Is Identity Threat Detection Already a Gap in Your Security Stack?

Most mid-market security teams already have a SIEM, EDR, and SOAR in place. On paper, that looks like complete coverage.

Then an attacker signs in with a valid credential.

Instead of exploiting a vulnerability, they’re using stolen credentials from a phishing campaign or an infostealer. The login is legitimate, the endpoint looks normal, and nothing immediately appears malicious.

That’s the gap. A mature security stack doesn’t automatically mean identity is protected.

This article explains what identity threat detection and response (ITDR) is, why identity attacks slip past traditional tools, and how to determine whether your security stack has an identity gap.

What is Identity Threat Detection and Response (ITDR)?

Identity threat detection and response is a security discipline focused on detecting and responding to attacks that misuse identities and credentials rather than deploying malware.

In practical terms, ITDR watches the signals that reveal an account is being used by someone it should not be:

• Login behavior, including sign-ins from unexpected locations, at unusual hours, or from infrastructure associated with attackers
• Session tokens, and whether an active session is being used from somewhere it did not originate
• OAuth grants, meaning third-party applications a user has authorized to access their account data
• Inbox rules, particularly new rules that auto-forward, delete, or hide messages
• Permission and privilege changes, such as an account suddenly gaining administrative rights

The important distinction is that ITDR is a detection-and-response discipline, not a prevention control. It does not stop someone from logging in. It recognizes when the person logging in should not be there, and acts.

ITDR Is Not Just Another Acronym

It would be reasonable to assume ITDR is a rebrand of identity and access management (IAM), or a new label for multi-factor authentication (MFA). It is neither.

IAM and MFA govern who is permitted access. They are the lock on the door, and they do that job well. What they do not do is notice when someone walks through that door holding a key they stole.

ITDR covers exactly what those tools leave open: detecting and responding once a valid credential is already being misused. The credential is real. The authentication succeeded. Something still needs to be watching what happens next.

Why Identity Has Become the New Perimeter

The shift is structural. When applications, email, and file storage all lived inside a network you controlled, the network edge was a meaningful boundary. That boundary is gone. Cloud platforms, SaaS applications, and distributed workforces mean the credential is now the entry point, and it works from anywhere.

Attackers have adjusted faster than most defenses. Microsoft reported a 32% surge in identity-based attacks in the first half of 2025, and found that more than 97% of identity attacks are password attacks, according to its Digital Defense Report 2025.

That figure reflects a simple economic calculation on the attacker’s side. Writing malware that evades modern endpoint detection is difficult. Buying a working credential is cheap.

3 Most Common Identity-Based Attacks

Identity attacks take several forms, but three account for the majority of what organizations actually encounter. Each one shares a defining trait: the attacker uses legitimate access, so there is no malicious file for traditional tools to catch.

1. Credential Theft

The most direct version. Attackers obtain valid usernames and passwords through breach data, phishing pages, or infostealer malware running on a personal device, then simply log in as the user.

There is no break-in to detect. No exploit fires, no payload deploys, no endpoint agent sees anything unusual, because from the system’s perspective nothing unusual happened. An authorized user authenticated successfully. That absence of a technical event is precisely what allows credential theft to slip past endpoint tooling.

2. Session Hijacking

More sophisticated, and more troubling for teams that consider MFA a solved problem.

When you authenticate, the system issues a session token, the credential that keeps you logged in so you are not disrupted on every click. If an attacker steals that token, through an adversary-in-the-middle phishing page or malware on the device, they can ride an already-authenticated session.

Here is the part worth sitting with: a stolen session token bypasses MFA entirely, because the user already passed MFA. The token is proof that authentication succeeded. Presenting it does not trigger another challenge.

“We have MFA” is not the same statement as “we would detect a takeover.” The first is a prevention control. The second requires someone watching what an authenticated session actually does.

3. Business Email Compromise (BEC)

Once inside an account, attackers rarely announce themselves. They read. They learn how the organization communicates, who approves payments, which vendors send invoices, and how those conversations normally sound.

Then they act as the user. They redirect payments, alter invoice details, request wire transfers from finance, or set inbox rules that quietly hide the replies that would expose them. BEC consistently ranks among the costliest identity-based attacks organizations face, and it typically requires no malware at all.

Why a Full SIEM + EDR + SOAR Stack Still Misses Identity

This is the part that surprises well-resourced teams. The problem is not that any individual tool is failing. It is that each one covers a different layer, and none of them owns identity detection and response.

EDR watches endpoints, not cloud identities. Your endpoint platform is monitoring device behavior. When an attacker signs into Microsoft 365 from their own machine using stolen credentials, no managed endpoint is involved in the attack at all. The activity happens somewhere your EDR does not look.

SIEM collects logs but needs someone to build the detections. Your SIEM is very likely ingesting the identity logs already. That is not the same as detecting anything. Someone has to write the correlation rules, tune them against your organization’s normal behavior, maintain them as that behavior changes, and monitor the output around the clock. Ingestion is not detection.

