What Is Identity Threat Detection and Response (ITDR)?

As users, applications, and data spread across multiple cloud environments and remote workspaces, identity has become the de facto security control point.

ITDR is the runtime layer of the identity architecture. Directory services (e.g., Active Directory, Microsoft Entra ID, and Okta) are not static repositories of user information. They are living, high-value targets that attackers probe relentlessly. ITDR treats them that way, applying continuous behavioral analysis instead of a login gate check.

ITDR works in three connected stages: it collects identity telemetry to build a baseline of normal behavior, analyzes activity against that baseline to surface anomalies, and triggers automated responses to contain threats. Each stage feeds the next, turning raw authentication data into immediate containment.

Here’s how each stage works:

1. Telemetry collection: ITDR pulls logs from identity providers, single sign-on (SSO) tools, and directories such as Active Directory to build a complete record of authentication activity across the environment to use as a baseline of normal behavior.
2. Behavioral analysis: Machine learning models compare activity against the baseline and surface outliers such as a suspicious login from an unexpected location or a sudden escalation in account privileges.
3. Automated response: When ITDR confirms a genuine anomaly, it can initiate specific actions to counter the threat, such as forcing a password reset or terminating a suspicious session before an attacker gains further ground.

ITDR is important because attackers increasingly breach enterprise systems by logging in with stolen or misused credentials rather than breaking in. Once an attacker holds valid credentials, firewalls and VPNs treat that session as legitimate. ITDR closes that gap by detecting identity abuse after authentication, before it escalates into a breach:

Several factors drive the need for ITDR:

• Phishing scams: Deceptive emails mislead users into giving away login credentials or other sensitive account details.
• Open source attack tools: Freely available pentesting tools give attackers an easy way to compromise identities, cover their tracks, and move through an attack faster.
• Credential stuffing: Attackers test stolen usernames and passwords, often pulled from unrelated data breaches, against an organization’s systems until one combination works.
• Social engineering: Attackers impersonate trusted users or colleagues to manipulate victims into sharing credentials or granting access.
• Remote work: Employees connecting from home and personal devices make it harder for security teams to maintain full visibility and control over who is accessing what.
• Regulatory compliance: Industries such as healthcare and finance face strict data protection rules, and a failure to detect identity-based threats can result in significant fines and reputational damage.

Identity Is the New Attack Surface

Remote work and cloud migration have dissolved the walls that firewalls and VPNs were built to defend. Workforces now connect from countless locations and devices, and applications live in multiple clouds instead of a single data center. That shift dissolves the clean network boundary legacy tools depend on. It also leaves defenders blind:  70% of organizations report limited or no visibility into AI-enabled threats moving over VPN, according to the ThreatLabz 2026 VPN Risk Report.

Both firewalls and VPNs share a common blind spot: they monitor traffic crossing those boundaries and apply rules based on it. Neither can tell whether a request came from a legitimate user or an attacker holding that user’s credentials. Once the credentials are valid, both firewalls and VPNs let the session proceed as though nothing is wrong.

ThreatLabz research also found that 63% of users bypass VPN controls to reach apps faster.

Attackers now target identity management systems directly. These systems hold the permissions that reach nearly every resource in the environment, so compromising one can open a path to much of the application estate without raising a single endpoint alert.

Identity-based attacks have become increasingly complex and impactful with AI, which has given rise to faster, more elaborate ways to steal credentials and automate campaigns at scale.

Common attack types include:

• Credential harvesting: Attackers steal usernames and passwords through phishing, malware, or exposed databases. Successful credential harvesting allows a threat actor to log in as a legitimate user without sounding any alarms.
• Session hijacking: Instead of stealing a password, session hijacking tactics involve compromising an active session token that enables attackers to ride an already-authenticated session and bypass login checks entirely.
• AI-powered phishing infrastructure: The ThreatLabz 2026 Phishing and Initial Access Report found attackers using AI site builders, including DeepSite AI and BlackBox AI, to quickly produce convincing replicas of government portals.
• Password spraying: Attackers can test several common passwords against many user accounts at once to avoid the lockouts that a brute-force attempt on a single account would normally trigger.
• OAuth consent phishing: These campaigns deceive users into approving a malicious application through a legitimate login flow, giving attackers a persistent access token that doesn’t require a password and bypasses multifactor authentication (MFA) entirely.

