Topic starter
13/10/2026 1:21 pm
TL;DR: Stellar Cyber says identity security now has to answer what an identity is doing, not only whether it authenticated, because credential misuse led breaches in the 2025 Verizon DBIR and Gartner expects AI agents to halve exploitation time for exposed accounts by 2027. IAM still matters, but ITDR becomes the control that spots trusted identities behaving like attackers.
Editorial analysis by NHI Mgmt Group, based on content published by Stellar Cyber: “IAM Protects the Identity. ITDR Protects the Moment.”.
By the numbers:
- Credential misuse was the leading cause of security breaches cited from the 2025 Verizon DBIR, according to Stellar Cyber.
- More than 50% of surveyed organizations had experienced one or more cybersecurity incidents involving compromised machine identities, according to Gartner research cited by Stellar Cyber.
- By 2027, AI agents will automate credential theft and compromise authentication communication channels, reducing exploitation time for exposed accounts by 50%, according to Gartner research cited by Stellar Cyber.
Key questions
Q: How should security teams respond when a valid login may already be compromised?
A: They should move from access denial logic to live behavioural verification.
Q: Why do residual credentials increase breach risk even when MFA is used?
A: MFA protects interactive login, but it does not automatically invalidate every existing token, session, or delegated authorisation.
Q: How do you know if identity threat detection is actually working?
A: Look for shorter mean time to detect and mean time to respond, plus fewer incidents where suspicious sessions persist for hours.
Practitioner guidance
- Correlate identity telemetry with SecOps signals Fuse Active Directory, Entra ID or Okta events with endpoint, network and cloud telemetry so suspicious identity use is evaluated in attack context, not as isolated logins.
- Define behavioural baselines for privileged identities Baseline normal login source, geography, device and access patterns for users and service accounts, then alert on deviations that indicate post-authentication abuse.
- Route IAM-originated incidents into threat hunting Create a response path where suspicious identity activity automatically becomes a hunt or investigation queue item for the SOC rather than an IAM-only ticket.
Bottom line: The article argues that IAM and ITDR solve different parts of the same identity problem, with IAM controlling entry and ITDR watching for abuse after entry succeeds.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 1:22 pm
Identity trust now has a post-authentication failure mode: IAM still answers who should be allowed in, but it does not answer whether a valid identity has already been turned into an attacker-controlled session. That is why ITDR exists as a separate control layer. The practitioner implication is that access approval and behavioural trust are now distinct governance decisions.
A question worth separating out:
Q: What happens when IAM controls work but identity behaviour is still malicious?
A: The account enters, the attacker inherits trust and the security team sees legitimate access patterns until the behaviour drifts far enough to matter. At that point, the breach is already in motion. ITDR is the layer that reduces the time between compromise, recognition and response.
👉 Read our full editorial: ITDR changes identity security from trust to continuous verification