ITDR — identity threat detection and response explained

Identity has become the primary attack surface in modern enterprises. Attackers no longer need to breach firewalls or exploit zero-day vulnerabilities in perimeter defenses when they can simply steal, forge, or abuse credentials to move through an organization undetected. The shift to hybrid work, cloud adoption, and the explosion of service accounts have made identity infrastructure both more critical and more exposed than ever before.

In response to this reality, Gartner introduced the concept of Identity Threat Detection and Response (ITDR) in 2022, identifying it as a top security priority. ITDR represents a dedicated security discipline — a set of tools, processes, and practices focused specifically on protecting identity infrastructure from compromise and detecting attacks that target identities as their primary vector.

This article provides a comprehensive examination of ITDR — what it is, why it emerged, how it works, how it compares to adjacent security disciplines, and what organizations need to consider when implementing it.

The Identity Crisis in Cybersecurity

Before exploring ITDR itself, it is important to understand why identity has become such a critical attack vector. The traditional perimeter-based security model assumed that threats originated outside the network, and defenses were built accordingly — firewalls, DMZs, intrusion detection systems. Once inside the perimeter, users and devices were largely trusted.

This model has collapsed. Several converging trends have rendered it obsolete:

Cloud and SaaS adoption — corporate resources now exist outside any definable perimeter, accessible from anywhere with valid credentials.
Hybrid and remote work — users authenticate from personal devices, home networks, and public Wi-Fi, making network-based trust meaningless.
Proliferation of identities — a typical enterprise manages not only employee accounts but also contractor accounts, service accounts, machine identities, API keys, and federated identities across dozens of systems.
Active Directory as a single point of failure — AD remains the backbone of identity in most enterprises, yet it was designed in an era when insider threats and sophisticated identity attacks were not primary concerns.

The result is stark. The vast majority of breaches involve compromised credentials. Attackers have learned that the fastest path to valuable data is not through a firewall — it is through a legitimate user account.

What Is ITDR?

ITDR (Identity Threat Detection and Response) is a security discipline focused on protecting identity infrastructure and detecting threats that target identity systems, credentials, and access privileges. Gartner coined the term in its 2022 report “Top Security and Risk Management Trends,” positioning ITDR alongside EDR and NDR as a critical detection and response capability.

Unlike traditional IAM, which focuses on provisioning and managing access, ITDR assumes that identity systems will be targeted and potentially compromised. Its purpose is to detect when this happens and enable rapid response before attackers can leverage stolen or forged credentials to achieve their objectives.

ITDR encompasses three core functions:

Prevention — hardening identity infrastructure to reduce the attack surface. This includes identifying misconfigurations in Active Directory, removing excessive privileges, detecting stale accounts, and enforcing security baselines.
Detection — continuously monitoring identity infrastructure for indicators of attack or compromise. This goes beyond simple log analysis to include behavioral analytics, protocol-level inspection, and correlation of identity events across hybrid environments.
Response — providing automated and manual response capabilities when identity threats are detected. This ranges from alerting SOC analysts to automatically disabling compromised accounts, forcing password resets, or revoking active sessions.

The key insight behind ITDR is that identity threats require specialized detection logic. A generic SIEM rule looking for “failed logins” is not sufficient to detect a Kerberoasting attack, a Golden Ticket forgery, or a subtle manipulation of Active Directory replication. These attacks require deep understanding of identity protocols and directory services internals.

ITDR vs IAM vs PAM vs EDR

ITDR does not replace existing security disciplines — it fills a gap between them. Understanding the boundaries and intersections is essential for architects designing a defense-in-depth strategy.

Discipline	Primary Focus	Function	Relationship to ITDR
IAM	Identity lifecycle	Provisioning, authentication, authorization, SSO	ITDR monitors the infrastructure IAM depends on
PAM	Privileged accounts	Vaulting, session recording, just-in-time access	ITDR detects when PAM controls are bypassed
EDR	Endpoints	Malware, exploits, process anomalies	ITDR covers identity-layer attacks EDR may miss
NDR	Network traffic	Lateral movement, C2 communication, exfiltration	ITDR provides identity context for network anomalies
ITDR	Identity infrastructure	Credential abuse, directory attacks, privilege escalation	Complements all of the above

IAM and ITDR

IAM systems manage the “front door” — they control who gets access and how they authenticate. But IAM systems themselves can be attacked. An attacker who compromises an IAM administrator account, or who directly manipulates Active Directory objects, can grant themselves access that IAM policies were designed to prevent. ITDR monitors the integrity of the identity infrastructure that IAM depends on.

