Identity threat detection and response is becoming central to secure access

At a glance

What this is: Imprivata argues that identity threat detection and response is moving from a supporting capability to a core control for secure access as credential abuse and access friction increase.

Why it matters: For IAM, PAM, and identity teams, the shift means access governance can no longer stop at authentication events and must extend into continuous risk evaluation across the access lifecycle.

By the numbers:

• 80% of breaches stem from compromised credentials, according to Verizon’s 2024 Data Breach Investigations Report cited by Imprivata.
• 90% of successful cyberattacks originate at endpoint devices, according to IBM’s Cost of a Data Breach Report cited by Imprivata.
• 70% of data breaches originate at endpoint devices, according to IBM’s Cost of a Data Breach Report cited by Imprivata.

Context

Identity threat detection and response, or ITDR, extends access security beyond the login event. Instead of treating authentication as the final control point, it looks for identity risk during and after access, including anomalous behaviour, compromised credentials, and misuse patterns that emerge once a session is active.

The access model in this article is under pressure from credential attacks, endpoint-originated compromise, and user friction that can trigger unsafe workarounds such as credential sharing. That makes ITDR relevant across IAM, PAM, and NHI governance because the control problem is not just who was allowed in, but whether the access path stays trustworthy over time.

Imprivata frames the issue as a move away from siloed tools toward integrated identity and access management. The practical question for security teams is whether their current access stack can continuously assess risk, or only verify identity at the front door.

Key questions

Q: How should security teams respond when access decisions are no longer safe to make only at login?

A: They should move to session-aware governance, where identity, device, and behavioural signals can change access decisions after authentication. That means integrating detection with IAM and PAM policy so risky sessions can be stepped up, constrained, or terminated before abuse spreads across business systems.

Q: Why do compromised credentials remain so effective in modern environments?

A: Compromised credentials remain effective because they produce legitimate-looking access. Many environments still trust the identity after the password, token, or session is accepted, even if the login originated from a risky device or abnormal context. That makes identity confidence a live security issue, especially when access is broad or long-lived.

Q: What are the signs that identity threat detection is failing in an enterprise environment?

A: Warning signs include breaches being identified by customers or external parties, long investigation windows with little internal evidence, and attackers remaining active for weeks without being detected. Another signal is when security teams rely on preventive tools alone and have no behavioral visibility into post-authentication activity. That leaves trusted identities effectively invisible once access is granted.

Q: When should organisations prioritise continuous identity over stricter login policies?

A: Organisations should prioritise continuous identity when active sessions, privileged automation, or long-lived machine access create more risk than a stronger initial login can address. If the threat is what happens after authentication, then login-only controls are misaligned. Continuous identity matters most where access can remain dangerous long after it was granted.

Technical breakdown

Why login controls are not enough

Traditional access controls validate identity at a point in time, then assume the session remains trustworthy. ITDR changes that model by adding behavioural and contextual telemetry around the session, so risk signals can be evaluated after authentication. That matters because compromised credentials do not disappear once a user is admitted, and endpoint-originated attacks often look legitimate at first. In practice, ITDR sits between authentication and response, correlating anomalies such as impossible travel, unusual access sequences, and device risk with the active identity context. It is a runtime layer, not a replacement for IAM.

Practical implication: treat login as the start of identity monitoring, not the end of it.

How identity risk detection supports passwordless access

Passwordless access reduces dependence on reusable secrets, but it does not remove the need to assess identity trust continuously. In a passwordless model, the assurance problem shifts toward device health, session behaviour, and the legitimacy of the access path rather than the password itself. ITDR can complement passwordless programmes by spotting when a trusted authentication event is followed by suspicious activity, credential sharing indicators, or access from compromised devices. The architectural point is simple: stronger initial authentication does not eliminate downstream identity abuse, so the detection layer must keep pace with the access layer.

Practical implication: pair passwordless rollouts with continuous risk evaluation, not a one-time assurance decision.

Why endpoint risk and identity risk are converging

The article links successful attacks and data breaches to endpoint devices, which is where identity compromise often becomes operational. Endpoint risk and identity risk are converging because the device is increasingly part of the trust decision, especially in hybrid work and mission-critical environments. When endpoint security, IAM, and response workflows stay siloed, security teams miss the moment where a valid identity starts behaving like a compromised one. ITDR is therefore as much about correlation as detection: connecting device signals, access behaviour, and identity policy into one response path.

