ITDR (Identity Threat Detection and Response)

What is ITDR (identity threat detection and response)?

ITDR (identity threat detection and response) is a security discipline focused on detecting and responding to attacks that target identity infrastructure itself: stolen sessions, compromised credentials, abused privileges, and manipulated identity configuration. It exists because attackers increasingly log in rather than break in, which leaves no malware for endpoint tooling to find.

What ITDR detects

• Credential attacks: password spraying, credential stuffing, and confirmed leaked credential matches.
• Session and token theft, where a valid session cookie or refresh token is replayed from elsewhere.
• MFA fatigue, where repeated push notifications are sent until the user approves one.
• Privilege abuse: unusual use of an administrative role, or a role assignment nobody requested.
• Configuration tampering: a new federation trust, a modified conditional access policy, a fresh admin account.

The blind spot is everything outside the identity provider

ITDR watches the identity infrastructure it is connected to, which in practice means the identity provider and the directory. A growing share of identity attacks now happens one layer out: OAuth consent phishing against a SaaS application, an API token issued inside a tool, or an application never federated at all. None of those produce a signal in the identity provider, because the identity provider was never involved.

Examples and use cases

An attacker sends a consent screen for a legitimate-looking productivity add-on. An employee approves it, granting persistent read access to their mailbox and drive. No password is stolen, no MFA is bypassed, and the identity provider records a successful, policy-compliant sign-in. Detection has to come from the grant itself: which applications hold which scopes, and which ones appeared this week. Corma surfaces those OAuth grants across the estate, which is the layer ITDR does not reach.

Related concepts

• Identity and access management platform
• IAM for security teams
• Discover and prevent shadow AI

FAQ

What is the difference between ITDR and EDR?

EDR detects threats on endpoints through process and file behavior. ITDR detects threats against identity systems through authentication, authorization, and configuration signals.

Is ITDR the same as a SIEM?

No. A SIEM aggregates logs from everywhere. ITDR specializes in identity telemetry and the attack patterns specific to it, and it usually feeds a SIEM rather than replacing it.

What is the most common identity attack today?

Session and token theft, followed by OAuth consent phishing. Both bypass multi-factor authentication because the factor had already been satisfied.

Where does ITDR fit alongside IAM?

IAM decides who gets access. ITDR watches what happens to those identities afterward and reacts when the behavior stops matching the grant.

Request a demo