Somewhere in your IT environment right now, there is a very good chance that a compromised identity is being used against you — and your existing security tools have no idea.
That's not alarmism. That's the operational reality of 2026. According to the Identity Defined Security Alliance, 90% of organizations experienced an identity-related breach in 2025. CrowdStrike's 2026 Global Threat Report found that attackers now move from initial access to lateral movement in under seven minutes — and the vast majority of those initial access events involve stolen or abused credentials, not malware.
Your firewall didn't stop them. Your endpoint detection didn't flag them. Your MFA, while helpful, wasn't enough.
The reason is simple: most businesses have invested heavily in securing their perimeter and their devices, but have paid far less attention to securing their identities in motion — what users and accounts are actually doing after they authenticate.
That's the problem Identity Threat Detection and Response (ITDR) was built to solve.
What Is Identity Threat Detection and Response (ITDR)?
ITDR is an emerging security discipline — now one of the fastest-growing in the industry — focused specifically on detecting and responding to threats that weaponize user identities, credentials, and access rights.
Think of it as the identity layer's answer to Endpoint Detection and Response (EDR). While EDR watches what's happening on your devices, ITDR watches what's happening with your identities: who is authenticating, from where, to what, and whether that behavior matches what's expected.
Gartner formally identified ITDR as a top security trend in 2023, and by 2026 it has moved from "emerging concept" to "urgent business need." Analysts at Forrester project the ITDR market will exceed $10 billion in annual spending by 2028.
What's driving the urgency? A fundamental shift in how attackers operate.
Why Traditional IAM Is No Longer Enough
Most organizations have some form of Identity and Access Management in place — Active Directory, Microsoft Entra ID (formerly Azure AD), Okta, or similar platforms. They've implemented Multi-Factor Authentication. Some have even deployed Single Sign-On (SSO) and Role-Based Access Control (RBAC).
That's all necessary. But it's not sufficient.
Here's the gap: traditional IAM is built around provisioning and authentication — making sure the right people can get in. ITDR is built around detection and response — catching bad actors who get in anyway.
Consider these attack scenarios that traditional IAM alone cannot reliably stop:
Scenario 1: Pass-the-Hash and Pass-the-Ticket Attacks
Attackers who compromise a single endpoint can extract credential hashes or Kerberos tickets from memory and use them to authenticate as legitimate users — without ever knowing the actual password. MFA doesn't help here because the authentication appears valid. ITDR systems detect the anomalous use of those credentials: wrong time, wrong device, wrong location, impossible travel.
Scenario 2: OAuth Token Abuse
Modern cloud environments rely heavily on OAuth tokens for application-to-application access. Attackers who steal a long-lived OAuth token can maintain persistent access to email, cloud storage, and SaaS applications — even after a user's password is reset. Traditional IAM won't catch this. ITDR monitors token usage patterns and flags anomalies.
Scenario 3: Insider Threat and Privilege Escalation
A disgruntled employee — or an attacker who has compromised a low-privilege account — begins enumerating Active Directory, querying sensitive databases, or silently escalating their own privileges. This behavior looks like normal work until it's too late. ITDR detects the behavioral shift and triggers an alert or automated response before serious damage is done.
Scenario 4: Adversary-in-the-Middle (AiTM) Phishing
AiTM attacks — where attackers proxy login sessions in real time to steal session cookies — bypassed traditional MFA in thousands of recorded incidents in 2025. Microsoft's Threat Intelligence team documented multiple large-scale AiTM campaigns targeting Microsoft 365 environments. ITDR can detect the anomalous session behavior that follows even when the authentication appeared legitimate.
The Five Core Capabilities of a Mature ITDR Program
If you're evaluating ITDR solutions — or asking your managed security provider whether this is in scope — here are the five capabilities that define a mature ITDR program.
1. Identity Posture Assessment
Before you can detect threats, you need to know the shape of your identity environment. A strong ITDR program continuously inventories:
- All user accounts, including service accounts and shared accounts
- Active privileges and entitlements across cloud, on-premises, and SaaS environments
- Misconfigured identity providers or directory settings (e.g., Kerberoastable service accounts, unconstrained delegation)
- Stale accounts that are still enabled but not actively used
- Non-human identities (service accounts, API keys, machine identities)
This is distinct from a one-time audit. ITDR systems continuously re-assess posture as environments change.
2. Behavioral Baselining and Anomaly Detection
ITDR platforms ingest authentication logs, access logs, and directory events and establish behavioral baselines for every identity — users, service accounts, and machine accounts. Deviations from that baseline trigger investigation.
This isn't simple rule-based alerting. Modern ITDR uses machine learning to build dynamic behavioral models that adjust as legitimate behavior evolves, while still catching genuine anomalies.
