Detect identity compromisebefore domain-level damage.Real-time credential threat detection.
Detect credential abuse, privilege escalation, and lateral movement in real time across Active Directory, Entra ID, Okta, and cloud identity providers. Behavioural analytics surfaces compromised identities before attackers achieve their objectives.
Identity Threat Detection FAQs
Frequently asked
questions.
answered
ITDR is a security discipline focused on detecting and responding to attacks targeting identity infrastructure — credential theft, privilege escalation, and lateral movement via compromised accounts. As attackers increasingly target identity rather than endpoints, ITDR fills the detection gap that traditional endpoint and network tools leave in identity-based attack chains.
ITDR detects DCSync attacks, Kerberoasting, AS-REP roasting, Pass-the-Hash, Pass-the-Ticket, LDAP enumeration, BloodHound reconnaissance, and AD persistence techniques like AdminSDHolder modification and malicious GPO creation.
The ML model observes 30 days of user activity across login times, geographies, device profiles, resource access patterns, and privilege use. It then scores deviations across five dimensions — location, temporal, peer comparison, privilege delta, and access velocity — combining them into a single risk score updated every 15 minutes.
Golden Ticket attacks forge Kerberos tickets using the KRBTGT account hash. ITDR detects them through anomalous ticket characteristics — unusual encryption types, lifetimes exceeding domain policy, and authentication patterns inconsistent with the user's historical baseline.
ITDR generates identity-specific alerts integrating with your SIEM via standard connectors (Sentinel, Splunk, QRadar). SOAR integration enables automated response — account suspension, forced password reset, session termination — triggered automatically on high-confidence detections.