ITDR is dead because identity risk is broader than a category

At a glance

What this is: This is a commentary on why ITDR is better understood as a practice than a product category, and why identity risk now spans far beyond traditional user accounts.

Why it matters: It matters because IAM, PAM, NHI and security teams need to detect compromise across a distributed identity estate, not only inside generic SOC telemetry.

Context

ITDR started as a way to improve detection of identity abuse, but the underlying security gap was always broader than one acronym. Modern identity estates now combine human users, service accounts, APIs, applications and AI agents, which means the control problem is lifecycle visibility across all identity types, not a single product label.

The practical issue is not whether SIEM or XDR can see identity signals. The issue is whether security teams can interpret stateful identity context, including entitlements, delegation paths and access changes over time, fast enough to spot abuse before it becomes lateral movement or persistence.

Key questions

Q: How should teams handle identity detection when accounts, workloads and agents all coexist?

A: Teams should treat identity detection as a governed lifecycle problem, not a user-only monitoring task. The practical shift is to combine access context, delegation history and authentication telemetry so compromise can be assessed across human and non-human identities with different behaviours and privilege patterns.

Q: Why do generic SIEM and XDR workflows miss identity compromise so often?

A: Because identity is stateful. A signal only becomes meaningful when it is interpreted against entitlements, ownership, trust relationships and recent access changes, and generic telemetry platforms rarely maintain that full context by default.

Q: What breaks when identity security is split into too many categories?

A: Ownership becomes fragmented, controls become inconsistent, and attackers move through whichever identity type has the weakest governance. The organisation ends up with multiple partial views of the same access fabric instead of one operating model for identity risk.

Q: Should organisations prioritise lifecycle governance over another identity acronym?

A: Yes. Lifecycle governance gives teams a stable way to manage who or what has access, how that access changes, and when it should end. Acronyms may describe tool classes, but lifecycle control is what determines whether identity risk is actually contained.

Technical breakdown

Why ITDR depends on identity state, not just telemetry

Identity security decisions are stateful because an event only matters when it is interpreted against the subject’s privileges, history, and trust relationships. A login from a known device may be benign for one account and high risk for another if the entitlements differ or the identity should not be active at that time. Generic detection stacks can ingest the signal, but they do not inherently maintain the identity model needed to decide what the signal means. That is why identity threat detection is a practice spanning telemetry, context, and response rather than a standalone category.

Practical implication: Treat identity context as a first-class data model in detection engineering, not as an enrichment afterthought.

Why category boundaries fail across human and non-human identities

The article’s core point is that the attack surface is now mixed. Human users, service accounts, application credentials, and AI agents all participate in the same access fabric, but they behave differently and fail differently. Human compromise often begins with phishing or credential theft, while NHI compromise more often comes from overprivilege, delegated access, or poor lifecycle control. A single category cannot capture these differences cleanly, and attackers exploit whichever identity type gives them the easiest route into the environment.

Practical implication: Build governance and detection by identity type, then unify the response model across the estate.

How distributed identity fabrics change the detection problem

The shift from a single directory to a distributed identity fabric changes the control plane. Access now spans on-prem directories, cloud identity providers, SaaS applications, APIs and machine identities, so compromise can occur in one layer and manifest in another. That creates blind spots when configuration, entitlements and telemetry are fragmented across teams and tools. In practice, the gap is not just visibility. It is the inability to correlate how access was granted, where it was reused, and whether the identity still carries active privilege.

Practical implication: Correlate entitlements, delegation and authentication events across cloud and on-prem identity systems before you rely on alerting alone.

NHI Mgmt Group analysis

ITDR is not dying because the problem disappeared; it is dying because the category never matched the operating reality. The article is right to separate the practice from the product label. Identity compromise is now an estate-wide condition that cuts across users, workloads, applications and agents, so the useful unit of analysis is the governed identity lifecycle, not the acronym.

Identity risk is now a cross-actor governance problem. Human IAM, NHI governance and emerging agentic AI controls are converging on the same operational question: who or what can act, under what authority, and for how long. That convergence makes fragmented tooling taxonomies less useful than a single governance model that can distinguish actor type without splitting the programme into silos.

Stateful identity context is the real detection substrate. Alerts that do not know the entitlement baseline, delegation path or lifecycle state of the identity they describe will keep producing weak signal. The field needs to treat identity context as infrastructure, because compromise detection fails when access history is invisible or disconnected from telemetry.

Category sprawl is a symptom of unresolved identity lifecycle governance. ITDR, ISPM, NHI management, PAM and IVIP each solve part of the problem, but none of them removes the need for ownership, inventory, entitlement review and offboarding discipline across all identity types. The practitioner takeaway is to govern the lifecycle first and let tools map to that operating model, not the other way around.

What this signals

Identity risk now behaves like an estate problem, not a category problem: teams need one governance model that can describe human users, service accounts, applications and AI agents without forcing all of them into the same operational assumptions. That shift changes how access reviews, detection logic and offboarding are designed.

The practical signal for programmes is that the control boundary has moved from the directory to the full identity lifecycle. If entitlement state, delegation and ownership are not correlated, detection tools will keep seeing events without understanding authority.

Security leaders should expect more overlap between ITDR, NHI governance and agentic AI identity work. The programme that wins will be the one that can unify those views without pretending they are the same actor type.

For practitioners

• Map identity coverage by actor type Inventory where your environment relies on human users, service accounts, API credentials, applications and AI agents, then document which team owns each identity class. The goal is to expose where detection logic assumes a single user-centric model that no longer fits the environment.
• Correlate entitlement state with telemetry Join authentication events to entitlement, delegation and provisioning data so alerts can be evaluated against the access the identity actually had at the time. Without that correlation, generic detections will miss the difference between normal use and abuse.
• Review offboarding across non-human identities Check whether service accounts, API keys and application credentials have the same lifecycle rigor as human accounts, including ownership, expiry and revocation. Category language often hides the fact that stale machine access remains active long after the business need has ended.
• Consolidate identity governance assumptions Use your identity security programme to define which controls are universal, which are actor-specific, and which are merely product-specific labels. That separation helps teams avoid buying around the problem instead of governing it.

Key takeaways

• Identity risk now extends across human and non-human actors, so a narrow ITDR category no longer describes the real control problem.
• The article’s central warning is that telemetry without entitlement context will keep missing identity abuse even when security tools are already deployed.
• Teams should govern the full identity lifecycle and use that model to organise detection, ownership and offboarding across all identity types.

Key terms

• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Identity lifecycle automation: The orchestration of joiner, mover, and leaver events so access is granted, adjusted, and removed without manual gaps. For mixed identity estates, it matters because revocation and review must keep pace with identities that do not follow human employment timelines.
• Distributed Identity Fabric: A distributed identity fabric is an architectural layer that unifies access policy across several identity sources while leaving the underlying systems in place. It is used to reduce complexity in hybrid and multi-cloud environments, where consistent enforcement matters more than centralizing every identity into one platform.
• Stateful Identity Data: Stateful identity data is a point-in-time view of accounts, groups, permissions, and policies. It is useful for inventory and baseline checks, but it does not show whether those identities are being used, abused, or exposed between review cycles.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.