What Is ITDR? Identity Threat Detection & Response Explained

Attackers log in more often than they break in. In fact, Verizon’s 2025 Data Breach Investigations Report ranked credential misuse as the leading cause of breaches.

For tools built to find malware, that’s a problem. A stolen password produces no file to scan and no exploit to block. The attacker signs in, and the activity looks like an employee doing their job. Identity threat detection and response (ITDR) is the security layer built to catch and contain that activity.

This blog covers what ITDR is, why it matters, the attacks it detects, how it works, how it compares to IAM, EDR, MDR, and SIEM, and why MSPs need it.

What Is ITDR (Identity Threat Detection & Response)?

ITDR stands for identity threat detection and response. It is a security capability that detects, investigates, and responds to attacks targeting identities, credentials, accounts, and identity infrastructure.

Why Identity Is Now the Primary Attack Target

Credentials are faster and quieter than malware. Cloud adoption has also made identity the control plane for email, files, and finances, so whoever holds a valid login holds a lot.

Attackers Log In Instead of Breaking In

Stolen credentials give an attacker access that looks legitimate. There is no malware and no file to flag. A compromised identity can pass for a normal user, which is why traditional tools often have nothing to alert on.

Cloud Makes Identity the Control Plane

In Microsoft 365 and Google Workspace environments, one login can open email, files, applications, and administrative functions. That makes identity the most valuable thing to compromise.

Speed Leaves Little Room to React

CrowdStrike’s 2026 Global Threat Report puts average attacker breakout time, from initial access to lateral movement, at 29 minutes. Once an attacker has a working login, minutes are enough. An alert waiting in a queue gives them time they should not have.

Prevention Alone Leaves a Gap

MFA, strong passwords, and conditional access reduce risk, but they do not make an account untouchable. A compromised account or a stolen session can still be abused after login, so identity activity needs monitoring after authentication and not only at the point of sign-in.

What Identity-Based Attacks Does ITDR Detect?

ITDR focuses on the techniques attackers use once they hold, or are trying to hold, a legitimate identity.

Account Takeover & Credential Misuse

Attackers use phished or leaked logins to take over legitimate accounts. Detection focuses on how credentials are used, not only on whether they were stolen, because a valid password used from the wrong place at the wrong time is the signal.

Session Hijacking & MFA Bypass

An attacker who steals an active session arrives with MFA already satisfied. Adversary-in-the-middle attacks work this way, and they make post-login monitoring necessary.

Suspicious Sign-In Behavior

Impossible travel, unusual access hours, new devices or locations, and sign-ins from known malicious infrastructure are all signals that an account is being used by someone other than its owner.

Privilege Escalation

After compromising an identity, attackers work to increase their access. Suspicious privilege assignments or role changes are often the first visible sign.

Business Email Compromise

A compromised identity leads to inbox rule changes, forwarding rules, executive impersonation, and payment redirection. The FBI’s IC3 reported $2.77 billion in business email compromise losses in 2024.

Identity-Based Lateral Movement

Attackers use compromised accounts and their permissions to move between systems, applications, and cloud resources. Blackpoint has written about how to catch lateral movement before it spreads.

How Does ITDR Work?

ITDR runs in five steps.

1. Collect Identity Signals

ITDR gathers sign-in, session, privilege, and activity data from identity platforms such as Microsoft 365 and Google Workspace.

2. Establish Normal Behavior

Each identity is compared against its own baseline: usual locations, devices, applications, access times, and resource use.

3. Detect Suspicious Activity

Detection looks for deviations from that baseline, not only for known-bad indicators. An account that has never touched a finance application suddenly doing so is worth a look even if nothing about the login is on a threat list.

4. Contain the Threat

Response means suspending the account, forcing a password reset, and cutting active sessions. Speed matters here because a hijacked session is live from the moment the attacker uses it.

Response capabilities vary by provider and service model, so it is worth asking exactly what a solution does on its own and what it hands to a person.

