Notifications
Clear all
Topic starter
25/06/2026 3:16 pm
TL;DR: Identity Threat Detection and Response, or ITDR, is positioned as a real-time layer for spotting identity abuse after authentication, especially where over 90% of breaches now involve compromised credentials, according to Permiso Security. The practical shift is that zero trust and governance controls must be paired with continuous identity behaviour monitoring, not just stronger sign-in controls.
NHIMG editorial — based on content published by Permiso Security: 15 Questions Everyone Asks About Identity Threat Detection and Response (ITDR)
By the numbers:
- With over 90% of breaches now involving compromised credentials, organizations are scrambling to understand how to protect their identity infrastructure.
Questions worth separating out
Q: How should security teams use ITDR alongside PAM and IGA?
A: Security teams should use PAM and IGA to reduce identity exposure, then use ITDR to detect misuse that still occurs.
Q: Why do service accounts need separate ITDR baselines?
A: Service accounts need separate baselines because they are expected to behave predictably and usually lack human-like patterns such as working hours, interactive logins, or varied application use.
Q: What breaks when identity monitoring does not span cloud and on-premises systems?
A: When monitoring stops at environment boundaries, attackers can pivot through trusted identity relationships without triggering a clear alert.
Practitioner guidance
- Baseline identity behaviour across critical account types Build separate behavioural profiles for human users, privileged admins, service accounts, and machine identities.
- Integrate ITDR into SIEM and SOAR response paths Route high-confidence identity detections into automated actions such as session revocation, account suspension, and step-up authentication, while sending lower-confidence events to analyst review with enriched identity context.
- Prioritise service account and orphaned identity coverage Inventory non-human identities, identify owners, and compare active accounts against actual application and workload dependencies.
What's in the full article
Permiso Security's full blog post covers the operational detail this post intentionally leaves for the source:
- A full comparison of ITDR, EDR, XDR, PAM, and IGA with concrete use cases for each control class.
- Detailed integration patterns for SIEM and SOAR, including response actions such as session revocation and account suspension.
- Expanded guidance on behavioural analytics, UEBA signals, and identity baselines across AD, Azure AD, and cloud IAM.
- Practical selection criteria for choosing an ITDR platform and designing an incident response workflow around it.
👉 Read Permiso Security's guidance on identity threat detection and response →
ITDR in zero trust: what IAM teams need to know?
Explore further
25/06/2026 4:41 pm
Identity telemetry is now a control plane, not a logging accessory. ITDR matters because identity abuse is often indistinguishable from normal access at the perimeter. Once credentials are valid, the decisive evidence shifts to behaviour, privilege transitions, and cross-system correlation. Security teams that still treat identity logs as after-the-fact audit material are missing the operational use case. The implication is that identity telemetry must be governed as an active detection layer.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to The 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
A question worth separating out:
Q: Who is accountable when ITDR blocks or suspends identity access?
A: Accountability sits with the identity owners, platform teams, and security operations functions that define policy, thresholds, and exception handling. The more automated the response, the more important it becomes to document ownership, approval logic, and recovery steps. Without that governance, response actions create operational risk instead of reducing it.
👉 Read our full editorial: Identity threat detection and response is reshaping zero trust
