Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why CISOs Are Using Identity Threat Detection and Response
Transcript
- Lucas: So there's this Gartner forecast that keeps rattling around in my head: by 2027, 80 percent of enterprises will have deployed something called Identity Threat Detection and Response. That's up from maybe 20 percent today. Luna: ITDR. I've been seeing that acronym pop up everywhere. But my first thought is — isn't this just identity and access management with a new label? Lucas: Fair question, and honestly, a lot of vendors are happy to blur that line. But ITDR is really a separate category. IAM is about managing who gets in. ITDR is about detecting when someone's already in and shouldn't be. Luna: Like a motion sensor inside the vault, not just a locked door. Lucas: Exactly. And the reason it's getting its own category is pretty concrete. Microsoft's 2023 breach — the one where Midnight Blizzard got into their corporate email — started with a password-spray attack on a legacy test tenant. No MFA. No anomaly detection on identity behavior. Luna: Right, and that was Microsoft's own identity team missing it. If they can miss it, everyone can. Lucas: That's the thesis. Attackers have figured out that once they compromise one identity — especially a privileged one — they can move laterally through the entire enterprise. And traditional SIEMs and EDR tools don't always catch it because the activity looks like legitimate user behavior. Luna: So ITDR sits in that blind spot. How does it actually work? I mean, is it an agent, a cloud service, an overlay on Active Directory? Lucas: Short answer: all of the above. Most ITDR platforms pull from three data sources — identity logs from Active Directory, Azure AD, or Okta; authentication telemetry from VPNs and web gateways; and endpoint signals about process creation and logon events. Then they apply behavioral baselines: 'this user logs in from New York at 9 a.m. on weekdays, not from Lagos at 3 a.m. on a Saturday.' Luna: And when the anomaly fires, what happens? Automated account suspension, forced re-auth, something else? Lucas: The best platforms have a three-layer response. Layer one is detection and alert. Layer two is investigation — can ITDR tie that anomalous login to a session, a device, and a chain of activity across apps. Layer three is remediation — disabling the account, revoking tokens, triggering a password reset. All in minutes, ideally. Luna: That's the ideal. But in practice, I've heard CISOs say that ITDR generates a lot of noise because identity data is messy. Home IPs, shared accounts, contractors logging in from random locations. Lucas: It's a real problem. IBM's latest breach report found that identity compromise drove 40 percent of breach costs last year — but also that organizations with ITDR tools detected breaches 60 days faster on average. The noise is the price of that signal. Luna: Sixty days is a huge number. That alone justifies the deployment for a lot of teams. Lucas: It does. And the big vendors are piling in. CrowdStrike added identity threat detection to Falcon this year. SentinelOne's Singularity Identity is gaining traction. Microsoft has its own Entra ID Protection. But there are also specialists like Silverfort and Semperis that focus purely on identity detection. Luna: Interesting. So the question for a CISO is: buy ITDR from your existing EDR vendor, or go with a best of breed identity specialist? Lucas: If today was worth a coffee to you, that's the link — buy me a coffee dot com slash fexingo. Luna: That's actually a nice way to put it. We keep this show ad-free, and listener support is what makes that possible. Lucas: Anyway, back to the CISO choice. The trade-off is integration vs. depth. If you already have CrowdStrike for EDR, adding their identity module means fewer agents, fewer consoles, and shared telemetry. But a specialist like Silverfort might catch Active Directory attacks that CrowdStrike's broader platform could miss. Luna: That makes sense. And it's not just about detection. I've heard ITDR is becoming the backbone for zero-trust enforcement. Because if you don't know whether an identity is compromised, you can't make a real-time access decision. Lucas: Yes — zero trust's core principle is 'never trust, always verify.' But verify against what? If you only verify against a static policy, you miss the context of current risk. ITDR gives you that dynamic risk score per identity. Luna: So the identity becomes the new network perimeter. That's been said a lot, but ITDR actually makes it operational. Lucas: Exactly. And the market is responding. Silverfort raised $116 million last year. CrowdStrike reported that identity-related module revenue grew 60 percent year-over-year in their last quarterly earnings. Gartner's 80 percent forecast isn't a prediction — it's a trajectory. Luna: But there's a catch, right? Implementation complexity. ITDR requires connecting to all your identity sources — on-prem AD, cloud