Leadership Compass

Identity Threat Detection and Response (ITDR)

Identity-related threats are among the most pervasive and damaging types of cyberattacks today—and the focus of Threat Detection and Response (TDR) has now expanded to include the very identities we rely on to access sensitive systems and data. To effectively counter these risks, we must extend TDR capabilities to encompass identities themselves. This is where Identity Threat Detection and Response (ITDR) comes in: by continuously collecting and analyzing operational identity data, ITDR provides the necessary context to detect, investigate, and respond to identity-centric threats.
Confirm participation by:
Jun 04, 2025
Estimated publication:
October 2025
Download the Questionnaire
Confirm Your Participation
How to Book a Briefing
Your Benefits
Alejandro Leal

This is an update of our April 2024 report, Identity Threat Detection and Response (ITDR): IAM Meets the SOC. If you would like to read what it encompassed, please click here.

This Leadership Compass covers the following:

  • Anomalous activity detection
  • Behavioral analytics
  • Compromised credential detection
  • Attack techniques monitoring and attack path visualization
  • IAM system vulnerability discovery
  • IAM system configuration analysis
  • MITRE ATT&CK alignment
  • Automated incident response playbooks
  • Risk-adaptive access controls
  • Integrated threat containment
  • Coverage of hybrid and multi-cloud environments
  • Mapping of identity infrastructure
  • Shadow identity discovery
  • Privileged identity monitoring
  • JIT access management integration
  • Service account and non-human identity (NHI) protection
  • Identity-specific threat feeds
  • Attack surface mapping for identities
  • Session recording and replay
  • Identity-centric forensics
  • Deception techniques
  • Identity risk scoring
  • GenAI for threat summarization
  • Strong dashboarding and reporting capabilities
  • Alerting capabilities
  • Investigative interface
  • Well-documented and secure APIs
  • Integration with authorization systems
  • Integration with Fraud Reduction Intelligence Platforms (FRIP)
  • Integration capabilities to other technologies for detection and response such as Network Detection and Response (NDR) and eXtended Detection and Response (XDR)
  • Integration capabilities to both Identity and Access Management (IAM) systems and Identity Governance and Administration (IGA) solutions
  • The ability to gather identity threat-related information from the dark web, such as information about stolen credentials

We expect ITDR solutions to cover most of these capabilities. We also recognize this is an emerging market, so we plan to review solutions that focus on authentication-related and access-related threats.

How to Book a Briefing
  1. Go to the KuppingerCole Booking tool webpage.
  2. Under Select a Service, select Leadership Compass Briefing 45 mins.
  3. Under Select Staff, scroll down and select Alejandro Leal
  4. Choose date and time between July 7 – August 1, 2025 that are convenient for your team. Please note: Times will be shown in your time zone.
  5. You will receive an MS Teams invite that you can forward along to others in your company. Alternatively, you can use this as a placeholder and send us an invite with another app.
  6. Please prepare a slide deck and provide it to the analyst

Briefing Outline

Key topics to cover:

  • Deployment Models

    Support for various environments, including on-premises, cloud-native, hybrid, and multi-cloud architectures.

  • Support for On-Premises Environments and Legacy Systems

    Ability to protect traditional identity infrastructures (e.g., Active Directory) and integrate with legacy applications and services.

  • Delivery Options

    Deployment formats such as SaaS, containerized solutions, microservices architectures, and self-managed installations.

  • Identity Asset Discovery

    Automated discovery of identity-related assets across systems by connecting to authoritative sources and mapping accounts to their responsible owners.

  • Continuous Visibility

    Real-time visibility into the state, usage, posture, and risk levels of all identity assets within the organization.

  • Prevention and Posture Management

  • Capabilities for proactive risk identification, hardening of identity environments, and continuous enforcement of security best practices.

  • Threat Detection

    Identification of abnormal behavior, suspicious activity, or deviations from established baselines that could indicate threats to identities.

  • Deception Capabilities

    Deployment and monitoring of decoy accounts, honeytokens, and deceptive assets to detect malicious activity targeting identity systems.

  • Investigation and Forensics

    Deep-dive analysis into detected activities to determine the method, scope, and impact of identity-related threats, with support for attack timeline reconstruction.

  • Threat Response

    Execution of automated and manual response actions, such as session termination, access revocation, privilege reduction, and account quarantine.

  • Remediation and Root Cause Analysis

    Integration with case management and investigation platforms; provision of identity-specific remediation guidance and documentation to support root cause analysis.

  • Dashboards, Analytics, and Visualizations

    Intuitive dashboards for identity risk monitoring, attack path analysis, threat hunting, and reporting across technical and executive audiences.

  • Integration with IAM/IGA Ecosystems

    Interoperability with Identity and Access Management (IAM), Identity Governance and Administration (IGA), and Privileged Access Management (PAM) systems.

  • Non-Human Identity Management

    Discovery, monitoring, and governance of machine identities, service accounts, robotic process automation (RPA) identities, and API access credentials.

  • Unique Selling Proposition (USP)

    Differentiating features or capabilities that set the solution apart from competitors in the ITDR market.

  • Product Roadmap and Known Challenges

    Insights into the future development plans, areas of ongoing innovation, and current limitations or challenges of the product.

The demo can be live, video, or canned, although the analyst would like to be walked through the demo, so he understands the products key capabilities including dashboards, etc.

If time allows, and capabilities exist, additional topics that can be covered:

  • Any features that are patented
  • Features that make the product standout over competitive products
  • Use cases of customers currently using your product
Book a Briefing
Your Benefits of Participation

Benefit from Third-Party Attestation

Receive an objective evaluation of your solution that you can easily integrate into your marketing strategy. Our vendor neutral approach ensures results are trustworthy and credible. Use this assessment as a powerful marketing asset to enhance customer trust.

Increase Brand Awareness

Share your cybersecurity expertise with the world. By participating in our analysis, you gain a platform to spotlight your company. Boost your visibility and establish yourself as a leading provider in the industry.

Get Insights Into Competing Solutions

Discover how your solution compares with others in the industry. Our analysis provides insights not only into your solution but also valuable information about competitors. Utilize this knowledge to strengthen your position in the market.

Gain Valuable Insights on Your Market Standing

Benefit from a thorough, complimentary evaluation of your solution. KuppingerCole Analysts will evaluate not only your product but also your positioning in the market. Seize this opportunity to receive valuable feedback and make your solution even more effective.

Switch to dark theme

Research Assistant

Hi, I'm Kuppi, your AI-powered research assistant. Ask me about KuppingerCole Analysts' research, events, or analysts.
As an AI assistant, I can make mistakes. Please verify important information.