ITDR: detecting identity risks before an incident
Cybersecurity
Articles by Tomás Romão
ITDR helps organisations treat identity as a critical attack surface by combining visibility, detection and response across hybrid environments.
TL;DR
- Identity has become a central risk vector in hybrid environments.
- ITDR complements MFA, IAM and Zero Trust with continuous detection and response.
- The focus should include privileged accounts, non-human identities and suspicious sessions.
- Integration with SOC, SIEM and operations can reduce investigation time.
- Adoption should start with priority use cases, not with an isolated tool.
Why identity has moved to the centre of risk
For years, many organisations treated identity mainly as an authentication problem: directories, passwords, multifactor authentication and access management. These controls remain necessary, but they are no longer sufficient. In hybrid environments, with SaaS applications, public cloud, on-premises infrastructure, service accounts, API integrations and external users, identity has become a distributed attack surface that is difficult to observe.
What ITDR adds
Identity Threat Detection and Response, or ITDR, is the discipline focused on detecting, investigating and responding to identity-centric threats. It does not replace IAM, PAM, MFA or [Zero Trust](/en/solutions/zero-trust-ztna) policies; it complements them with continuous monitoring, behavioural analysis, event correlation and response capability. The aim is to identify signals such as anomalous privilege escalation, unusual credential use, suspicious account creation, token abuse or lateral movement through legitimate identities.
From prevention to operational detection
Prevention reduces the likelihood of compromise, but it does not cover every scenario. Credentials can be stolen, sessions can be hijacked and old permissions can remain active for too long. That is why ITDR should be connected to security operations: ingestion of logs from directories, cloud platforms, critical applications, EDR solutions, SIEM and orchestration tools. For organisations without permanent internal capacity, a [SOC/NOC as a Service](/en/solutions/soc-noc-as-a-service) model can help maintain continuous monitoring and structured triage.
Use cases worth prioritising
Adoption should start with the most likely and highest-impact risks. Dormant privileged accounts, administrators with weak authentication, service accounts with excessive permissions, application identities without secret rotation and persistent external access are strong candidates. It is also important to combine identity with context: location, device, application, time, access pattern and resource sensitivity. This approach is aligned with the logic described in [Zero Trust in practice](/en/blog/zero-trust-na-pratica-como-substituir-vpns-tradicionais): trusting the network less and relying more on verifiable context for each access.
Metrics and governance
ITDR should produce decisions, not just alerts. Useful metrics include time to detect credential abuse, time to revoke access, number of orphaned accounts removed, coverage of privileged accounts and volume of justified exceptions. These metrics should be reviewed by security, operations and application owners, because many responses require a balance between containment and service continuity. Alignment with [observability and AIOps](/en/blog/como-a-observability-e-o-aiops-ajudam-a-acelerar-a-resposta-a-incidentes) practices can also improve operational impact analysis.
Conclusion
ITDR makes a practical reality explicit: in many incidents, identity is the path for entry, persistence or escalation. The answer is not simply to buy another platform, but to map critical identities, reduce excessive privileges, collect relevant signals and define proportionate responses. For CIOs, CTOs and security leaders, the key question is straightforward: can we quickly understand when a legitimate identity is being used illegitimately?