# ITDR Tools Compared: Five Platforms Scored Side by Side

Source: https://startwithidentity.com/rankings/best-itdr-tools/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

This is a side-by-side scorecard rather than a shopping list. Five [ITDR](https://startwithidentity.com/guides/fundamentals/what-is-itdr/) platforms scored against one rubric.

## Where this category splits

ITDR is a label stretched across three different starting points, and the right pick depends on which gap you actually have.

**Identity-infrastructure protection** (Silverfort) sits inside the authentication path itself, so it reaches systems agents and proxies cannot: legacy applications, Active Directory authentication, command-line tools and service accounts. Its licensing is metered by employee headcount rather than by protected identity, which is unusual and makes expanding coverage cost-neutral.

**Active Directory specialists** (Semperis) focus on AD and Entra ID posture, attack-path analysis and, critically, forest recovery. If your worst case is a domain-wide compromise, recovery capability matters more than detection breadth.

**Platform extensions** (CrowdStrike, Microsoft Defender for Identity, Vectra AI) extend an existing endpoint, cloud or network estate into identity signals. They are strongest when you already run the platform and weakest when you do not, because the value depends on correlation with telemetry you may not have.

## What has changed in the market

CrowdStrike acquired SGNL in January 2026, adding runtime access enforcement between identity providers and downstream resources, which pushes its offering from detection toward prevention.

## How to read these scores

Every vendor here is scored on the same [10-dimension rubric](https://startwithidentity.com/methodology/). Scores are comparative within the category, not absolute: a 4.5 means strong relative to peers solving the same problem.

Three things the scores deliberately do not capture. They do not price your deployment, because most vendors in this category quote rather than publish. They do not measure fit with your existing stack, which is usually what actually decides it. And they do not predict vendor stability, which in identity has mattered more than features lately given the pace of consolidation.

Use this to narrow a field to two or three candidates on capability, then pilot against your worst case rather than the vendor's reference architecture.

## Where to go next

For the full field, see [top 5 identity threat detection platforms](https://startwithidentity.com/articles/top-5-identity-threat-detection-platforms/). For the evaluation process, see [how to choose an ITDR solution](https://startwithidentity.com/guides/buyer-guides/how-to-choose-an-itdr-solution/). To browse every profile, see the [ITDR vendor directory](https://startwithidentity.com/vendors/itdr/).