3. Attack Path Analysis
One of the most powerful ITDR capabilities is the ability to map attack paths — the chains of permissions, trust relationships, and misconfigurations that an attacker could exploit to move from a compromised entry point to your crown jewel assets.
Tools like BloodHound (used by both red teams and defenders) make these paths visible. ITDR platforms take this a step further by continuously updating attack path analysis as your environment changes.
4. Real-Time Detection and Automated Response
When an identity-based threat is detected, speed matters. ITDR platforms can trigger automated responses such as:
- Forcing re-authentication or step-up MFA
- Disabling a compromised account
- Revoking active sessions and tokens
- Isolating affected systems pending investigation
- Alerting SOC analysts for human review
The integration of ITDR with a 24x7 SOC — like the one Layer27 operates — is where real value is unlocked. Automated systems catch the event; human analysts validate context, determine scope, and drive containment. Neither alone is as effective as both working together.
5. Forensic Investigation and Response Playbooks
When an identity-based incident occurs, ITDR platforms provide the forensic trail needed to understand what happened: which accounts were touched, what data was accessed, what lateral movement occurred, and when. This is critical not just for containment, but for breach notification obligations under state privacy laws, HIPAA, PCI-DSS, and other compliance frameworks.
The Identity Attack Surface Is Larger Than You Think
Most business leaders think about identity security in terms of their employees' login credentials. But the modern identity attack surface is far broader.
Service accounts are among the most targeted identities in any environment. They often have excessive privileges, rarely rotate passwords, and are almost never monitored for anomalous behavior. In a typical mid-market IT environment, service accounts are outnumbered by human users — but represent a disproportionate share of breach pathways.
Cloud identities multiply the problem. Every SaaS application your business uses — your CRM, your HR platform, your project management tools, your cloud storage — creates identity relationships that may or may not be governed consistently. Shadow IT compounds this: employees onboard SaaS tools with personal accounts that IT never sees.
Third-party and contractor identities represent another gap. As we explored in previous posts on workforce identity lifecycle management and the invisible workforce, temporary and contract workers are often provisioned with access that outlasts their engagement — and their accounts are rarely reviewed as rigorously as full-time employees.
Federated identities in hybrid environments — where on-premises Active Directory federates with cloud identity providers — create complex trust relationships that attackers actively exploit. The SolarWinds attack, which remains one of the most sophisticated identity-based compromises in history, exploited federated trust relationships to pivot from on-premises environments into cloud tenants.
All of this is in scope for a mature ITDR program. None of it is adequately addressed by traditional IAM tooling alone.
How ITDR Fits Into a Layered Security Architecture
ITDR doesn't replace your existing IAM investment — it extends it. Here's how it fits into a defense-in-depth strategy:
IAM Layer (Entra ID, Okta, AD): Handles provisioning, authentication, and access control. The foundation.
PAM Layer (Privileged Access Management): Controls and vaults privileged credentials. Limits blast radius when accounts are compromised. (If you haven't addressed PAM, it should come before or alongside ITDR.)
ITDR Layer: Continuously monitors identity behavior, detects threats in motion, and drives automated or human-led response.
EDR/XDR Layer: Monitors endpoint behavior for malware, exploitation, and lateral movement at the device level.
MDR + SOC Layer: Human analysts who correlate signals across all of the above and drive coordinated incident response.
For organizations using Layer27's Managed Detection & Response (MDR) service, ITDR telemetry becomes a critical feed into the broader detection pipeline. Identity events — failed authentication spikes, impossible travel, privilege escalation attempts — are correlated with endpoint and network signals to build a complete picture of an attack in progress, not just a fragment of it.
Layer27's Protect Pro and Infrastructure Pro clients benefit from this layered approach, with identity monitoring integrated into their overall security posture management rather than treated as a standalone point solution.
Compliance Implications: Why Regulators Are Starting to Notice
ITDR isn't just a security best practice. It's increasingly becoming a compliance expectation.
HIPAA: The 2025 Security Rule update reinforced expectations around access monitoring and audit controls. Healthcare organizations that cannot demonstrate continuous monitoring of who accessed PHI — and can't detect anomalous access in near-real-time — are increasingly vulnerable during audits.
PCI-DSS 4.0: Requirement 10 mandates comprehensive logging and monitoring of all access to system components and cardholder data. ITDR platforms provide the behavioral intelligence layer that makes this monitoring meaningful rather than a checkbox exercise.
CMMC 2.0: Defense contractors handling Controlled Unclassified Information must implement access control, audit and accountability, and incident response capabilities that ITDR directly supports.
