# Identity threats and ITDR: podcast learning path

Source: https://startwithidentity.com/podcasts/learn/identity-threats-itdr/

How attackers abuse identity, and how teams detect and respond. 15 episodes, ordered from basics to advanced.

Read alongside: [ITDR (glossary)](https://startwithidentity.com/glossary/itdr/), [ITDR guide](https://startwithidentity.com/guides/security/identity-threat-detection-response-guide/), [Breach teardowns](https://startwithidentity.com/breaches/), [Attack techniques](https://startwithidentity.com/techniques/)

1. [The Real-World State of ITDR with Brian Desmond](https://www.hipconf.com/podcast/the-real-world-state-of-itdr-with-brian-desmond/) (Hybrid Identity Protection Podcast, 2022-09-08, 29 min, learner): Introduces identity threat detection and response from the view of hands-on identity teams and where organizations struggle most.
2. [Analyst Chat #212: Securing the Front Door: The Importance of ITDR in Identity Protection](https://www.kuppingercole.com/watch/itdr-identity-protection) (KuppingerCole Analyst Chat, 2024-04-29, 19 min, learner): Explains why attackers now target identity systems as an entry point, what ITDR tools do, and why identity and security operations teams must cooperate.
3. [ITDR Deep Dive with Matt Caufield - Exploring the Next Big Thing in Identity & Access Management](https://podcasts.apple.com/us/podcast/itdr-deep-dive-with-matt-caufield-exploring-the-next/id1683228982?i=1000613526256) (The Identity Jedi Show, 2023-05-18, 31 min, learner): Discusses ITDR as an emerging category and how it differs from traditional identity and access management controls.
4. [Root Causes 249: What Is MFA Exhaustion?](https://www.sectigo.com/root-causes/root-causes-249-what-is-mfa-exhaustion) (Root Causes: A PKI and Security Podcast, 2022-10-21, 10 min, learner): What MFA fatigue is: an attacker with a stolen password floods push prompts until the user approves, why it worked against Uber and Cisco, and why users should question unexpected prompts.
5. [EP 39 - Analyzing the MGM and Okta Breaches: the Identity Connection](https://podcasts.apple.com/us/podcast/ep-39-analyzing-the-mgm-and-okta-breaches/id1620186412?i=1000633477255) (Security Matters (formerly Trust Issues), 2023-11-02, 33 min, practitioner): Breaks down the 2023 MGM help desk social engineering attack and the Okta support system breach, and the identity weaknesses both exploited.
6. [EP 46 - Behind the Data Breach: Dissecting Cozy Bear's Microsoft Attack](https://podcasts.apple.com/us/podcast/ep-46-behind-the-data-breach-dissecting-cozy-bears/id1620186412?i=1000645464922) (Security Matters (formerly Trust Issues), 2024-02-15, 32 min, practitioner): Dissects the Midnight Blizzard (APT29) breach of Microsoft, including password spraying a legacy test tenant and abusing OAuth applications for access.
7. [EP 49 - Inside the Attack Surface: Lessons from the Red Team on Browser Threats](https://podcasts.apple.com/us/podcast/ep-49-inside-the-attack-surface-lessons-from-the-red/id1620186412?i=1000651307698) (Security Matters (formerly Trust Issues), 2024-04-03, 30 min, practitioner): Explains why attackers moved from stealing passwords to hijacking session tokens and cookies, and why the browser is now a main identity attack surface.
8. [#409 - Q1 2026 Identity Threat Report Roundup](https://podcasts.apple.com/us/podcast/409-q1-2026-identity-threat-report-roundup/id1471899975?i=1000756737587) (Identity at the Center, 2026-03-23, 59 min, practitioner): Summarizes seven Q1 2026 threat reports and the identity patterns they share, including MFA gaps, machine identity abuse, deepfakes, and faster breach timelines.
9. [Microsoft DART: In the Trenches with Shiva P](https://www.hipconf.com/podcast/microsoft-dart-in-the-trenches-with-shiva-p/) (Hybrid Identity Protection Podcast, 2024-11-22, 39 min, practitioner): A Microsoft incident responder walks the attack kill chain from initial access to ransomware extortion and shares ways to reduce identity risk.
10. [Kerberoasting in 2025](https://creators.spotify.com/pod/profile/blue-security-podcast/episodes/Kerberoasting-in-2025-e38r5gg) (Blue Security Podcast, 2025-09-30, 35 min, practitioner): How Kerberoasting abuses RC4 service tickets, why old service account keys stay RC4 until reset, and a defender to-do list: audit RC4, disable it, gMSAs, SPN cleanup.
11. [Octo Tempest Threat Actor Profile](https://thecyberwire.com/podcasts/microsoft-threat-intelligence/5/notes) (Microsoft Threat Intelligence Podcast, 2023-11-01, 46 min, practitioner): How Octo Tempest (Scattered Spider) uses SIM swaps, SMS phishing and help desk password and MFA reset calls backed by stolen PII, and defenses such as strict reset verification and phishing-resistant MFA.
12. [How a Single Breach Can Turn into a Full Compromise with Tim Beasley, Senior Incident Response Consultant at Semperis](https://www.hipconf.com/podcast/single-breach-can-turn-into-full-compromise-tim-beasley/) (Hybrid Identity Protection Podcast, 2026-02-17, 40 min, architect): Explains how attackers escalate through identity infrastructure after initial access, and why identity defense needs a recovery-first plan as well as prevention.
13. [Red Team Secrets: How we bypass Conditional Access (and how you can fix it)](https://entra.news/p/red-team-secrets-how-we-bypass-conditional) (Entra.Chat, 2025-08-29, 58 min, architect): A security researcher explains how Conditional Access can be bypassed through FOCI client apps, pre-consented scopes and policy exclusions, and what admins can do about it.
14. [Hacking Entra ID: Bypassing AppLocks & Creating ‘Immortal’ Users](https://entra.news/p/hacking-entra-id-bypassing-applocks) (Entra.Chat, 2025-11-08, 52 min, architect): Covers Entra ID attack research: backdooring service principals, restricted administrative units that create undeletable accounts, AppLock bypass, and Copilot Studio OAuth phishing.
15. [Analyst Chat #267: ITDR & Machine Identities (NHIs) - Rethinking IAM for Security at Scale](https://www.kuppingercole.com/watch/idtr-nhis-rethinking-iam-for-security) (KuppingerCole Analyst Chat, 2025-09-01, 66 min, architect): Separates real ITDR capability from vendor relabeling, contrasts visibility with observability of identity behavior, and argues hygiene must come before detection.