SOAR automates response, but only for the playbooks it has. Automation executes the workflows you have defined. It cannot respond to a scenario nobody anticipated and encoded.

The result is a gap that is structural rather than technical. Identity misuse looks like legitimate access, so it does not clearly belong to any one tool’s domain, and it slips between them. Nothing in the stack is broken. It is simply that no single component owns the problem, and unowned problems do not get solved.

The Blind Spot Between IAM and Your SOC

Framed another way, there is a specific space in most architectures where nobody is standing.

On one side sits IAM and MFA, controlling who gets access. On the other sits your SOC, investigating and responding to detected threats. Between them is the moment a valid credential is being misused, after access has been granted but before anything has been detected.

IAM considers its work finished at authentication. The SOC cannot act on what was never surfaced. ITDR fills the space between “access granted” and “someone is actually watching for misuse.”

5 Signs Identity Is a Gap in Your Stack

A quick self-assessment. If several of these are true, identity is likely uncovered in your environment:

1. No monitoring of Microsoft 365 or Google Workspace login anomalies. Nobody is alerted when a sign-in occurs from an unexpected country, at an unusual hour, or from suspicious infrastructure. If this is your situation, securing cloud identities is the layer that is missing.
2. No alerting on suspicious inbox rules or OAuth grants. These are among the most reliable indicators of account takeover and among the least commonly monitored.
3. No defined response when an account is taken over. If your answer to “what happens when an account is compromised at 2am” is improvised, you do not have a response capability.
4. Reliance on MFA alone. MFA is essential and insufficient. Session hijacking and MFA fatigue attacks both defeat it.
5. Identity alerts landing in a SIEM nobody triages 24/7. An alert that no one reads before Monday morning is not stopping the threat. It is a record of what happened while nobody was watching.

What to Look for in an ITDR Approach

If identity is a gap, the next question is what actually closes it. These are the criteria that matter most when evaluating a threat detection and response provider.

Coverage Across Your Actual Identity Platforms

Confirm the provider covers where your identities genuinely live: Microsoft 365, Google Workspace, and authentication tools like Cisco Duo. Coverage limited to a single platform leaves the same gap in a different location.

Real Response, Not Just Alerts

Ask precisely what happens when a compromised account is detected. Does the provider suspend the account, terminate active sessions, and force a credential reset? Or does it notify you and wait? The difference determines whether you have detection or actual response.

Human Oversight

Identity signals are contextual. An executive logging in from abroad might be traveling or might be an attacker, and the distinction frequently requires judgment rather than a rule. Confirm that experienced analysts review and act on detections, and that you can reach one during an incident.

Low Noise

Identity monitoring that floods your team with false positives will be tuned down, then ignored, then effectively switched off. Ask about false positive rates and how detections are validated before they reach you.

Consolidation Rather Than Another Silo

This is the criterion most often overlooked, and the one that matters most for a team already managing SIEM, EDR, and SOAR.

Identity detection that shares context with endpoint and cloud telemetry beats a standalone identity silo, and it is not a close comparison. A compromised credential used to access a workstation, which then reaches toward a file server, is a single attack chain. Split across three disconnected tools, it looks like three unremarkable events. Correlated on one platform, it is obviously an intrusion.

Adding a standalone ITDR product to an already-crowded stack means another console, another integration, another alert queue, and another vendor relationship. More tools also mean more seams for attackers to hide in, and more fatigue for a team that is already stretched.

How Blackpoint Closes the Identity Gap Through Consolidation

Blackpoint delivers detection and response to identities with ITDR inside the CompassOne platform, alongside endpoint, and network coverage on a single console. Identity signals are cross-correlated with everything else rather than sitting in isolation, so an attack chain that crosses layers is visible as one event instead of several disconnected ones.

The newer capability here is Blackpoint’s AI SOC Agent for ITDR, launched in July 2026. It contains credential-based attacks in under two minutes on average, and as fast as 21 seconds, backed by the 24/7 human-led SOC. When a compromised account is confirmed, the response is automatic: the account is suspended, active sessions are terminated, a password reset is forced, and a human analyst is notified and available.

Measured against the timeline of an actual BEC incident, where an attacker may need only minutes to establish inbox rules and begin redirecting payments, that speed is the difference between a password reset and a breach notification.

To state it plainly: this replaces the blind spot with coverage on a platform you already run. It is not one more standalone tool to manage.

You Don’t Need Another Tool. You Need Identity Covered.

The fix for the identity gap is not a fifth dashboard bolted onto SIEM, EDR, and SOAR. It is identity detection and response unified with the endpoint and cloud coverage you already have, watched by a SOC that acts rather than notifies.

If your stack looks complete but you are not confident identity is genuinely covered, see what that looks like on one platform.

See how Blackpoint delivers ITDR on one platform →