PAM and ITDR

PAM solutions protect privileged accounts by vaulting credentials, recording sessions, and enforcing just-in-time access. However, PAM cannot detect an attacker who obtains domain admin privileges through a Kerberos attack (like Golden Ticket) that bypasses PAM entirely. ITDR detects these protocol-level attacks that operate below the PAM layer.

EDR and ITDR

EDR excels at detecting malicious activity on individual endpoints — malware execution, suspicious processes, fileless attacks. However, many identity attacks produce minimal endpoint footprint. A Kerberoasting attack, for example, involves legitimate Kerberos service ticket requests that EDR may not flag. ITDR analyzes these requests in the context of identity infrastructure and recognizes them as attack indicators.

How ITDR Works

ITDR platforms operate by monitoring identity infrastructure at multiple layers — from directory service internals to authentication protocols to cloud identity provider APIs. The technical architecture typically involves several components working together.

Active Directory and Entra ID Monitoring

The foundation of most ITDR deployments is deep monitoring of Active Directory. This goes far beyond reading Windows Event Logs. Advanced ITDR solutions monitor:

Directory replication stream — detecting unauthorized replication requests (DCSync attacks) by monitoring the DRS (Directory Replication Service) protocol.
NTDS.dit changes — tracking modifications to the AD database file, including schema changes, object creation/deletion, and attribute modifications.
Group Policy Objects — detecting unauthorized GPO modifications that could be used to deploy malware, weaken security settings, or create backdoor accounts.
Kerberos ticket activity — analyzing TGT and service ticket requests for anomalies indicative of Kerberoasting, AS-REP Roasting, Golden Ticket, or Silver Ticket attacks.
LDAP queries — identifying reconnaissance activity such as enumeration of privileged groups, service accounts, or trust relationships.
DNS records — monitoring for DNS poisoning or record manipulation that could redirect authentication traffic.

For Entra ID (formerly Azure AD), ITDR platforms monitor sign-in logs, audit logs, conditional access policy changes, application consent grants, role assignments, and federation configuration changes. The challenge in hybrid environments is correlating events across on-premise AD and cloud Entra ID to detect attacks that span both.

Anomaly Detection and Behavioral Analytics

Raw event monitoring generates enormous volumes of data. The value of ITDR lies in its ability to distinguish genuine threats from normal activity through several analytical approaches:

Baseline profiling — ITDR platforms learn the normal behavior of each identity: typical login times, source locations, accessed resources, authentication methods. Deviations from these baselines generate alerts.
Protocol analysis — understanding the internals of Kerberos, NTLM, LDAP, and SAML enables detection of protocol-level abuse that would be invisible to generic log analysis.
Attack pattern recognition — known attack techniques (mapped to MITRE ATT&CK tactics like TA0006 Credential Access and TA0008 Lateral Movement) are encoded as detection rules that identify specific sequences of events.
Graph analysis — mapping relationships between identities, groups, permissions, and resources to identify attack paths that an adversary could exploit for privilege escalation.

Automated Response

When threats are detected, ITDR platforms can trigger automated response actions:

Disabling or locking a compromised account
Forcing a password reset
Revoking active sessions and tokens
Triggering MFA step-up authentication
Isolating an affected system through EDR integration
Creating a high-priority incident ticket in the SOC workflow
Enriching the alert with identity context (account history, group memberships, recent changes) for faster analyst triage

The level of automation depends on organizational risk tolerance. High-confidence detections (e.g., confirmed Golden Ticket usage) may warrant automatic account lockout, while lower-confidence anomalies may generate alerts for human investigation.

Common Identity Attacks ITDR Detects

Understanding the specific attacks ITDR is designed to detect helps clarify its value proposition. These attacks target Active Directory, Kerberos, cloud identity providers, and authentication protocols.

Kerberoasting

Kerberoasting exploits the Kerberos protocol by requesting service tickets (TGS) for accounts with Service Principal Names (SPNs). The returned tickets are encrypted with the service account’s password hash, which the attacker can then crack offline. If service accounts use weak passwords — a distressingly common situation — the attacker obtains valid credentials without triggering account lockouts.

ITDR detects Kerberoasting by identifying anomalous patterns of TGS requests: a single user requesting tickets for many services in a short timeframe, requests for services the user has never accessed before, or requests using encryption types that suggest offline cracking intent (RC4 instead of AES).