AI-driven attacks have expanded threat actors’ ability to run harvesting campaigns automatically and turn a single compromised identity into a direct route to an organization’s most sensitive data. And without advanced cybersecurity measures, such as deception technology, attackers can hide inside an organization’s environment for days or weeks before detection.

ITDR protects non-human identities (NHIs) by monitoring machine credentials for unusual activity and applying the same automated response used for human accounts. This oversight matters because NHIs, such as service accounts, API keys, and AI agents, can’t complete standard MFA prompts and often carry broad, unmonitored privileges.

NHIs already vastly outnumber human users in most enterprise environments. A Cloud Security Alliance (CSA) whitepaper reports that NHIs outnumber human users by an average of 45:1. In cloud native environments, that ratio can reach 144:1.

That ratio is quickly expanding as organizations continue to onboard AI agents and adopt automated workflows. Despite this scale, these identities seldom receive the same scrutiny as human accounts, a gap that should concern every CISO.

ITDR closes this gap by extending behavioral baselining to machine identities. It flags anomalies such as a service account authenticating from an unexpected location or requesting privileges it has never used before. ITDR then triggers the same automated containment playbooks used for human accounts.

Effective ITDR relies on three connected capabilities: seeing risk before it’s exploited, catching attacks as they unfold, and shutting them down fast.

Posture Management and Attack Path Discovery

Posture management, formally known as identity security posture management (ISPM), forms the foundation ITDR builds on. ISPM starts with a complete inventory of identity assets, including human, machine, and service accounts, along with every permission attached to them. Without that visibility, security teams are defending ground they cannot see.

This ISPM inventory reveals weak security hygiene that often hides in plain sight.  Examples include stale accounts remaining active after their use expires, overprivileged users holding rights they do not need, and shared credentials passing from user to user without documentation. With clear visibility into those identities and permissions, security teams can close the gaps before an adversary finds them first.

The real value of ISPM comes through attack path mapping. It maps the routes an adversary could take from a low-privileged account to a domain administrator takeover. Identifying those routes early lets security teams close them before they are exploited.

Some organizations reinforce their ISPM further with deception technology, planting decoy credentials or fake privileged accounts directly along the routes ITDR uncovers. Since legitimate users have no reason to touch a decoy, any interaction with one signals an active attacker, giving security teams an early, high-confidence alert well before the intruder reaches a real target.

Real-Time Anomaly Detection and Threat Hunting

Strong ITDR also observes actual identity behavior in real time. User and entity behavior analytics (UEBA) builds a baseline of normal activity for each identity in the environment. This includes typical login times or common resources accessed during normal operation.

Using this baseline, ITDR can recognize complex identity-based attacks that go undetected by traditional legacy-based security measures. Examples include:

• Kerberoasting, which cracks Windows service account passwords offline
• Pass-the-Hash, which uses stolen credential hash values without requiring an adversary to obtain a valid password
• Golden Ticket, which generates forged authentication tickets to mimic any other user within an organization’s domain

ITDR also watches what happens after a successful login, so a security operations center (SOC) can spot lateral movement and rapid privilege escalation in the early stages of an attack.

Automated Containment and Response Playbooks

When ITDR identifies anomalous behavior, it triggers predefined playbooks that constrain the account until an analyst reviews it. Those playbooks can force a password reset, revoke active session tokens, or require additional multifactor authentication (MFA) before the account regains access.

The table below breaks down how specific detection signals map to attacker tactics and automated response actions.

ITDR does not replace existing security technologies. It sits between them, watching identity behavior in ways other defenses weren’t built to watch.

ITDR vs. Identity and Access Management (IAM)

IAM determines whether a given authentication attempt is granted access. ITDR follows up after that decision and monitors what an authenticated account does next, alerting security teams to any behavior a legitimate user would never exhibit.

ITDR vs. Endpoint Detection and Response (EDR)

EDR and ITDR watch different ground and cover more together than either does alone. If an attacker steals credentials from a compromised workstation, EDR pinpoints the local exploit by detecting the malware or suspicious process running on that device, while ITDR flags the account’s unusual authentication activity across the network.

Neither tool alone reveals the full scope of an attack; however, when combined, they create a comprehensive defense strategy from initial compromise to the lateral movement attempt.

Here’s a practical breakdown of how these cybersecurity disciplines differ.

ITDR unifies identity signals from every cloud and on-premises directory an organization uses into a single behavioral view. That view lets security teams spot an attacker pivoting between environments, activities that would otherwise appear as separate, unrelated events in each platform’s logs.

