Topic starter
25/06/2026 3:16 pm
TL;DR: Identity Threat Detection and Response, or ITDR, is positioned as a real-time layer for spotting identity abuse after authentication, especially where over 90% of breaches now involve compromised credentials, according to Permiso Security. The practical shift is that zero trust and governance controls must be paired with continuous identity behaviour monitoring, not just stronger sign-in controls.
Editorial analysis by NHI Mgmt Group, based on content published by Permiso Security: “15 Questions Everyone Asks About Identity Threat Detection and Response(ITDR)”.
By the numbers:
- With over 90% of breaches now involving compromised credentials, organizations are forced to treat identity monitoring as a runtime control rather than a login-only check.
Key questions
Q: What breaks in zero trust when identity behaviour is not monitored after login?
A: Zero trust loses its runtime assurance.
Q: Why do compromised credentials create such a large breach risk in identity-led environments?
A: Because a stolen credential often appears legitimate to downstream systems, which means the attacker can blend into normal access flows.
Q: What signals indicate that a service account has been abused?
A: Interactive logons, unfamiliar source hosts, atypical time-of-day use, and sudden access bursts are the most useful signals.
Practitioner guidance
- Baseline post-authentication behaviour Define normal access patterns for human users, service accounts, and cloud identities so deviations can be detected as identity abuse rather than generic anomalies.
- Correlate identity events across platforms Feed Active Directory, cloud IAM, PAM, and SIEM telemetry into one detection path so a privilege change, unusual login, and resource access can be evaluated together.
- Prioritise service account monitoring Flag interactive logons, new resource paths, and unusual timings for service accounts, because those behaviours often indicate a compromise of a non-human identity.
Bottom line: ITDR matters because authenticated identities can still become attack paths, especially in environments where zero trust stops at sign-in and governance checks run on a slower cadence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:41 pm
ITDR is the runtime layer zero trust was missing. Zero trust is strongest at authentication, but authentication alone does not govern what a valid identity does next. That gap matters because modern intrusions increasingly use legitimate identities rather than broken perimeter controls. Practitioners should treat ITDR as the control that extends identity verification into the live session.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Compromised credentials take an average of 246 days to identify and contain, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should organisations combine ITDR with PAM and SIEM?
A: Use PAM to govern privileged access, SIEM to centralise and correlate logs, and ITDR to spot identity abuse in real time. The three controls solve different problems. PAM limits who can act, SIEM stores and correlates evidence, and ITDR detects when a trusted identity starts behaving like an attacker.
👉 Read our full editorial: Identity threat detection and response is reshaping zero trust