Golden Ticket and Silver Ticket Attacks

A Golden Ticket attack occurs when an attacker obtains the KRBTGT account hash (through DCSync or NTDS.dit extraction) and uses it to forge Ticket Granting Tickets with arbitrary privileges and lifetimes. This effectively gives the attacker unrestricted access to the entire domain for as long as the KRBTGT hash remains unchanged.

Silver Ticket attacks are similar but target individual service accounts rather than the KRBTGT. The attacker forges service tickets directly, bypassing the KDC entirely.

ITDR detects these attacks through anomalies in ticket properties: tickets with unusually long lifetimes, tickets that were not issued by the legitimate KDC, tickets with unexpected encryption types, or authentication events that lack corresponding TGT issuance records.

DCSync

DCSync is a technique where an attacker impersonates a domain controller and uses the Directory Replication Service (DRS) protocol to request password hash data from another domain controller. Tools like Mimikatz implement this attack by issuing DRSGetNCChanges requests. If an attacker gains sufficient privileges (Replicating Directory Changes), they can extract every password hash in the domain without touching the NTDS.dit file directly.

ITDR detects DCSync by monitoring replication requests and alerting when a non-domain controller initiates replication — a definitive indicator of compromise.

Pass-the-Hash and Pass-the-Ticket

Pass-the-Hash (PtH) attacks use stolen NTLM hashes to authenticate as a user without knowing their plaintext password. Pass-the-Ticket (PtT) attacks use stolen Kerberos tickets for the same purpose. Both enable lateral movement within the network.

ITDR detects these attacks by correlating authentication events: a user authenticating from a machine where they have not previously logged in, NTLM authentication from accounts configured for Kerberos, or ticket reuse from unexpected network locations.

Credential Stuffing and Password Spraying

Credential stuffing uses previously breached username/password pairs to attempt login across different services. Password spraying tries a small set of common passwords across many accounts, staying below lockout thresholds.

ITDR detects these attacks through statistical analysis of authentication failures: distributed login attempts across many accounts with the same password, authentication attempts from known malicious IP ranges, or successful authentications immediately following a pattern of failures.

Directory Persistence Mechanisms

Sophisticated attackers establish persistence within Active Directory itself. Techniques include creating hidden admin accounts, modifying AdminSDHolder to regain privileges automatically, adding SID History entries to non-privileged accounts, modifying security descriptors on directory objects, or installing rogue federation trust configurations.

ITDR continuously monitors directory object integrity and alerts on changes to security-sensitive attributes, groups, and configurations — even when those changes are made by accounts with legitimate administrative privileges.

ITDR Vendor Landscape

The ITDR market has matured rapidly since Gartner’s 2022 designation. Several categories of vendors offer ITDR capabilities, each approaching the problem from a different starting point.

Identity Security Specialists

Semperis is one of the most recognized pure-play ITDR vendors, with deep expertise in Active Directory security. Their Directory Services Protector (DSP) provides real-time AD monitoring, attack detection, and automated recovery. Semperis also offers Active Directory Forest Recovery (ADFR) for disaster recovery scenarios where AD has been completely compromised — a situation that is devastatingly common in ransomware attacks.

Silverfort takes a different approach, deploying an agentless platform that extends MFA and adaptive access policies to legacy systems, service accounts, and administrative tools that traditionally cannot support modern authentication. Their ITDR capabilities focus on detecting identity threats across hybrid environments without requiring changes to existing infrastructure.

Endpoint and Cloud Security Platforms

CrowdStrike integrated ITDR into its Falcon platform through the acquisition of Preempt Security. CrowdStrike Falcon Identity Threat Detection monitors Active Directory in real time, detects lateral movement and credential-based attacks, and provides identity-centric risk scoring. The advantage of CrowdStrike’s approach is the correlation of identity signals with endpoint telemetry from the Falcon agent, providing richer context for investigation.

SentinelOne offers Singularity Identity, which provides AD attack surface reduction, deception-based detection (deploying fake credentials and directory objects as honeytokens), and automated response. SentinelOne’s identity security integrates with their broader XDR platform for unified threat management.

Microsoft has built ITDR capabilities into Microsoft Defender for Identity (formerly Azure ATP). It monitors on-premise Active Directory traffic by analyzing network communications, detecting known attack techniques like Pass-the-Hash, Kerberoasting, and DCSync. For cloud environments, Entra ID Protection provides risk-based conditional access and anomaly detection for Azure AD sign-ins. Microsoft’s advantage is deep integration with the identity infrastructure most enterprises already run.

