# How to Choose an ITDR Solution

Source: https://startwithidentity.com/guides/buyer-guides/how-to-choose-an-itdr-solution/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Identity Threat Detection and Response (ITDR) catches identity-based attacks that prevention misses. The category is broad, so scope your need first.

## 1. Know which problem you are solving

- **Directory security and recovery** for Active Directory and Entra (detection, posture, fast forest recovery).
- **Runtime identity protection** that extends MFA and risk analysis everywhere, including legacy and [service accounts](https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/).
- **SaaS identity risk** and shadow access.
- **Exposure intelligence** on leaked credentials and infostealer logs.

Different leaders own different halves, so naming your priority narrows the field fast.

## 2. Check integration with your stack

ITDR feeds and consumes signals from your IdP, EDR, and SIEM. Confirm clean integration so detections are actionable, not noise.

## 3. Posture vs detection vs response

Some tools find misconfigurations (posture), some detect attacks at runtime, some help you recover. Decide how much of that lifecycle you need in one product.

## 4. Score and pilot

Compare with the [capability checker](https://startwithidentity.com/tools/capability-checker/) and validate detections against real scenarios.

## 5. Test detections against your own scenarios

Vendor demos show the detections that work. Bring your own, drawn from what actually happens:

- A valid sign-in that satisfies phishing-resistant policy but comes from a session the user did not start, for example a Windows Hello authentication with an empty device ID.
- A [device code](https://startwithidentity.com/glossary/device-code-flow/) grant from a client with no business using one.
- A new OAuth consent grant to an unfamiliar application.
- A service account performing its first-ever privileged action.
- A directory change that creates an escalation path, such as a certificate template permission or new delegation right.

If a tool cannot show you these, it is watching the wrong layer.

## 6. Hybrid coverage is not optional

Attackers pivot between on-premises Active Directory and the cloud identity provider because the trust between them is the point of the architecture. A tool that watches one and not the other misses the path entirely. Confirm coverage of both, and confirm it correlates rather than presenting two consoles.

## 7. Ask about response, not just detection

Detection without a playbook produces alerts. Identity containment is different from endpoint containment: revoking [refresh tokens](https://startwithidentity.com/glossary/refresh-token/) and sessions matters more than resetting a password, because a reset leaves a stolen session alive. Ask what the product can do directly, what it hands to your identity provider, and what remains manual.

## 8. Prevention and resilience are separate purchases

Runtime protection that extends MFA to protocols agents cannot reach, and directory resilience that lets you recover a forest cleanly, are different products solving different halves. If budget allows only one, choose the one matching the incident you would struggle most to survive. See [Silverfort vs Semperis](https://startwithidentity.com/compare/silverfort-vs-semperis/) and [ISPM](https://startwithidentity.com/glossary/ispm/) for the preventive posture side.

## Where to start

Browse [ITDR vendors](https://startwithidentity.com/vendors/itdr/) and [Silverfort vs Semperis](https://startwithidentity.com/compare/silverfort-vs-semperis/), and read about [Zero Trust](https://startwithidentity.com/guides/fundamentals/what-is-zero-trust/).