Sharelock ITDR

Identity Security positions digital identity—its lifecycle, authentication, and authorization—as a core pillar of cybersecurity. Many prominent attack types converge on the same prerequisite: gaining access to highly privileged accounts that unlock sensitive data and downstream systems. Across advanced persistent attacks on critical infrastructure, malicious insiders, and software supply chain attacks, privileged identities and their access paths repeatedly serve as the leverage point to reach critical resources.

Traditional IAM approaches focus on lifecycle management, recertifying static entitlements, strengthening authentication (including contextual risk), and privileged access controls. Yet access governance remains heavily role-based and manually complex, especially when layered entitlement models exist in major systems. This makes it difficult to maintain clear visibility into who has which access. More importantly, static entitlements show only “the tip of the iceberg”; behavioral outliers—how entitlements are actually used—are more relevant for detecting identity-driven threats. The rise of dynamic cloud workloads and non-human (“silicon”) accounts further reduces the effectiveness of static control methods.

Sharelock addresses this gap with an Identity Threat Detection & Response (ITDR) and Cloud Workload Protection (CWPP) solution that augments existing IAM and SOC tooling. It ingests both static entitlement data and dynamic activity data (including IAM audit trails and concrete user actions) from IAM systems and business applications, normalizes and correlates it, and models “habits” to flag anomalies. Anomalies are then evaluated to determine which are real threats versus legitimate, non-routine activity. The platform supports response actions and integrates with SIEM/SOAR. It offers an ITDR reference model with 50+ Indicators of Behavior (IoBs), an unsupervised, rule-less ML approach, flexible baselining, and dashboards that highlight risky entities/users, “should-be vs as-is” gaps, and early threat signals. Key challenges include expanding integrations, playbooks beyond SAP, and growing its partner ecosystem.

• Attackers commonly try to gain access to highly privileged accounts to reach sensitive information or additional systems.
• Many critical cyberattack types are fully or partially related to digital identities and their access.
• Common IAM practices emphasize user lifecycle management, entitlement recertification, stronger authentication with MFA, and privileged access restrictions.
• Granting and reviewing entitlements is often handled through complex, manual, role-based processes.
• Static entitlements are described as only the “tip of the iceberg” for Identity Security compared with behavioral analysis.
• Dynamic workloads and non-human (“silicon”) accounts reduce the sufficiency of static approaches for controlling access.
• Sharelock supports two primary use cases: ITDR and Cloud Workload Protection (CWPP).
• Sharelock includes out-of-the-box integrations with One Identity/OneLogin, SailPoint, Okta, and applications such as Microsoft 365, Google Workspace, Salesforce, and SAP.
• Sharelock provides an ITDR reference model containing more than 50 predefined Indicators of Behavior (IoBs).
• Sharelock supports on-premises or as-a-service deployment, including single-tenant and multi-tenant installations.

• “Identity Security has established itself as a term.”
• “Identity-related threats thus are a major challenge for organizations.”
• “Furthermore, looking at static entitlements, it is just the tip of the iceberg when it comes to Identity Security.”
• “Way more relevant is the analysis of outliers in the behavior of users, based on information about how these are using the entitlements.”
• “Not every anomaly result in a threat, but – way more frequently – is related to a required action outside of the daily routine of users.”
• “Their patented technology builds on a ML architecture that works without rules.”
• “Customers can define their own baselines.”
• “The model runs unsupervised.”
• “Sharelock closes a gap in the current IAM tools landscape with their ITDR platform, a standalone solution that complements existing IAM solutions as well as SIEM/SOAR tools in the SOC.”
• “It adds cross-system anomaly detection for identity and access related events…”