ITDR changes identity security from trust to continuous verification

At a glance

What this is: This article argues that identity security now needs ITDR because valid authentication no longer proves safe behaviour, especially when compromised human and machine identities can be abused after access is granted.

Why it matters: IAM, PAM and SOC teams need shared visibility into post-login behaviour because identity compromise is now an attack phase, not just an access-control problem, across human, machine and increasingly autonomous identity flows.

By the numbers:

• Credential misuse was the leading cause of security breaches cited from the 2025 Verizon DBIR, according to Stellar Cyber.
• More than 50% of surveyed organizations had experienced one or more cybersecurity incidents involving compromised machine identities, according to Gartner research cited by Stellar Cyber.
• By 2027, AI agents will automate credential theft and compromise authentication communication channels, reducing exploitation time for exposed accounts by 50%, according to Gartner research cited by Stellar Cyber.
• Collaboration between IAM and cybersecurity functions led to a 30% improvement in achieving IAM goals, according to Gartner's 2024 IAM Leadership Survey cited by Stellar Cyber.

Context

Identity Threat Detection and Response, or ITDR, addresses a governance gap that traditional IAM leaves open after authentication succeeds. IAM still decides whether an identity should be allowed in, but it does not answer whether that identity is now behaving like an attacker once access is granted. That distinction matters for human users, service accounts and machine identities alike.

The article frames identity as part of the active attack path rather than a static trust decision. For security teams, that means post-login telemetry, anomalous behaviour and SOC correlation become part of identity governance instead of separate detection problems.

The operating assumption behind many identity programmes is that successful authentication means the hardest decision has already been made. This article says that assumption is now incomplete because legitimate credentials can be the attacker’s entry point and the identity itself can become the threat signal.

Key questions

Q: How should security teams respond when a valid login may already be compromised?

A: They should move from access denial logic to live behavioural verification. Once authentication succeeds, the control question becomes whether the identity is acting within its normal pattern across endpoint, network and cloud activity. That requires SOC integration, not just IAM enforcement, because the abuse happens after the trust decision.

Q: Why do residual credentials increase breach risk even when MFA is used?

A: MFA protects interactive login, but it does not automatically invalidate every existing token, session, or delegated authorisation. If those artefacts remain active after the owner has left or the project has ended, attackers can inherit legitimate access without triggering a fresh MFA challenge. That is why token and session lifecycle matters.

Q: How do you know if identity threat detection is actually working?

A: Look for shorter mean time to detect and mean time to respond, plus fewer incidents where suspicious sessions persist for hours. Successful programmes also show accurate correlation between behavioural anomalies and real misuse, not just alert volume. If detection cannot trigger containment before damage spreads, the programme is still mostly observational.

Q: What happens when IAM controls work but identity behaviour is still malicious?

A: The account enters, the attacker inherits trust and the security team sees legitimate access patterns until the behaviour drifts far enough to matter. At that point, the breach is already in motion. ITDR is the layer that reduces the time between compromise, recognition and response.

Technical breakdown

Why valid authentication is no longer a security boundary

Traditional IAM is built around pre-access decisions: proof of identity, policy evaluation and privilege assignment. ITDR adds a different layer because compromise often happens after those checks succeed. The moment a user, service account or machine identity starts acting outside its normal behavioural envelope, the issue is no longer authorisation alone. Behavioural anomalies such as impossible travel, unfamiliar source locations, lateral movement and unusual privilege use can indicate that the account is valid but the actor is not. In practice, this means the control objective shifts from preventing all access to detecting trust misuse fast enough to limit blast radius.

Practical implication: Treat successful authentication as the start of monitoring, not the end of it.

How identity telemetry becomes attack-context telemetry

ITDR only works when identity events are correlated with endpoint, network and cloud signals. A login by itself is rarely conclusive, but a login plus an unusual device, a suspicious ASN, a change in login geography or concurrent cloud activity can reveal abuse that IAM alone would miss. The technical value comes from stitching identity context into broader SecOps workflows so analysts can separate legitimate user movement from adversary movement. That is especially important when the same identity can touch SaaS, cloud and internal systems in a short time window. Without correlation, identity alerts remain isolated notifications instead of investigation evidence.

Practical implication: Correlate identity events with endpoint and cloud telemetry before analysts triage them.

