ITDR
Identity Threat Detection and Response. Security tooling that detects and responds to identity-based attacks such as account takeover, privilege escalation, and lateral movement, often across Active Directory, Entra ID, and cloud IdPs. Complements prevention and posture by catching attacks at runtime.
ITDR exists because endpoint and network tools do not see identity attacks: there is no malware in a valid login with a stolen token. It watches the identity control plane itself, which in most enterprises means Active Directory and the cloud IdP together, since attackers routinely pivot between them. The detections that matter are behavioral, because every individual action in the chain is technically authorized.
See also: what is ITDR, lateral movement, ISPM, ITDR vendors
Related on Start with Identity
- GlossaryUEBA
User and Entity Behavior Analytics. Machine-learning analysis of normal behavior to flag anomalies that signal compromise or insider risk. A common building blo
- GlossaryAttack Path
A chain of individually legitimate permissions and relationships that together let a low-privileged identity reach a high-privileged one. Each link is a valid c
- GlossaryEntity Analytics
The analysis of behaviour and relationships across all entities in an environment, human and non-human, to establish what normal looks like and surface deviatio
- BlogOkta buys Permiso Security to put ITDR inside the identity provider
Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of
- PodcastSemperis
Semperis' biweekly show for defenders of hybrid Active Directory and Entra ID environments, hosted by 15-time Microsoft MVP Sean Deuby.
- BlogSilverfort acquires Fabrix Security, a one-year-old AI access-decision engine
Price undisclosed, reported as tens of millions for a company founded in 2025. Fabrix supplies the identity knowledge graph and decisioning; Silverfort supplies