Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Enterprises Use Identity Threat Detection and Response to Stop Credential Attacks
Transcript
- Lucas: Let me paint a picture. November 2023 – an attacker compromises a third-party support engineer's laptop. That engineer had access to Okta's customer support system. The attacker doesn't break a password or bypass MFA. They simply hijack a valid session token. By the time Okta detects it, the attacker has viewed files from multiple customer tenants. That breach cost Okta over two million dollars in remediation and legal fees, and it shook enterprise trust in identity providers. Luna: And that's the kind of attack that traditional security tools struggle to catch. You can have perfect MFA policies, but if a session token is stolen, the attacker looks like a legitimate user. Lucas: Exactly. That's why a growing number of security teams are turning to a category called Identity Threat Detection and Response — ITDR for short. Gartner formally defined it in 2022, and they now predict that by the end of this year, 2026, seventy-five percent of enterprises will have deployed some form of ITDR to combat identity-centric attacks. Luna: So how is ITDR different from what we already have? We've got identity and access management platforms, we've got endpoint detection. Where does ITDR fit? Lucas: Great question. IAM is about policy — who gets access, how they authenticate. EDR is about the device — what processes are running, what files are being modified. ITDR sits in the middle. It monitors the identity layer itself: login anomalies, token usage, privilege escalation. It asks questions like 'Is this user really in Tokyo five minutes after swiping into an office in New York?' or 'Why is a service account initiating an interactive logon at 3 AM?' Luna: So it's behavioral analysis focused on identity rather than the endpoint. That makes sense because a lot of modern attacks target identity directly. The Verizon Data Breach Investigations Report has said for years that credential theft is the number one attack vector. Lucas: Right. And ITDR tools pull signals from multiple sources — Active Directory, cloud identity providers like Azure AD or Okta, VPN logs, even HR systems. When a user leaves a company, ITDR can detect if their account is still active and automatically disable it. Or if an attacker tries to use a stolen certificate to authenticate, ITDR flags that as anomalous. Luna: I've heard of companies like Silverfort and CrowdStrike offering ITDR capabilities. CrowdStrike's Falcon Identity Threat Detection module is actually an extension of their EDR. Does that mean you already have ITDR if you have modern EDR? Lucas: Partially. CrowdStrike and Microsoft Defender for Identity are strong, but they tend to be endpoint-centric. Standalone ITDR platforms like Silverfort provide agentless coverage for legacy systems and cloud workloads. They can see authentication flows that endpoint agents can't. For example, if an attacker tries to authenticate to a mainframe or a legacy file server, an EDR agent on the laptop won't pick that up. But an ITDR platform monitoring your Active Directory and federation services will. Luna: That's a key gap. And I imagine alert fatigue is already a problem. How do ITDR tools avoid drowning analysts in false positives? Lucas: A lot of it comes down to baselining. ITDR uses machine learning to learn typical user behavior. Once it knows that a specific user logs in from New York between 9 and 5 and never accesses databases, a login from Russia at midnight hitting a database triggers an alert with high confidence. They also use risk scoring, so analysts can prioritize. Some platforms even automate response — like forcing a password reset or terminating all sessions for a compromised account. Luna: That proactive response is huge. Because in the Okta breach, the session token was valid for over an hour before it was revoked. If ITDR had detected the anomalous use of that token earlier — maybe a support engineer logging from an unusual location — they could have cut off access much faster. Lucas: Exactly. And that's the value proposition. ITDR reduces 'dwell time' — the window between compromise and detection. The average dwell time for identity-based attacks is still around 200 days according to some studies. With ITDR, that number can drop to hours or even minutes. Luna: But adoption isn't always smooth. What are the common challenges CISOs face when implementing ITDR? Lucas: The biggest challenge is identity sprawl. Large enterprises have thousands of accounts across on-prem Active Directory, Azure AD, AWS IAM, multiple SaaS apps. Correlating all that identity data is a data engineering problem. Second is cultural — security teams may not want to give yet another tool access to authentication data. But the vendors address that with read-only connectors and strict access controls. Luna: So it's not just 'install and turn on.' There's a setup phase where you have to integrate all your identity sources and tune the baselines. Lucas: Definitely. But once it's tuned, it's very effective. I spoke with a CISO at a mid-size financial services firm who implemented Silverfort last year. He told me that in the first month, ITDR detected a compromised service account that had been used for lateral movement for weeks. His EDR and SIEM had missed it because the activity appeared legitimate from an endpoint perspective. Luna: That's a real win. So ITDR seems like a natural complement to zero-trust architectures. If you're implementing zero trust, you need visibility into identity risks. Lucas: Exactly. Zero trust is about 'never trust, always verify.' ITDR gives you the verification layer — it continuously validates that the identity behind a request is behaving as expected. Without it, zero trust relies on static policies that can't adapt to compromised credentials. Luna: Let's talk about costs. Is ITDR something only large enterprises can afford, or can mid-market companies also benefit? Lucas: It varies. Major vendors like CrowdStrike price it per user per month, often around three to five dollars per identity. For a company with a thousand employees, that's about fifty thousand dollars a year. There are also open-source options like Wazuh that have identity monitoring capabilities, but they require more customization. I'd say it's accessible for any organization that takes identity security seriously — and really, that should be every company. Luna: That's a point I want to push back on a little. Not every company has a dedicated security team. For a small business, fifty thousand dollars might be too much. What would you recommend for them? Lucas: Fair point. For smaller teams, I'd recommend starting with free tools from cloud providers. Azure AD Identity Protection is included with some licenses and gives you risk-based conditional access. Microsoft also has a free tier of Defender for Identity with limited features. Then as you grow, you can layer on a more comprehensive ITDR solution. The key is to at least have visibility into sign-in risks and unusual behavior. Luna: Good advice. Now, I know we have to wrap up soon, but I want to circle back to the human element. ITDR can detect anomalous activity, but if an attacker uses legitimate credentials and behaves normally, it's tough to catch. How do tools handle that? Lucas: That's the hardest scenario — the 'insider threat' or an attacker with a golden ticket. Some ITDR tools use honeytoken accounts — fake users that sit in Active Directory and are never used by real people. If anyone tries to authenticate as that user, it's an immediate red flag. Also, session recording for privileged users and stepping up authentication for sensitive actions can help. But no tool is perfect. Defense in depth still matters. Luna: Absolutely. Look, this podcast has always been ad-free, and we want to keep it that way. If you're getting value from these episodes and you're in a position to support us, we have a page where you can buy us a coffee — it's Buy Me a Coffee dot com slash fexingo. Your support helps us keep the content independent and focused on what matters to operators and builders. Lucas: Yeah, we really appreciate that. And honestly, if today's episode gave you a concrete idea you can use, that's the link — Buy Me a Coffee dot com slash fexingo. Every bit helps. Now, back to the topic: I think the biggest question for ITDR going forward is how it evolves with generative AI. Attackers are using AI to craft more convincing phishing emails and even to generate fake voice or video for identity verification. ITDR will need to incorporate behavioral biometrics and trust scoring to keep up. Luna: Agreed. And as more companies adopt passwordless authentication, the attack surface shifts from passwords to tokens and biometrics. ITDR will be essential for monitoring those new vectors. This has been another great conversation. I'm Luna. Lucas: And I'm Lucas. Thanks for listening, and we'll see you next time on Cybersecurity Business with Fexingo.