Topic starter
24/06/2026 7:29 pm
TL;DR: ISPM and ITDR solved real enterprise identity problems, but they struggled because most large organisations lacked complete, reliable identity inventories across AD, cloud, SaaS, and service accounts, according to Hydden. The core lesson is that posture and detection cannot fix fragmented ground truth, because incomplete identity data turns better analytics into better wrong answers.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “Why ISPM and ITDR Never Scaled”.
Key questions
Q: What breaks when identity tools are split across visibility, posture, and detection?
A: The response chain breaks.
Q: Why do posture findings often turn into backlog instead of remediation?
A: Because the tool surfaces issues across multiple domains, but the authority to fix them remains split across directory, cloud, SaaS, and application teams.
Q: How do security teams decide whether ITDR is working?
A: ITDR is working when responders can move from alert to containment without a long investigative detour.
Practitioner guidance
- Define a single identity estate inventory Consolidate AD, cloud, SaaS, privileged accounts, and service principals into one continuously reconciled view before relying on posture or detection outputs.
- Assign remediation owners by identity domain Map every posture finding to the team that can actually change it, such as directory, cloud, SaaS, or application owners, before governance review starts.
- Measure detection coverage against unknown accounts Test whether behavioural baselines exist for every privileged identity, including short-lived automation accounts and direct cloud roles, not only for integrated systems.
Bottom line: ISPM and ITDR were useful responses to real identity risk, but their effectiveness depended on a complete identity inventory that most enterprises did not have.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:47 am
Identity posture and identity threat detection fail when the inventory layer is not trustworthy: ISPM and ITDR were built to expose misconfiguration and suspicious authentication behaviour, but both depend on the same upstream truth about what identities exist. When that truth is fragmented across AD, cloud, SaaS, and service accounts, the tools can only analyse partial reality. The practical consequence is not simply lower visibility. It is a governance model that starts reporting on the wrong denominator and then treats those outputs as operational fact.
A question worth separating out:
Q: Should organisations prioritise identity inventory before posture and detection?
A: Yes. A continuously reconciled identity inventory is the control that makes posture scoring and behavioural detection trustworthy. If the inventory is incomplete, both categories can still be useful, but they will produce partial and sometimes misleading outputs that are hard to operationalise at scale.
👉 Read our full editorial: ISPM and ITDR exposed the limits of fragmented identity governance