Identity Threat Detection & Response (ITDR)

ITDR stands for Identity Threat Detection and Response. It is a security category formalised by Gartner in 2022 to describe the discipline of monitoring identity infrastructure (including Active Directory, Azure AD (Entra ID), and SSO platforms) for signs of compromise, credential theft, and privilege abuse. ITDR extends beyond identity prevention (MFA, Conditional Access) to provide active detection and response: real-time monitoring, analyst-reviewed alerts, and containment actions when a threat is confirmed. Precursor's managed ITDR service satisfies the detection and response requirement: 24/7 SOC analyst coverage, documented response procedures, and post-incident reporting you can share with your underwriter or auditor.

Gartner first defined Identity Threat Detection and Response (ITDR) in 2022, identifying a critical gap in security architectures that focused heavily on identity governance and prevention (IAM, PAM, MFA) but lacked detection and response capability for identity-based attacks. Gartner positioned ITDR as a required layer in mature security programmes, noting that 80% of breaches involve compromised credentials. Gartner's ITDR framework covers three capability areas: identity threat intelligence, identity posture management, and identity-specific detection and response. Cyber insurers and auditors now reference the Gartner ITDR category when assessing whether an organisation has adequate identity security controls.

EDR (Endpoint Detection and Response) monitors endpoint behaviour: processes, file system changes, and network connections from devices. ITDR monitors identity infrastructure: sign-in logs, authentication events, permission changes, and account behaviour across Azure AD, Active Directory, and SaaS platforms. The two are complementary. EDR detects post-compromise activity on devices; ITDR detects the initial credential compromise and lateral movement through identity systems. Many attacks now bypass endpoint controls entirely by using stolen credentials. ITDR is specifically designed to catch this class of attack. Precursor provides both as part of a combined Managed SentinelOne EDR and ITDR service for clients who want closed-loop coverage across identity and endpoint.

Identity threat detection and response pricing ranges from £900 to £4,000+ per month depending on user count and identity sources. Small organisations (up to 250 users, single Azure AD tenant) average £900 to £1,500 per month including 24/7 monitoring and incident response. Mid-sized organisations (250 to 1,000 users, hybrid AD environment) typically cost £2,000 to £3,000 per month. Large enterprises (1,000+ users, multiple tenants, on-prem AD forests) typically cost £3,500 to £4,000+ per month. All pricing includes Azure AD/Entra ID integration, on-premise AD (if required), impossible travel detection, MFA bypass monitoring, and privileged account surveillance. We provide fixed monthly quotes after a scoping call to understand your identity infrastructure.

Azure AD Identity Protection generates alerts. It does not investigate them, and it does not watch them at 3am. Specifically: it only monitors Microsoft's cloud ecosystem and misses attacks that pivot through on-premise AD, third-party SaaS, or VPN; it cannot correlate identity events with endpoint or network telemetry to detect multi-stage attacks; MFA fatigue attacks and sophisticated credential phishing often bypass Identity Protection's automated risk scoring; and out-of-hours attacks will not be investigated until your team returns on Monday morning. Cyber insurers and auditors now distinguish between Azure AD P2 (prevention) and ITDR (detection and response). Azure AD P2 satisfies the former. Without 24/7 analyst triage, it does not satisfy the latter. Most organisations use Identity Protection as a telemetry source and outsource 24/7 monitoring to a specialist SOC.

Yes. MFA push notifications are not phishing-resistant. An attacker who has obtained a user's password will send MFA push requests repeatedly, often at 10pm or 11pm, until the user approves one to make the notifications stop. The average time from first push to user approval in a fatigue attack is under four minutes when the user is tired. Our ITDR monitoring detects MFA fatigue attacks by tracking anomalous MFA request volumes per user: more than three push requests within ten minutes from a new or anomalous IP triggers an analyst review. If the user then approves, session containment can be initiated before the attacker completes their objective. We also monitor for legacy authentication protocol bypass (IMAP, POP3, SMTP AUTH) that circumvents MFA entirely for accounts enrolled in modern auth. MFA is necessary. It is not sufficient without detection.

Yes. We monitor both cloud identity providers (Azure AD, Okta) and on-premise Active Directory. For on-prem AD, we ingest Windows Event Logs (4624, 4625, 4768, 4769, 4776) to detect pass-the-hash, Golden Ticket attacks, DC replication abuse, and lateral movement through the domain. On-prem AD monitoring is included in standard pricing, not an add-on. If you are concerned about your Active Directory security posture before onboarding monitoring, our Active Directory security assessment provides a full attacker-perspective review of your domain configuration.

Our SOC analyst immediately alerts your designated contacts and, with your pre-authorisation, can execute containment actions: revoking all active sessions, forcing password reset, disabling the account, and blocking sign-ins from suspicious locations. We then provide forensic analysis showing the attacker's access window, what data or systems were reached, and what persistence mechanisms were created (device registrations, OAuth consents, forwarding rules). The post-incident report is formatted for use with your cyber insurer or auditor.