Why machine identity compromise needs behavioural detection

Machine identities create a different monitoring problem because they often authenticate successfully by design and then perform repetitive, legitimate-looking tasks. A compromised service account may not trigger classic IAM controls, but it can still be abused for privilege escalation, cloud access or data movement. Gartner’s cited research points to compromised machine identities as a recurring incident pattern, which is why static entitlement reviews are not enough. The technical challenge is not merely inventorying non-human identities but watching for behavioural drift, unexpected access paths and changes in usage pattern that signal abuse of an otherwise valid identity.

Practical implication: Baseline normal machine identity behaviour and alert on drift, not just entitlement changes.

Threat narrative

Attacker objective: The attacker wants to convert a trusted identity into a working post-authentication foothold that can be used for broader compromise without triggering access-denial controls.

1. Entry begins when an attacker obtains or misuses valid credentials and authenticates successfully through normal identity controls.
2. Escalation follows when the trusted identity is used for unusual login patterns, lateral movement or access to cloud and endpoint resources that do not fit its normal profile.
3. Impact occurs when the identity is used to reach data, privileged systems or downstream services before defenders can contain the abuse.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity trust now has a post-authentication failure mode: IAM still answers who should be allowed in, but it does not answer whether a valid identity has already been turned into an attacker-controlled session. That is why ITDR exists as a separate control layer. The practitioner implication is that access approval and behavioural trust are now distinct governance decisions.

Credential misuse is the new identity blast-radius driver: When attackers no longer need to break authentication, the key control variable becomes how quickly suspicious identity behaviour is detected and contained. The article correctly links that shift to compromised human and machine identities. Security programmes should therefore measure response speed after login, not only prevention rates at the gate.

Machine identities collapse the usefulness of purely static reviews: Service accounts and other machine identities can be valid, authenticated and yet actively abused without any obvious permission change. That means periodic recertification alone cannot expose runtime misuse. Practitioners need behavioural visibility over the identity lifecycle, not only entitlement snapshots.

Trust assumes the identity is the actor; ITDR assumes the actor may have changed: The operating premise of traditional IAM is that the credential holder and the legitimate subject are the same. That assumption fails when stolen credentials, token abuse or session hijacking let an attacker inherit trust. The implication is not just more telemetry, but a redefinition of when identity trust is considered complete.

Identity and SOC operations must converge around live attack context: Identity events that never reach threat hunting or incident response remain partial signals. This article shows why IAM, SecOps and threat intelligence need a shared workflow around suspicious identity activity. The practitioner implication is that identity is no longer a separate operational domain when it is part of the attack chain.

What this signals

Identity security is moving from gatekeeping to runtime verification: programmes that stop at authentication are now blind to the attack phase that starts immediately after access is granted. Teams should expect identity telemetry to become a live SecOps input rather than an IAM-only record.

Identity blast radius depends on how fast abuse is recognised: once valid credentials are in play, the decisive control is how quickly the organisation can distinguish normal use from adversary use. That makes identity visibility a containment function, not just an audit function.

For practitioners

• Correlate identity telemetry with SecOps signals Fuse Active Directory, Entra ID or Okta events with endpoint, network and cloud telemetry so suspicious identity use is evaluated in attack context, not as isolated logins.
• Define behavioural baselines for privileged identities Baseline normal login source, geography, device and access patterns for users and service accounts, then alert on deviations that indicate post-authentication abuse.
• Route IAM-originated incidents into threat hunting Create a response path where suspicious identity activity automatically becomes a hunt or investigation queue item for the SOC rather than an IAM-only ticket.
• Separate prevention metrics from detection metrics Track whether identities are approved correctly and, separately, how fast the team spots abuse after access is granted, because those are different control outcomes.

Key takeaways

• The article argues that IAM and ITDR solve different parts of the same identity problem, with IAM controlling entry and ITDR watching for abuse after entry succeeds.
• Credential misuse and compromised machine identities show that valid access is now a common attack path, not a sign that the risk has passed.
• The practical shift is to correlate identity telemetry with broader SecOps data so suspicious behaviour can be detected and contained before it spreads.

Key terms

• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Post-authentication misuse: Post-authentication misuse is abuse that happens after a login, session or token has already been accepted as valid. The identity appears legitimate to the system, which is why behavioural signals and cross-domain correlation are needed to identify the attacker behind the access.
• Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.
• Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.