ITDR is dead because identity risk is broader than a category

At a glance

What this is: A critique of ITDR category thinking that argues identity security now spans human, machine, and agentic identities across the full lifecycle.

Why it matters: IAM teams need a broader control model because attackers now exploit identity state, entitlement context, and delegated access across both human and non-human programmes.

👉 Read Widefield Security’s analysis of why ITDR no longer fits modern identity risk

Context

ITDR is increasingly a shorthand for a deeper governance problem: identity now behaves like a distributed control plane rather than a single authentication layer. In modern environments, access decisions are shaped by stateful entitlements, federated trust, and delegated permissions across humans, service accounts, applications, and AI agents. That makes identity compromise harder to detect with generic telemetry alone.

The article argues that the industry’s category habit has obscured the real issue. Security teams do not need another acronym so much as a way to reason about identity behaviour across the full lifecycle, from provisioning to privilege use to offboarding. For IAM leaders, the practical question is whether current controls can still model identity context once the environment becomes hybrid, cloud-connected, and machine-heavy.

Key questions

Q: How should security teams detect identity compromise across cloud and SaaS environments?

A: They should correlate authentication events with entitlement state, privilege history, and lifecycle changes across every identity store in use. The goal is to identify whether access was expected, newly granted, or left behind after offboarding. Without that context, identity detections are easy to miss and hard to trust.

Q: Why do directory logs alone fail to catch many identity attacks?

A: Directory logs show activity, but they do not explain whether the identity still had valid access, whether the permissions were excessive, or whether the same identity existed in multiple systems. Attackers exploit that gap by moving through federated and delegated paths that are invisible in a single log source.

Q: What do security teams get wrong about ITDR programs?

A: They often treat ITDR as a category purchase instead of an operating model. That leads to narrow detections, weak context, and fragmented ownership. Effective programmes define identity visibility, response, and governance as one continuous process across humans, workloads, and machine identities.

Q: When should organisations reevaluate identity threat detection coverage?

A: They should reevaluate it whenever identity architecture changes, especially when they add federation, new SaaS applications, workload identities, or AI-driven access paths. Each change creates new identity state and new places where privilege can be hidden, stale, or abused.

Technical breakdown

Why ITDR became a practice, not a product category

ITDR emerged because defenders needed identity-focused detections layered onto existing telemetry platforms such as SIEM and XDR. The underlying assumption was that identity events could be correlated like any other security signal. That works only when the organisation can reconstruct identity state, privilege context, and access history at detection time. In reality, identity behavior is stateful and distributed, so a login event without entitlement context is often ambiguous. Practical implication: detection logic must incorporate identity context, not just alert volume.

Practical implication: build detections that join identity state, privilege context, and access history before triage.

Hybrid identity fabric and the collapse of directory-centric monitoring

Identity is no longer anchored to a single directory. It now spans on-prem directories, cloud identity providers, SaaS applications, APIs, workload identities, and AI-driven access flows. That shift breaks any monitoring model that assumes identity signals live in one control plane. Directory logs alone cannot explain lateral movement, delegated access abuse, or non-human identity misuse because the attack path crosses systems. Practical implication: monitor identity as a federated fabric, not as isolated authentication systems.

Practical implication: correlate identity signals across directories, SaaS, cloud, and workload systems.

Identity threat detection across human and non-human identities

The article’s strongest point is that attackers treat all identities as exploitable access paths. A user account, service account, API key, connected application, or AI agent can each become the entry point, depending on where privileges are excessive or poorly governed. That is why identity threat detection must account for lifecycle state, standing privilege, and delegated access patterns, not just suspicious sign-in behaviour. Practical implication: define detection coverage by identity type and privilege model, then test each path separately.

Practical implication: separate detection coverage by identity type, privilege model, and lifecycle state.

Threat narrative

Attacker objective: The attacker aims to turn legitimate identity state into broad access that can evade generic detection and enable lateral movement or exfiltration.

1. Entry occurs through compromised credentials, delegated permissions, or another identity-based access path rather than a traditional exploit.
2. Escalation follows when the attacker uses stateful identity context to move from a valid login or token to broader privilege abuse.
3. Impact lands when the adversary uses that access to move laterally, persist, or operate inside cloud, SaaS, or machine identity workflows.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ITDR was never a product category because identity detection is inseparable from identity governance. The article is right to reject the idea that a standalone tool can solve identity compromise in isolation. Once identity spans humans, workloads, SaaS, and AI agents, detection depends on lifecycle state, entitlement visibility, and privilege context. The practitioner conclusion is that identity security must be governed as a programme, not purchased as a label.