IAM Vendors with ITDR Extensions

Okta and Ping Identity have added threat detection capabilities to their cloud identity platforms. These focus primarily on detecting anomalies in authentication patterns, application access, and administrative operations within their own identity clouds — complementing rather than replacing dedicated ITDR solutions that monitor on-premise AD.

Choosing a Vendor

The right ITDR solution depends on the organization’s identity architecture. Key evaluation criteria include:

Coverage — does the solution monitor on-premise AD, Entra ID, and third-party identity providers?
Detection depth — does it analyze protocol-level activity (Kerberos, NTLM, LDAP) or only API-level logs?
Response capabilities — can it take automated remediation actions, or is it alert-only?
Integration — does it feed into existing SIEM, SOAR, and SOC workflows?
Deployment model — agentless vs agent-based, cloud-delivered vs on-premise?
AD recovery — in ransomware scenarios, can it help restore a compromised Active Directory?

SOC and SIEM Integration

ITDR does not operate in isolation. Its value multiplies when integrated into the broader security operations ecosystem. In a mature SOC, ITDR signals become a critical data source alongside endpoint, network, and cloud telemetry.

SIEM Integration

ITDR platforms export alerts and raw identity events to SIEM platforms (Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security). This enables SOC analysts to:

Correlate identity threats with endpoint and network events for comprehensive incident reconstruction
Build custom detection rules that combine identity signals with other data sources
Track identity-related metrics and trends over time
Generate compliance reports that demonstrate identity monitoring coverage

SOAR Playbooks

Security Orchestration, Automation, and Response (SOAR) platforms can consume ITDR alerts and execute automated playbooks:

ITDR detects a Kerberoasting attack
SOAR playbook triggers: enrich the alert with the attacker’s recent activity, check if the targeted service account credentials were successfully cracked (by monitoring for subsequent anomalous authentication), disable the service account if compromise is confirmed, create an incident ticket, and notify the identity team
The entire sequence executes in seconds rather than the hours it would take for manual investigation

MITRE ATT&CK Mapping

Effective ITDR solutions map their detections to the MITRE ATT&CK framework, providing SOC teams with a common language for understanding attack techniques. Key ATT&CK tactics and techniques relevant to ITDR include:

TA0006 — Credential Access: Kerberoasting (T1558.003), AS-REP Roasting (T1558.004), OS Credential Dumping (T1003), DCSync (T1003.006)
TA0003 — Persistence: Account Manipulation (T1098), Create Account (T1136)
TA0004 — Privilege Escalation: Domain Policy Modification (T1484), Abuse Elevation Control (T1548)
TA0005 — Defense Evasion: Use Alternate Authentication Material (T1550)
TA0008 — Lateral Movement: Pass-the-Hash (T1550.002), Pass-the-Ticket (T1550.003)

ITDR Best Practices

Implementing ITDR is not simply a matter of deploying a product. It requires organizational commitment to identity security as a discipline. The following best practices provide a framework for effective ITDR implementation.

1. Know Your Identity Attack Surface

Before deploying ITDR tooling, conduct a thorough assessment of your identity infrastructure. Map all Active Directory forests and domains, identify all Entra ID tenants, catalog service accounts and their privileges, document trust relationships, and understand where privileged credentials are stored and used. You cannot protect what you do not know exists.

2. Harden Before You Monitor

ITDR detection is more effective when the identity attack surface has been reduced. Start with foundational hardening:

Implement tiered administration (Tier 0/1/2 model) to isolate domain admin credentials
Remove unnecessary Service Principal Names to reduce Kerberoasting targets
Enforce AES encryption for Kerberos and disable RC4 where possible
Clean up stale accounts, excessive group memberships, and orphaned permissions
Rotate the KRBTGT password twice (with appropriate interval) to invalidate any existing Golden Tickets
Review and restrict DCSync permissions to legitimate domain controllers only

3. Deploy Deception

Honeytokens and deception accounts are a powerful complement to ITDR detection. Create fake privileged accounts, service accounts with SPNs, and credential caches that no legitimate process should ever access. Any interaction with these deception objects is a high-fidelity indicator of compromise, producing alerts with near-zero false positive rates.

4. Integrate with Zero Trust Architecture

ITDR is a natural component of Zero Trust. The Zero Trust principle of “never trust, always verify” applies directly to identity — even authenticated users should be continuously evaluated for signs of compromise. ITDR provides the continuous evaluation mechanism that Zero Trust requires for the identity layer. Conditional access policies should consume ITDR risk signals to dynamically adjust authentication requirements.