5. Investigate & Report

Every action should leave a clear record of what triggered it and what was done, for the MSP and for its clients. Correlating identity activity with endpoint and cloud signals shows the full attack path, including how the attacker got in and what they touched.

ITDR vs. IAM, EDR, MDR, & SIEM

ITDR complements these tools. It does not replace any of them.

ITDR vs. IAM

IAM manages identities, authentication, and access. ITDR detects when those identities or access mechanisms are being abused.

ITDR vs. EDR

EDR monitors endpoint activity, and ITDR monitors identity and access activity. Identity attacks often leave no obvious endpoint indicators, so combining the two gives stronger context than either provides alone.

ITDR vs. MDR

MDR is a broader managed service for detection, investigation, and response. ITDR covers identity threats within that service, and it works best as part of an MDR strategy, not as an alternative to one. SIEM, for its part, collects and analyzes log data and does not by itself contain identity threats.

Why Do MSPs Need ITDR?

If your clients use Microsoft 365 or Google Workspace, identity is where their risk lives.

Client Identities Live in the Cloud

Email, files, and financial systems sit behind a login. One compromised account reaches a lot of them.

One Account Can Become Many Problems

A single hijacked session can lead to business email compromise, payment fraud, and movement into other environments. Each of those is a client incident that lands on the MSP.

Clients Expect Response, Not Just Alerts

An alert sitting in a queue does not protect a client. Containment in minutes is the standard MSPs are measured against, and it also supports cyber insurance and compliance requirements.

What Should You Look for in an ITDR Solution?

Focus on the capabilities that decide whether a solution can catch and stop an identity attack, not on the length of its feature list.

Identity & Cloud Visibility

The solution should see across identity providers, cloud environments, applications, and authentication activity, and connect that activity with other security telemetry.

Behavioral Detection

Simple rules and known indicators are not enough on their own. The solution should identify activity that deviates from normal user or account behavior.

Investigation & Context

The solution should connect identity events with endpoint, cloud, and other security signals. Context is what separates a real compromise from an employee traveling for work.

Identity-Level Response

Detection without response leaves the work to the MSP. Look for the ability to disable accounts, revoke sessions, force credential resets, and remove unauthorized access.

Continuous Monitoring

Identity threats do not keep business hours. Monitoring should run continuously, with human analysts available to investigate significant threats.

Blackpoint ITDR: Identity Defense Built for MSPs

Blackpoint’s identity threat detection and response (ITDR) protects Microsoft 365 and Google Workspace, backed by a 24/7 human-led SOC. It also covers Cisco Duo, with SOC analysts covering the full identity surface. It runs on standard Microsoft 365 licensing, with no E5 or Entra ID P2 required.

ITDR is a native capability inside the CompassOne platform, which brings identity, endpoint, and cloud signals together so analysts see more than the login. Our Cloud MDR service provides the monitoring and response around it.

The AI SOC Agent acts only on high-confidence credential threats. When its confidence threshold is met, it suspends the account, forces a password reset, cuts active sessions, logs a full summary, and notifies the SOC. Anything below the threshold routes to a human analyst along with the model’s reasoning.

The model was trained on more than a decade of SOC data and validated against analyst judgment before autonomous action was enabled.

Blackpoint’s SOC data shows an average containment time of under two minutes for compromised Microsoft 365 and Google Workspace accounts, and as little as 21 seconds for credential-related threats. Across the Blackpoint customer base in 2025, the SOC disrupted a compromised cloud account every 18 minutes on average.

Detect Identity Threats Before They Become Bigger Incidents

Controlling access is one part of identity security. Organizations also need to know when a legitimate identity is being abused. ITDR watches how identities behave so threats are contained while they are still active.

For MSPs, the goal is to catch and contain a compromised identity in minutes, before the client finds out through a fraudulent payment.

See ITDR in Action

See how a stolen session gets caught and contained while the attacker is still logged in. ITDR runs inside the CompassOne platform, so the same view includes the endpoint and cloud context around the identity.

Request a Demo →