State Privacy Laws: As data breach notification obligations tighten across U.S. states, the ability to rapidly determine the scope of identity-based compromise — which accounts were affected, what data was accessible — directly impacts notification timelines and legal exposure.
Layer27's Compliance practice helps organizations map ITDR controls to their specific regulatory obligations, ensuring that the security investment also satisfies audit requirements.
What This Means for Your Active Directory Environment
For the overwhelming majority of U.S. businesses, Microsoft Active Directory or Entra ID sits at the heart of the identity infrastructure. That makes it the most valuable target for attackers — and the most critical environment to monitor.
A few specific Active Directory attack techniques that ITDR is designed to catch:
- DCSync attacks: Attackers simulate a domain controller to extract password hashes for any account in the directory
- Golden Ticket attacks: Forged Kerberos tickets that grant persistent, nearly invisible access to any resource in the domain
- AS-REP Roasting: Exploiting accounts that don't require Kerberos pre-authentication to capture crackable hashes offline
- AdminSDHolder abuse: Manipulating the AdminSDHolder object to maintain persistent elevated privileges even after apparent remediation
None of these generate obvious alerts in a default Active Directory configuration. All of them are detectable with ITDR tooling properly deployed and tuned.
Practical Steps: Where to Start With ITDR
If ITDR is new territory for your organization, here's a pragmatic roadmap to get started without boiling the ocean.
Step 1: Know What You Have
Before you can protect your identities, you need a complete inventory. Audit all accounts — human and non-human — across on-premises AD, cloud directories, and SaaS platforms. Flag stale accounts, excessive privileges, shared credentials, and service accounts with no documented owner.
Step 2: Clean Up the Foundation
Address the obvious misconfigurations before layering detection on top of them. Disable stale accounts. Enforce least-privilege access. Rotate service account credentials. Remove users from admin groups they don't need. This reduces your attack surface before you've spent a dollar on ITDR tooling.
Step 3: Enable Comprehensive Logging
ITDR is only as good as the data it ingests. Ensure that authentication events, directory changes, privilege assignments, and access logs are being collected — from on-premises AD, Entra ID, SaaS platforms, and cloud environments. Without comprehensive logging, detection is blind.
Step 4: Deploy Behavioral Analytics
Whether through a dedicated ITDR platform or through a SOC provider with identity security capabilities built in, deploy behavioral analytics that establish baselines for normal activity and alert on meaningful deviations. Start with your highest-privilege accounts.
Step 5: Build Response Playbooks
Know in advance what you will do when an identity threat is detected. Which accounts get disabled automatically? Who gets notified? What's the escalation path? Organizations using Layer27's Co-Managed IT model often develop these playbooks collaboratively — combining the client's institutional knowledge with Layer27's security expertise.
Step 6: Test Your Detection
Red team your identity controls. Simulate attacks like Pass-the-Hash, privilege escalation, and impossible travel. Verify that your ITDR tooling catches them. If your SOC doesn't see an alert, your attacker won't generate one either.
The Cost of Getting This Wrong
In 2025, the average cost of a data breach reached $4.88 million, according to IBM's annual Cost of a Data Breach Report — a record high. Identity-based breaches consistently rank among the most expensive, primarily because of the dwell time involved. When an attacker operates through a legitimate identity, they can remain undetected for weeks or months, dramatically expanding the scope of damage.
For small and mid-size businesses, a breach of this magnitude is existential. Many never fully recover. The organizations that do recover quickly are the ones that detected the attack early, contained it rapidly, and had the forensic evidence to understand exactly what was compromised.
ITDR is what makes early detection possible when the threat is wearing a legitimate identity.
Layer27 Can Help
Identity security is not a problem you can solve once and check off the list. It requires continuous visibility, continuous response, and continuous improvement — across an attack surface that is expanding every time you onboard a new employee, deploy a new application, or migrate a workload to the cloud.
Layer27's Managed Detection & Response (MDR) service includes identity threat detection as a core component of our detection pipeline, integrated with our 24x7 SOC for round-the-clock human analysis and response. Our Safe Start and Protect Pro programs help businesses build the identity security foundations — proper access controls, MFA, PAM, and behavioral monitoring — that make ITDR effective. And our Security Awareness Training ensures that your employees understand how their credentials are being targeted and what to watch for.
Whether you're starting from scratch or looking to mature a program already in progress, we can help you close the identity security gap before an attacker finds it.
Talk to a Layer27 advisor about identity threat detection and response →
Identity-based attacks are the defining threat vector of 2026. The businesses that recognize this early — and build detection capabilities to match — are the ones that will survive what's coming. Don't wait for the breach to make the case for you.