Identity Threat Detection & Response (ITDR)
What is Identity Threat Detection & Response?
Identity Threat Detection & Response (ITDR) helps protect your organization from cyberattacks that target user accounts, credentials, and identities. ITDR continuously monitors for signs of identity compromise, including suspicious sign-ins, unusual authentication activity, and attempted account takeovers. By identifying identity-based threats early, organizations can respond to compromised accounts faster and prevent attackers from using legitimate credentials to gain or expand access across the network.
Frequently Asked Questions
What does ITDR protect against?
ITDR helps protect against identity-based cyber threats such as stolen credentials, compromised user accounts, suspicious login attempts, account takeovers, and unauthorized access.
How does ITDR detect a compromised identity?
ITDR monitors identity and authentication activity for behaviors that may indicate an account has been compromised. This can include suspicious sign-ins, unusual login patterns, unexpected authentication attempts, and other activity that differs from normal user behavior.
Why is identity security important?
Attackers do not always need to hack their way into a network. If they obtain legitimate credentials, they may be able to sign in as an authorized user. Identity security helps organizations detect when trusted accounts or credentials are being misused.
What is a suspicious sign-in?
A suspicious sign-in is a login attempt that displays characteristics associated with potential account compromise. Depending on the environment, this could include unusual locations, devices, authentication patterns, or other abnormal activity.
What happens when ITDR detects suspicious identity activity?
ITDR helps security teams quickly identify and investigate potentially compromised identities. When suspicious activity is detected, our Security Operations Center (SOC) can isolate the affected device and restrict network access to help prevent the threat from spreading. The sign-in attempt can then be investigated and validated with the user before access is safely restored.