions. ITDR detects and responds to attacks at runtime. Many products now combine posture and detection, but recovery of a compromised directory is often a separate product.

What response actions should ITDR trigger automatically?

The actions that matter are identity-specific: revoke the user's refresh tokens and active sessions, remove attacker-added MFA methods and registered devices, disable or force step-up on the account, and alert the identity provider and SIEM. A password reset alone is not containment, because a stolen session survives it.

Why has ITDR become important?

Attackers increasingly log in rather than break in. In a campaign Huntress reported in October 2026, one actor replayed stolen Microsoft 365 tokens into 79 organizations and replaced victims' MFA methods so access survived password resets. Prevention controls passed every one of those sign-ins.

Do I need a separate ITDR product if I have Microsoft Defender or CrowdStrike?

Not always. Microsoft Defender for Identity is included in Microsoft 365 E5 and covers classic Active Directory attacks, and CrowdStrike Falcon Identity Protection is a Falcon module. Organizations add specialists for gaps: Silverfort for MFA on legacy protocols and service accounts, Semperis for Active Directory forest recovery, or Push Security for browser-level phishing detection.

What Is ITDR (Identity Threat Detection and Response)?

ITDR (identity threat detection and response) is the tooling and practice for detecting and containing attacks that use identity itself: stolen passwords and session tokens, MFA manipulation, privilege escalation in Active Directory and Entra ID, and lateral movement through trusted accounts. It exists because attackers now log in rather than break in, and a valid login with a stolen token looks normal to every prevention control.

Why prevention is not enough

Strong authentication and least privilege reduce risk, but attackers still get in through phishing, infostealers, help desk social engineering and session hijacking. ITDR assumes breach and watches for the behaviors that follow the first sign-in.

The 2026 record makes the point. Huntress reported on October 22, 2026 that one actor replayed stolen Microsoft 365 tokens into 79 organizations, registered at least 48 rogue Entra devices and replaced victims' MFA methods, in 19 organizations within three hours of the first sign-in, so access survived password resets. On November 3, 2026 Todyl described an operator signing in to Entra ID as applications with stolen client secrets, reaching 27 organizations. Neither involved malware.

What ITDR covers

Directory protection for Active Directory and Entra ID: misconfiguration detection, change tracking and fast recovery.
Runtime detection of anomalous authentication and account takeover using behavioral analytics (UEBA).
Attack-path analysis to find how an attacker could escalate or move laterally (attack path).
SaaS and browser identity risk: OAuth grants, session use after MFA, phishing pages.
Exposure intelligence: credentials and cookies found in breach and infostealer data.

ITDR vs ISPM vs CIEM vs EDR

Tool	When it acts	What it watches	Example question
ISPM	Before an attack	Identity configuration	Which accounts have no MFA?
CIEM	Before an attack	Cloud permissions	Which roles are over-permissioned?
ITDR	During an attack	Sign-ins, sessions, directory changes	Is this session stolen?
EDR	During an attack	Endpoint processes	Is this process malicious?
AD recovery	After an attack	Directory backups	Can we rebuild a clean forest?

Mature programs use posture, detection and recovery together. Many ITDR products now bundle posture; few bundle forest recovery.

What ITDR detects that nothing else does

The defining property of an identity attack is that nothing looks broken. Detections that earn their place are behavioral and identity-specific:

Sign-ins that satisfy phishing-resistant MFA policy but come from a session the user did not start, for example Windows Hello authentications with an empty device ID.
Device code grants from clients that have no business using them (device code phishing).
New OAuth consent grants to unfamiliar applications (OAuth consent phishing).
MFA methods removed and replaced, or new devices registered, shortly after a sign-in from a new location.
A first-time privileged action by an identity that has never performed one.
Directory changes that create an escalation path: certificate template permissions, group nesting, delegation rights (AD CS template abuse, Kerberoasting).

Hybrid is where attacks live

Attackers pivot between on-premises Active Directory and the cloud identity provider, because the trust between them is the point of the architecture. ITDR that watches one and not the other misses the path. Microsoft described on October 30, 2026 intrusions where fake Teams help desk contacts led to AD CS certificates for 11 privileged accounts and a DCSync within seconds. In 2023 a help desk call gave attackers control of MGM Resorts' Okta super administrators before ransomware hit ESXi hosts (help desk social engineering). Restoring a compromised forest from ordinary backups can restore the attacker's persistence too; see Silverfort vs Semperis.

Response is the harder half

Detection without a response playbook produces alerts. Identity containment differs from endpoint response:

Revoke refresh tokens and active sessions, not only the password, because a reset leaves a stolen session alive (token replay).
Remove attacker-added authentication methods and registered devices.
Rotate secrets and certificates for any service principal involved.
Check for new OAuth grants, mailbox rules and federation changes.
Share the event with other systems. The OpenID Shared Signals Framework, with CAEP and RISC, has been a Final Specification since 29 August 2025, so an ITDR alert can tell connected apps to end a session.

See token theft and the infostealer session hijacking teardown.

Who needs ITDR first

Prioritize it if you run hybrid Active Directory and a cloud identity provider, rely on help desk resets, have service accounts that cannot use MFA, or have already had a session-theft incident. A small cloud-only company on one IdP may get enough from that IdP's own risk detections plus strict session and MFA policy, and should spend first on phishing-resistant MFA.

ITDR vendors in 2026

The category is consolidating into identity and XDR platforms. As of November 5, 2026, per the profiles: Okta closed its acquisition of Permiso Security on 26 August 2026 to become the Okta Platform's ITDR layer; Silverfort bought Fabrix Security on 28 April 2026 after Rezonate in 2024; and CrowdStrike Falcon Identity Protection added SGNL's continuous access evaluation when that deal closed on 20 February 2026. Microsoft Defender for Identity is included in Microsoft 365 E5. Semperis leads on Active Directory recovery, and Push Security and Obsidian Security watch the browser and SaaS sessions.

Pricing is mostly hidden: ITDR scored 14 out of 100 in the Identity Pricing Transparency Index 2026, and 16 of 21 vendors were quote-only on October 30, 2026.

Where to start

Compare the best ITDR tools, best ITDR for Active Directory and top identity threat detection platforms, read CrowdStrike vs Microsoft Defender for Identity, and follow how to choose an ITDR solution.