# What Is Identity Threat Detection and Response (ITDR)?

Source: https://startwithidentity.com/guides/fundamentals/what-is-itdr/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Identity Threat Detection and Response (ITDR) is the discipline and tooling for detecting and responding to attacks that target identity itself: stolen credentials, account takeover, privilege escalation, and lateral movement. As identity became the primary attack surface, prevention alone stopped being enough, and ITDR fills the runtime gap.

## Why prevention is not enough

Strong [authentication](https://startwithidentity.com/guides/fundamentals/authentication-vs-authorization/) and least privilege reduce risk, but attackers still get in through phishing, [infostealers](https://startwithidentity.com/glossary/infostealer/), and [session hijacking](https://startwithidentity.com/glossary/session-hijacking/). ITDR assumes breach and watches for the behaviors that follow.

## What ITDR covers

- **Directory protection** for Active Directory and Entra ID, including misconfiguration detection and fast recovery.
- **Runtime detection** of anomalous authentication and [account takeover](https://startwithidentity.com/glossary/account-takeover/) using behavioral analytics ([UEBA](https://startwithidentity.com/glossary/ueba/)).
- **Attack-path analysis** to find how an attacker could escalate or move laterally.
- **SaaS identity risk** and exposed-credential intelligence.

## ITDR vs ISPM vs CIEM

[ISPM](https://startwithidentity.com/glossary/ispm/) is the preventive posture side (find risky configurations before attack). [CIEM](https://startwithidentity.com/guides/fundamentals/what-is-iga/) right-sizes cloud entitlements. ITDR is the detection-and-response side at runtime. Mature programs use all three.

## What ITDR detects that nothing else does

The defining property of an identity attack is that nothing looks broken. There is no malware in a valid login with a stolen token, no exploit in a service principal assuming a role it was permitted to assume, and no failed authentication to alert on. Endpoint and network tooling sees none of it.

The detections that earn their place are behavioral and identity-specific:

- Sign-ins that satisfy [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) policy but come from a session the user did not start, for example Windows Hello authentications with an empty device ID.
- [Device code](https://startwithidentity.com/glossary/device-code-flow/) grants from clients that have no business using them.
- New OAuth consent grants to unfamiliar applications.
- A first-time privileged action by an identity that has never performed one.
- Directory changes that create an escalation path: certificate template permissions, group nesting, delegation rights.

## Hybrid is where attacks live

Attackers routinely pivot between on-premises Active Directory and the cloud identity provider, because the trust between them is the point of the architecture. ITDR that watches one and not the other misses the path. This is also why AD resilience is a distinct concern: restoring a compromised forest from ordinary backups can restore the attacker's persistence along with everything else. See [Silverfort vs Semperis](https://startwithidentity.com/compare/silverfort-vs-semperis/).

## Response is the harder half

Detection without a response playbook produces alerts. The identity-specific containment steps are different from endpoint response: revoke [refresh tokens](https://startwithidentity.com/glossary/refresh-token/) and sessions rather than only resetting the password, because a password reset leaves a stolen session alive; remove attacker-added authentication methods; check for registered devices you did not expect. See [token theft](https://startwithidentity.com/glossary/token-theft/) and the [infostealer session hijacking teardown](https://startwithidentity.com/breaches/infostealer-session-hijacking/).

## Where to start

Browse [ITDR vendors](https://startwithidentity.com/vendors/itdr/), compare [Silverfort vs Semperis](https://startwithidentity.com/compare/silverfort-vs-semperis/), and read [how to choose an ITDR solution](https://startwithidentity.com/guides/buyer-guides/how-to-choose-an-itdr-solution/).