Key Takeaways
- Identity is the new perimeter. With cloud and remote work, a valid credential is often more valuable to an attacker than a compromised device. Most breaches now involve identity.
- ITDR (Identity Threat Detection and Response) is the discipline of detecting and responding to attacks on identities: credential theft, account takeover, privilege escalation and identity-system abuse.
- ITDR fills the gap between endpoint security (EDR) and network tools, which were not built to detect an attacker using legitimate credentials.
- You build ITDR on identity telemetry: Active Directory and Entra ID logs, cloud sign-ins, VPN and SSO logs, correlated in a SIEM such as Wazuh.
- Core detections: impossible-travel sign-ins, MFA fatigue and bypass, privilege escalation, dormant-account use, and identity-provider configuration abuse.
Why Identity Became the New Perimeter
For years security was built around the network perimeter: keep attackers out, and trust what is inside. Cloud services, remote work and SaaS dissolved that boundary. Today your data sits in applications reached from anywhere, and the thing that controls access is not a firewall but an identity, a username, a password, a token, an MFA method. That shift made identity the real perimeter.
Attackers adapted faster than most defences. Rather than exploiting a vulnerability, they increasingly just log in with stolen, phished or sprayed credentials, because a valid identity gives them legitimate access that looks normal to traditional tools. Industry analysis consistently finds that the majority of breaches now involve identity in some form. When the attacker is using real credentials, the question is no longer how they got in but how you detect them once they have, and that is what ITDR answers.
What ITDR Actually Is
Identity Threat Detection and Response (ITDR) is the practice, and the set of capabilities, for detecting, investigating and responding to threats that target identities and the identity infrastructure. It covers attacks on user and service accounts (credential theft, account takeover), on privileges (escalation, abuse of admin rights), and on the identity systems themselves (Active Directory, Entra ID, your SSO and IdP).
ITDR is not a single product you buy so much as a capability you assemble, and it sits alongside the tools you already run. It consumes identity signals, applies detections for identity-specific attacks, and feeds response. Gartner elevated ITDR precisely because existing categories left a gap: endpoint and network tools were not designed to notice an attacker who holds valid credentials and behaves, on the surface, like a legitimate user.
Want This Running In Your Environment?
Codesecure builds and runs open-source SOC and SIEM platforms on Wazuh, TheHive, Cortex, MISP and n8n, self-hosted for full data control, for businesses across India, Singapore, UAE and Malaysia. ISO/IEC 27001:2022 certified delivery, named OSCP, CEH and CISSP consultants, fixed-price proposals, no vendor lock-in.
See SOC and SIEM Services →ITDR vs EDR vs the Tools You Have
It helps to place ITDR against the familiar tools. EDR watches endpoints for malicious processes and files; it is strong when malware touches a device, but blind when an attacker uses stolen credentials from their own machine against your cloud. Network tools see traffic, not whose identity is behind it. SIEM collects logs broadly and is the natural home for identity detection if you feed it the right sources and write the right rules.
ITDR is the lens that focuses on identity across all of these. In practice, you do not need a separate expensive platform to start: a SIEM like Wazuh, fed with identity telemetry and tuned with identity-specific detections, delivers core ITDR. The point is not the label but the coverage, making sure that attacks which use legitimate credentials are detected, which the other tools were never built to do.
The Identity Telemetry You Need
ITDR runs on identity logs, and the good news is that you likely already generate them. The core sources are your directory and identity provider: Active Directory domain controller events and Entra ID (Azure AD) sign-in and audit logs, which record authentications, privilege changes, MFA activity and administrative actions. Add cloud sign-ins (AWS, Microsoft 365, Google Workspace), SSO and IdP logs (Okta, Entra, Ping and similar), and VPN and remote-access logs.
Collected into a SIEM like Wazuh, these give the raw material for identity detection. Wazuh already ingests Active Directory events through its agent and Microsoft 365 and cloud sign-ins through its integrations, so much of the plumbing overlaps with monitoring you may already run. The task is to bring the identity sources together and correlate across them, because identity attacks often span several systems: a phished Microsoft 365 account used to pivot into AWS, for example.
