Identity threat detection and response monitors Active Directory, Entra ID and other identity systems for attacks such as credential theft, privilege escalation and suspicious sign-ins.
My pickCrowdStrike Falcon Identity ProtectionCrowdStrike Falcon Identity Protection adds identity threat detection to the Falcon endpoint platform.
Some ITDR tools are add-ons to an EDR platform, while others specialize in hardening and recovering Active Directory. Compare how well each covers on-premises AD versus cloud identity, and whether it can block attacks rather than just alert on them.
Why it works
Once attackers have valid credentials, they look like employees. ITDR spots the misuse of identities that endpoint tools miss.
What to look for
It should cover both on-premises AD and cloud identity.
It should detect attacks such as Kerberoasting and DCSync.
It should report on identity hygiene, such as stale admin accounts and weak configurations.
Products I track for Identity Threat Detection and Response (ITDR)