The challenge with hybrid and multicloud environments is that they disperse identities across multiple systems. An organization might run Active Directory on-premises while also relying on Entra ID, Okta, and separate identity controls inside AWS or Google Cloud. Each environment produces its own authentication logs. Without a unifying layer, security teams must work with fragmented visibility between platforms.

ITDR handles this unification by ingesting telemetry from the full stack of identity providers and cloud environments an organization uses, then correlating it into one continuous behavioral baseline. This enables ITDR to better identify an attacker who authenticates normally in one cloud but then pivots to a second environment using the same stolen credentials. This behavioral pattern could easily go undetected if each cloud were monitored in isolation.

Attackers move at speeds much faster than most security teams can react. Generative AI and modern bypass techniques have decreased the time between initial compromise and full domain takeover. This has reinforced the need to shift from manual response to continuous automated defense.

Emerging GenAI Attack Paths

AI has fundamentally altered the economics of social engineering. With generative AI, attackers create highly personalized phishing lures in seconds, using scraped data to mimic colleagues’ tone or reference real projects, making these messages much harder to spot than generic attempts of the past.

As non-human identities become more common, they also create a growing blind spot. Service accounts, API keys, and automation bots often run with standing privileges and no multifactor authentication because they can’t complete a login prompt like a human can. As a result, a compromised service account can provide an attacker with the same reach as a stolen human credential with less scrutiny applied to it.

The machine speed of these cyberattacks makes the case for automation. Zscaler ThreatLabz red teaming experts investigated enterprise AI systems and found critical vulnerabilities in every single one tested. The median time to achieve a critical compromise was just 16 minutes, and 90% of all systems were compromised within 90 minutes (ThreatLabz 2026 AI Security Report). Manual security processes simply can’t respond fast enough to these types of attacks.

Bypassing Multifactor Authentication

Attackers use MFA fatigue attacks by flooding a user with approval prompts until frustration or habit leads them to make a single wrong click. Additionally, reverse proxy phishing kits capture credentials and one-time codes in real time, relaying them to the legitimate login page before a session token is issued.

Session hijacking sidesteps MFA entirely. After a user authenticates, the browser holds a session cookie proving that login happened. Malware and phishing can steal that cookie, letting attackers ride the session straight into enterprise applications without ever facing an MFA prompt.

These techniques share a common weakness in traditional defenses. Each technique succeeds after the MFA gate has already opened. Active session validation closes that security gap by checking whether a session’s behavior still matches the user it claims to belong to. Continuous behavioral monitoring through ITDR catches what MFA can’t, flagging when a verified session starts acting like an intruder.

Getting full value from ITDR takes more than buying a solution. It takes shared visibility across teams and access policies that evaluate risk continuously.

1) Unify the SOC and Identity Teams

Remove the barriers between SOC and identity teams so both groups act on the same information in real time:

• Give SOC analysts real-time access to identity directory logs, so they can see what’s happening as it happens rather than wait for a report from another team.
• Integrate ITDR alerts into an extended detection and response (XDR) platform so identity signals correlate automatically with endpoint and network signals.
• Run ongoing security assessments of Active Directory and Entra ID to identify misconfigurations before an attacker does.

2) Enforce Continuous Zero Trust Access Policies

One-time login checks are no longer enough. Risk-based conditional access should evaluate every session continuously and adjust access as the risk profile changes.

Require phishing-resistant MFA, such as FIDO2 passkeys, for every administrative and privileged service account. Audit third-party partner permissions automatically across hybrid environments, since those accounts often keep broad access long after a project ends.

3) Reduce Standing Privileges Through Least-Privileged Access

Audit privileged accounts frequently and remove access from those who do not require it. Just-in-time privilege elevation provides administrative rights only while a specific task requires them and revokes access automatically once the window closes.

4) Run Attack Simulations

Run tabletop exercises and red-team simulations that model kerberoasting, session hijacking, and privilege escalation before a real incident does it first. Refine automated response actions with the results and confirm that SOC and identity teams can function together under pressure.

Zscaler Identity Protection gives security teams continuous visibility into authentication behavior, exposes hidden attack paths, and stops credential abuse before it leads to a breach. Built on the Zscaler Zero Trust Exchange™ platform, Zscaler ITDR correlates identity signals across the security stack to turn isolated alerts into automated actions.

To learn more, request a demo.