What is Identity Threat Detection and Response (ITDR) and Why We're Excited.
Most of the attacks we respond to these days do not start with malware. They start with a login. Someone gets a password through a convincing email, buys stolen credentials online, or tricks an employee into approving a multi-factor prompt at the wrong moment. Once an attacker is signed in as a real person, your firewall waves them through, your antivirus sees nothing unusual, and they look exactly like a normal user going about a normal day.
That gap is what Identity Threat Detection and Response, or ITDR, was built to close. At ACT Systems, we have spent the past few months putting it through its paces in our own environment, and honestly, it has changed how confident we feel about the part of security that has been hardest to watch. We’re so excited about the results that we are now making it a formal part of what we offer our clients.
What ITDR Actually Does
Think of ITDR as a security guard who knows your staff by habit, not just by badge. It continuously watches the identity systems that sit at the center of your business, usually Microsoft Entra ID or Active Directory, and it learns what normal looks like for each account. Where people usually sign in from. What times they usually work. Which applications they usually touch. Which admin actions are routine and which are rare.
When something breaks that pattern, ITDR notices and acts. A finance account signing in from another country at 3 a.m., a sudden burst of failed logins followed by a success, a brand new mailbox rule that forwards every message to an outside address, an ordinary user account that just granted itself administrator rights. These are the quiet moves attackers make in the hours before they do real damage, and they are exactly the moves that used to slip past us until it was too late.
Why It Matters For Your Business
The value here is time. In most identity-based breaches, there is a window between the first suspicious login and the moment the attacker locks you out of your own systems or drains an account. That window is often measured in hours. ITDR shrinks your response time inside that window from whenever someone happens to notice to within minutes, automatically, at any hour.
It also covers a blind spot that traditional tools were never designed for. Endpoint protection guards devices. Email filtering guards the inbox. Neither is really watching the identity itself, and identity is now the front door to your email, your files, your finance systems, and your line-of-business applications all at once. Protecting the door protects everything behind it.
There is a compliance benefit too. Cyber insurance applications and frameworks are increasingly asking whether you monitor for identity compromise and privileged account misuse. ITDR gives you a clear, documented yes.
How We Are Deploying It
Our rollout is straightforward, and it does not disrupt anyone’s workday.
We connect ITDR to your identity provider in read-and-respond mode and let it observe for a short baseline period.
We tune the response rules with you, deciding which situations trigger an alert to our team and which ones automatically disable an account on the spot.
We integrate the alerts into our monitoring so a real person reviews anything the system flags, day or night.
We review the findings with you each month so you can see what was caught and why.
Your team will not notice anything different unless their account does something genuinely unusual, in which case a quick identity check is a small price to pay to stop a breach.
A Good Security Reminder
ITDR is a strong safety net, but the fundamentals still carry most of the weight. Please keep using multi-factor authentication on every account that offers it, be skeptical of any message that pushes you to log in or approve a prompt in a hurry, and tell us right away if you ever approve an authentication request you did not expect. That last one takes thirty seconds and has saved companies from very bad weeks.
If you would like to talk through what ITDR would look like for your business, or you want to see a demonstration of what it catches, reach out any time. We are glad to help.
Comments