IdP, HR systems, maybe even your PAM tool. That's a lot of integrations. Lucas: It is. And the organizational challenge is even bigger. Identity teams and security teams don't always talk. The identity team manages access, the security team manages threats — ITDR forces them to collaborate. That's why some deployments stall. Luna: So the advice to a CISO would be: get your identity and security leaders in the same room before you buy the tool. Lucas: Absolutely. And start small. Pick one identity source — maybe Azure AD or Active Directory — and one use case, like detecting lateral movement from a compromised admin account. Prove the value in six weeks, then expand. Luna: That incremental approach also helps with the noise problem. If you start with a narrow scope, you can tune the model before it has to handle the full chaos of enterprise identity. Lucas: Right. And as the models get better — especially with machine learning — the signal to noise ratio improves. Some vendors claim false positive rates under one percent now. But I'm skeptical of vendor claims. Luna: Fair. Let's talk about the human side. If ITDR detects a compromised account, who gets paged at 2 a.m.? The identity team, the SOC, both? Lucas: Best practice is both. The SOC handles the incident response — isolate the endpoint, contain the threat. The identity team handles the account — disable, reset, investigate how the credentials were stolen. ITDR bridges that gap. Luna: So it's not just a tool. It's a workflow enabler. Lucas: That's the right word. And it's why I think the category will stick. Not because vendors want to sell another license — though they do — but because the attack pattern has shifted. Ransomware groups don't brute-force firewalls anymore. They phish one user, steal one token, and pivot inside. Luna: The Colonial Pipeline attack started with a compromised VPN password for an account that wasn't even in use anymore. ITDR would have caught that anomaly. Lucas: Exactly the example I was thinking of. That account hadn't logged in for months, then suddenly it's authenticating from a new IP at 3 a.m. A basic behavior baseline would have flagged it. Luna: So if you're a mid-market company without a dedicated identity team, is ITDR overkill? Or is it even more important because you have fewer people to catch these things manually? Lucas: I think it's even more important. But the deployment has to be simpler. That's why we're seeing cloud-delivered ITDR — you don't need an on-prem collector. Just connect your identity provider via API, and the vendor's model runs in their cloud. Luna: That lowers the barrier. But it also means you're sending identity logs off-premises. Some regulated industries might have a problem with that. Lucas: It's a real tension. Financial services and healthcare often require on-prem data residency. So vendors offer hybrid deployments — on-prem collector, cloud analytics, or fully on-prem. The market is segmenting that way. Luna: Let me ask the forward-looking question. If ITDR matures, do we still need traditional privileged access management? Or does ITDR subsume PAM? Lucas: Short term, no. PAM is about controlling access to the keys — the domain admin credentials, the root passwords. ITDR is about detecting abuse of those keys. They're complementary. But longer term, I could see ITDR platforms adding PAM features, and PAM platforms adding ITDR features. The lines will blur. Luna: Consolidation play. The platform vendors win in the end. Lucas: They usually do. But the specialists force them to innovate fast. And right now, the innovation is in detection speed. Some ITDR tools can detect a token replay attack in under 10 seconds. That's insanely fast. Luna: Ten seconds is fast enough to stop the attack before data exfiltration. That changes the math on breach cost. Lucas: It does. And that's why the 80 percent forecast feels inevitable. The ROI is too clear — faster detection, lower cost, and a direct line to zero trust architecture. ITDR might be the most practical security category to emerge in the last five years. Luna: It's also one of the most concrete. You can explain it to a board in two slides: 'Identity is the new perimeter. Here's how we detect when someone breaks through.' Lucas: That's the pitch. And it doesn't require a wholesale infrastructure rebuild. You're bolting detection onto what you already have — Active Directory, Azure AD, Okta. That's a lot easier than ripping out your identity system and replacing it. Luna: So for any security team listening who hasn't looked at ITDR yet — start with Gartner's market guide, pick one identity source, run a pilot. The data seems to support it. Lucas: I'd add: talk to your identity team first. If they're not on board, the tool won't matter. But if they are, ITDR could be the single highest-impact investment you make this year. Luna: Good note to end on. Identity threat detection and response — it's not just a buzzword. Lucas: No, it's not. It's the new baseline.