Identity Threat Detection and Response (ITDR) is a security discipline that monitors identity activity in real time to detect, investigate and respond to the compromise and misuse of identities and credentials. It looks at behaviour, so it can spot an attacker who is using a valid account.

What does ITDR detect?

• Privileged account misuse.
• Lateral movement across systems.
• Insider threats.
• Credential theft and abuse, such as pass-the-hash and Kerberoasting.
• Privilege escalation and unexpected role changes.
• Abnormal behaviour after a legitimate login.

How does ITDR work?

1. Collect: gather identity activity from directories, cloud platforms and applications.
2. Baseline: learn what is normal for each identity, in its role.
3. Detect: flag deviations that may signal compromise or misuse.
4. Investigate: gather context on the identity, its privileges and related events.
5. Respond: contain the threat with a proportionate action and record what happened.

How is ITDR different from EDR, XDR and SIEM?

EDR watches endpoints. SIEM collects and correlates logs from many sources. XDR spans several domains. ITDR focuses on identity behaviour and the paths attackers take through identities, and it can work with the others by supplying the identity context they lack.

How is ITDR different from ISPM?

ISPM reduces exposure before an attack, and ITDR detects and responds during one. Posture findings tell detection where risk is highest, and detection shows posture what attackers actually go after.

Why does monitoring after login matter?

Authentication proves who is logging in, not what they do next. Many tools stop at the login event or at system logs. Seeing individual transactions and queries inside critical applications separates normal work from misuse, and gives investigators the detail they need.

What are the signs of identity compromise?

• Logins to systems or applications an account never uses.
• New members added to privileged groups.
• Bulk data access or exports that are new for that identity.
• Activity at unusual hours or from unusual locations.
• Sudden activity on dormant accounts.

What does response look like?

It should be proportionate. Options include asking for additional authentication, limiting the session, restricting privileges, ending the session or escalating to an analyst. High-impact actions need approval, and every step should be recorded for review.

What role does agentic AI play?

Investigating each alert by hand is slow. Agentic processes can collect context, compare behaviour with what is normal, judge the risk and take an approved action on their own, so investigation starts when the signal appears, within guardrails the team sets.

What does ITDR look like in practice?

A privileged account queries a critical application it has never used, from a new location, at night. ITDR flags the deviation, gathers the account’s privileges and recent activity, judges the risk, limits the session and records what happened, before data leaves.

How does ITDR support incident reporting?

NIS2, DORA and GDPR all expect timely reporting of incidents. ITDR helps scope an incident quickly by showing which accounts were involved and what they did.

What are the limits of ITDR?

It cannot remove weaknesses that already exist, it depends on good coverage and context, and it works from what is normal for each identity. That is why it works best together with posture management, which reduces what there is to detect.

What should you look for in an ITDR solution?

Coverage of on-premises, cloud and SaaS identities, depth after login, context that makes alerts explainable, response that can run autonomously and design that respects privacy and data protection.

Sharelock provides ITDR natively with identity security posture management, monitoring behaviour after login down to individual transactions and queries on critical applications.

‍