Stateful identity context is the real control plane, and generic telemetry cannot replace it. A suspicious event only becomes meaningful when defenders know whether the identity had standing privilege, how access was granted, and whether the access still should have existed. That is the hidden failure mode behind many identity incidents. The practitioner conclusion is that correlation without governance context is operational noise.

Distributed identity fabric is the better named concept than “ITDR” for this problem space. That phrase captures the article’s core insight: identity now operates across multiple trust boundaries, not inside a single directory or console. It also aligns with how attackers work, because they exploit whichever identity surface is weakest. The practitioner conclusion is to design controls around the fabric, not around one detection category.

Human IAM and NHI governance are converging on the same failure pattern: invisible privilege state. Whether the identity is a person, service account, or agent, the breach path usually starts when entitlement state is opaque and review cycles lag behind real usage. The article’s broader value is that it ties identity threat detection to lifecycle governance across actor types. The practitioner conclusion is to stop separating “user” and “machine” risk models too early.

Identity security is maturing into an architecture problem, not an acronym problem. The market will keep minting new labels, but the operational requirement is consistent: unify identity visibility, access governance, and response across all identity classes. The practitioner conclusion is to evaluate controls by coverage and context, not by category name.

From our research:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which is why identity detection often starts with incomplete state rather than complete governance context.
• If your programme needs a lifecycle lens as well as detection, the NHI Lifecycle Management Guide shows how provisioning, rotation, and offboarding shape identity risk.

What this signals

Distributed identity fabric: the article’s framing is a reminder that identity security now depends on joining access, lifecycle, and telemetry across cloud and SaaS boundaries. Teams that still treat directory logs as the centre of gravity will keep missing identity abuse that happens in delegated or federated systems.

With 96% of organisations storing secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, the detection problem is no longer limited to sign-ins. Security teams should expect identity compromise to begin in places where governance is weakest, then propagate into systems that look well monitored.

The right response is to align identity threat detection with lifecycle controls and Zero Trust assumptions, not to keep adding labels. For a practical governance baseline, the Ultimate Guide to NHIs remains the clearest starting point.

For practitioners

• Map identity telemetry to lifecycle state Join sign-in events, entitlement data, and privilege history before you write detections so analysts can tell whether access was expected, stale, or abused.
• Extend detection coverage beyond directories Include SaaS, cloud, API, workload, and agent access signals in the same triage workflow so attackers cannot hide behind cross-platform identity fragmentation.
• Separate controls by identity type Build distinct control expectations for human accounts, service accounts, and AI-driven identities because each has different privilege patterns, review cadence, and failure modes.
• Treat identity review as a governance input Use access review, offboarding, and privilege certification results to tune detections, not as a parallel compliance exercise detached from response operations.

Key takeaways

• ITDR becomes less useful as a label once identity spans humans, workloads, SaaS, APIs, and AI-driven access paths.
• The real failure mode is missing identity context, because alerts without lifecycle and entitlement state are too weak to prove compromise.
• Security teams should measure coverage across the full identity fabric and treat governance data as part of detection, not an afterthought.

Key terms

• Identity threat detection and response: A security practice focused on spotting and responding to identity abuse across accounts, permissions, and authentication flows. It works best when detections are joined to entitlement state, lifecycle events, and privilege history, because identity compromise is usually a state problem as much as a sign-in problem.
• Identity fabric: The combined set of directories, cloud identity providers, SaaS permissions, workload identities, and delegated access paths that define how identity works in an enterprise. It matters because identity state is distributed, so a single log source rarely gives a complete picture of risk or misuse.
• Standing privilege: Privilege that remains continuously available instead of being granted only when needed. In identity security, standing privilege creates a wider attack window and makes abuse easier to hide, especially when governance and review cycles lag behind actual access use.
• Lifecycle state: The current governance condition of an identity, including whether it is active, properly provisioned, reviewed, rotated, or offboarded. For security teams, lifecycle state is essential because access that exists on paper but not in governance records is often where attackers find the easiest path.

What's in the full article

Widefield Security's full article covers the operational detail this post intentionally leaves for the source:

• The article’s fuller explanation of why Gartner framed ITDR as a practice rather than a standalone tool category
• Additional context on how SIEM, XDR, and other telemetry platforms are expected to feed identity detections
• The article’s broader discussion of AI agents and machine identities as part of the modern identity attack surface
• The author’s concluding argument about why unified identity security matters more than any single acronym

👉 Widefield Security’s full article expands on the category history, detection model, and identity landscape shift.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or identity governance in your organisation, it is worth exploring.