Practical implication: integrate endpoint telemetry into identity response so access decisions can change when device trust changes.

Threat narrative

Attacker objective: The objective is to turn a valid access path into durable, low-friction abuse of business systems and data without triggering immediate challenge or containment.

1. Entry occurs through compromised credentials or risky endpoint activity that gives the attacker a legitimate-looking foothold into the access layer.
2. Escalation follows when the attacker reuses trusted access paths, shares credentials, or blends in with normal user behaviour to avoid immediate detection.
3. Impact arrives when identity misuse persists across the access lifecycle, enabling broader compromise, data exposure, or operational disruption before the session is contained.

Breaches seen in the wild

• Change Healthcare breach 2024: A stolen login on a Citrix portal without MFA led to ALPHV ransomware, a $22 million ransom and 192.7 million people affected.
• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity threat detection and response marks the point where access security becomes a lifecycle discipline. If access is only checked at login, the programme is blind to the period when identity abuse actually unfolds. ITDR changes the governance question from who authenticated to whether that identity remains trustworthy as conditions change, which is why it belongs in IAM, PAM, and NHI governance conversations alike.

Passwords are not the only problem, but they remain a governance proxy for weak identity trust. The article’s own evidence ties breach paths to compromised credentials and endpoint activity, which shows that authentication strength alone does not settle access risk. The deeper issue is that access models still over-trust the moment of entry and under-govern what happens after trust is granted.

Continuous identity intelligence is becoming the control plane for secure access. As environments get more distributed and adversaries automate faster, the market is moving toward access systems that can assess, respond, and adapt in real time. That does not replace IAM or PAM, but it does redefine them around runtime risk rather than static entitlement snapshots.

Identity threat detection and response closes the gap between detection and authorization. Traditional security tools can spot threats after the fact, but access governance needs decisions while the session is active. That makes ITDR a practical bridge between identity policy, behavioral telemetry, and remediation across the full access lifecycle.

Identity risk is now inseparable from user experience. The article correctly notes that friction can drive unsafe workarounds, which means access design must balance resistance to abuse with usability. In NHIMG terms, the access programme fails when it creates the very behaviours attackers exploit, so practitioner teams should treat trust, usability, and response as one governance problem.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Read next: Identity Threat Detection and Response (ITDR) Guide

What this signals

Access governance is shifting from entitlement snapshots to runtime trust decisions. Teams that still certify access only on a schedule will miss the identity drift that happens after authentication, especially when users, endpoints, and applications are all part of the trust calculation. Continuous identity threat detection gives the programme a way to react before a compromised session becomes a breach path.

Identity risk, device risk, and user friction are now one operational problem. When users resort to credential sharing or other workarounds, the programme has already lost part of its trust model. Security teams should watch for access journeys that create evasions, because those are usually the points where identity controls are easiest to bypass and hardest to recover.

For practitioners

• Map your access controls to the full identity lifecycle Identify where your environment still assumes authentication is the end of the control path. Rework those points so post-login behaviour, device trust, and anomalous access sequences can trigger response.
• Add session-level risk signals to IAM decisions Feed device health, access pattern anomalies, and contextual identity signals into the access stack so policy can respond while a session is active, not only at sign-in.
• Reduce friction that encourages credential sharing Review where login friction is pushing users toward workarounds that weaken identity assurance. Focus on access journeys that preserve usability without inviting shared credentials or bypass behaviour.
• Align passwordless rollout with continuous detection Treat passwordless as an authentication change, not a complete security outcome. Pair it with continuous identity threat detection so compromised devices or suspicious sessions are still visible.

Key takeaways

• Compromised credentials and endpoint-originated attacks remain central breach paths, which is why identity controls now have to work beyond the login event.
• ITDR matters because it adds behavioural and contextual response to access, not just stronger authentication at the front door.
• Security teams should pair passwordless access with continuous risk evaluation, or they will improve entry assurance while leaving session abuse under-governed.

Key terms

• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Continuous identity intelligence: Continuous identity intelligence is the ability to analyse access, entitlements, and abnormal behaviour in near real time instead of in scheduled batches. For identity teams, it is the difference between seeing risk when it emerges and discovering it only after the review cycle has already passed.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Session-Aware Governance: Session-aware governance is the practice of making access decisions during an active session, not only before entry. It matters because identity risk often emerges after authentication, so controls need to observe behaviour, assess trust changes, and trigger containment before abuse spreads.

Deepen your knowledge

NHI governance, identity lifecycle, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.