5. Plan for AD Compromise Recovery

Ransomware operators routinely target Active Directory as part of their attack chain. An organization whose AD is destroyed cannot authenticate users, access resources, or operate. ITDR strategy should include:

Regular AD backups with tested recovery procedures
Offline copies of critical AD data (KRBTGT hash, domain controller credentials)
A documented AD forest recovery plan with defined RTO
Consideration of specialized AD recovery tools (Semperis ADFR, Microsoft’s AD Forest Recovery process)

6. Measure and Iterate

ITDR effectiveness should be measured through regular Purple Team exercises that simulate identity attacks against your environment and validate that ITDR detections fire correctly. Track metrics like mean time to detect (MTTD) for identity threats, false positive rates, and coverage against the MITRE ATT&CK identity techniques. Use these metrics to continuously tune detection rules and improve response playbooks.

The Future of ITDR

ITDR is a rapidly evolving discipline. Several trends will shape its development in the coming years.

Machine identity protection — as organizations adopt microservices, containers, and API-driven architectures, the number of non-human identities (service accounts, API keys, certificates, managed identities) is growing exponentially. Future ITDR solutions will need to monitor machine identity behavior with the same rigor currently applied to human accounts.

Identity fabric integration — rather than operating as a standalone tool, ITDR will increasingly be embedded into identity fabric architectures that unify identity management, governance, and security across hybrid environments.

AI-driven detection — large language models and advanced machine learning will enhance anomaly detection by understanding the semantic context of identity operations, reducing false positives while catching novel attack variations that rule-based systems miss.

Decentralized identity — as organizations explore verifiable credentials and decentralized identity standards, ITDR will need to adapt to protect identity verification processes that do not depend on centralized directory services.

Frequently Asked Questions (FAQ)

What is the difference between ITDR and IAM?

IAM (Identity and Access Management) focuses on provisioning, authenticating, and authorizing users — it controls who gets access to what. ITDR focuses on detecting when those identities are being attacked, compromised, or misused. IAM is preventive, ITDR is detective and responsive. They are complementary layers, not alternatives.

Does ITDR replace EDR or XDR?

No. EDR monitors endpoints (workstations, servers) for malicious behavior, while ITDR monitors identity infrastructure (Active Directory, Entra ID, Okta) for identity-specific threats like credential theft, privilege escalation, and lateral movement. A mature security program uses both — EDR for endpoint-level threats and ITDR for identity-level threats.

Which identity attacks does ITDR detect?

ITDR detects a wide range of identity-based attacks including Kerberoasting, Golden Ticket and Silver Ticket attacks, DCSync, Pass-the-Hash, credential stuffing, suspicious privilege escalation, anomalous authentication patterns, and unauthorized changes to directory objects like group memberships or GPO modifications.

Is ITDR only for on-premise Active Directory?

No. While ITDR originated from the need to protect Active Directory, modern ITDR solutions cover hybrid and cloud-only environments. They monitor Entra ID (Azure AD), Okta, Ping Identity, and other cloud identity providers in addition to on-premise AD. Most enterprises operate hybrid identity infrastructure, and ITDR platforms are designed for exactly this scenario.

How does ITDR integrate with a SOC?

ITDR platforms feed identity-specific alerts into SIEM and SOAR tools used by the SOC. This includes alerts on credential abuse, privilege escalation, directory changes, and anomalous authentication. SOC analysts use these signals alongside endpoint and network telemetry to investigate incidents. Many ITDR solutions provide pre-built integrations with Splunk, Microsoft Sentinel, and other SIEM platforms.

Summary

Identity Threat Detection and Response represents a necessary evolution in cybersecurity strategy. As identity has become the primary attack vector — surpassing network and endpoint exploitation in frequency and impact — organizations need dedicated capabilities to protect, monitor, and defend their identity infrastructure.

ITDR is not a replacement for IAM, PAM, or EDR. It is the missing layer that connects them, providing the detection and response capabilities specifically designed for the unique characteristics of identity-based attacks. An attacker using a forged Kerberos ticket or a compromised service account operates within the boundaries of what traditional security tools consider legitimate activity. Only identity-aware detection can recognize these threats for what they are.

For security teams, the practical takeaway is clear: assess your identity attack surface, harden your Active Directory and cloud identity configurations, deploy ITDR tooling that provides protocol-level visibility, integrate identity signals into your SOC workflows, and regularly test your detection coverage against known identity attack techniques. The organizations that treat identity security as a first-class discipline — rather than an afterthought — will be measurably more resilient against the threats that define the current threat landscape.

Our services

Security Operations Center (SOC)