The Identity Attacks ITDR Detects
With identity telemetry flowing, build the detections that define ITDR. Account takeover: impossible-travel sign-ins (logins from two distant locations too close in time), access from new devices or countries, and sign-ins following a phishing campaign. MFA attacks: MFA fatigue (repeated push prompts until a user accepts), MFA method changes, and sign-ins that bypass MFA.
Privilege escalation: accounts being added to privileged groups, new admin or Global Administrator assignments, and sudden use of elevated rights. Credential and directory attacks: password spraying, Kerberoasting and DCSync against Active Directory (covered in depth in our AD monitoring guide), and changes to identity-provider configuration such as new federation or trust. Dormant and anomalous use: a long-unused account suddenly active, or behaviour that deviates from a user's baseline, which is where UEBA complements ITDR.
Not Sure Where To Start?
Whether the driver is identity attacks, a compliance deadline, data-residency requirements or AI-powered fraud, our SOC lead will map it to a practical detection plan on a 30-minute free scoping call. No obligation, no slideware.
Book a Free Scoping Call →From Detection to Response
The R in ITDR is response, and identity gives you decisive actions. When a high-confidence identity attack is detected, the containment is often at the identity layer: disabling or forcing a reset on a compromised account, revoking active sessions and tokens, requiring re-authentication, or stepping up MFA. Because these actions target the credential rather than the device, they can cut off an attacker who is operating entirely through legitimate access.
In a Wazuh-based SOC, identity detections feed your case-management and response workflow (for example TheHive and n8n), so an impossible-travel alert can trigger enrichment, analyst review and, where appropriate, automated or one-click containment such as disabling the account through the identity provider's API. As with all automation, keep a human in the loop for consequential actions. Mapping identity detections to MITRE ATT&CK keeps coverage measurable, and ties ITDR into the same programme as the rest of your detection engineering.
Frequently Asked Questions
What is ITDR (Identity Threat Detection and Response)?
ITDR is the discipline and set of capabilities for detecting, investigating and responding to threats that target identities and identity infrastructure: credential theft, account takeover, privilege escalation and abuse of systems like Active Directory and Entra ID. It exists because endpoint and network tools were not built to notice an attacker using valid credentials.
Why is identity called the new perimeter?
Because cloud services, SaaS and remote work dissolved the network boundary, and access is now controlled by identities (credentials, tokens, MFA) rather than a firewall. Attackers increasingly log in with stolen or phished credentials instead of exploiting vulnerabilities, so a valid identity is often more valuable than a compromised device. Most breaches now involve identity.
What is the difference between ITDR and EDR?
EDR watches endpoints for malicious processes and files and is strong when malware touches a device, but blind when an attacker uses stolen credentials from their own machine against your cloud. ITDR focuses on identity, detecting attacks that use legitimate credentials across directories, cloud sign-ins and SSO. They are complementary, covering device-based and identity-based attacks respectively.
Do I need a dedicated ITDR product?
Not necessarily. ITDR is a capability you can assemble on tools you already run. A SIEM like Wazuh, fed with identity telemetry (Active Directory, Entra ID, cloud sign-ins, SSO and VPN logs) and tuned with identity-specific detections, delivers core ITDR without a separate platform. The important thing is the coverage, detecting attacks that use valid credentials, not the product label.
What identity attacks should ITDR detect?
Account takeover (impossible-travel sign-ins, access from new devices or countries), MFA attacks (MFA fatigue, method changes, bypass), privilege escalation (new admin or privileged-group additions), directory attacks (password spraying, Kerberoasting, DCSync), identity-provider configuration abuse, and dormant or anomalous account use. Starting with impossible travel, MFA abuse and privilege additions covers the most common paths.
Can Codesecure build ITDR into our SOC?
Yes. Codesecure builds identity threat detection on Wazuh by collecting Active Directory, Entra ID, cloud sign-in and SSO telemetry and tuning detections for account takeover, MFA abuse, privilege escalation and directory attacks, with identity-layer response through your case workflow. ISO/IEC 27001:2022 certified delivery with named OSCP, CEH and CISSP consultants across India, Singapore, UAE and Malaysia.
Detect The Attacker Who Logs In With Valid Credentials
Codesecure builds Identity Threat Detection and Response on Wazuh, correlating Active Directory, Entra ID, cloud and SSO signals to catch account takeover, MFA abuse and privilege escalation, with identity-layer response. Delivered by named OSCP, CEH and CISSP consultants.
