Attackers no longer hack their way into corporate networks; they log in using valid credentials obtained through infostealers, adversary-in-the-middle (AiTM) phishing, or credential stuffing. Identity Threat Detection and Response (ITDR) has emerged as the critical missing layer between Identity and Access Management (IAM) and Endpoint Detection and Response (EDR).
1. What Distinguishes ITDR from IAM and EDR?
Traditional IAM solutions (such as Okta or Microsoft Entra ID) focus on provisioning access, managing SSO, and validating login policies. However, once an attacker possesses a valid session token, IAM assumes the session is legitimate.
Meanwhile, traditional EDR tools monitor endpoint processes, DLL injections, and kernel modifications. If an attacker leverages legitimate tools like PowerShell or Azure CLI to query Active Directory or enumerate AWS IAM roles, EDR often sees only normal administrative commands.
ITDR fills this visibility gap by monitoring:
- Session token theft and browser cookie extraction from developer machines.
- Abnormal Kerberos ticket requests (Kerberoasting) and DCSync domain controller replication attacks.
- Unauthorized creation of OAuth app registrations with high-privilege graph permissions.
- Impossible travel and session hijacking across cloud services.
2. Top Identity Attack Vectors Observed in 2025–2026
- Adversary-in-the-Middle (AiTM) Phishing: Reverse-proxy phishing kits (like Evilginx) intercept user credentials and valid session cookies, bypassing traditional SMS and push-based MFA.
- OAuth Consent Phishing: Tricking employees into granting third-party cloud apps permissions to read emails and SharePoint documents without sharing passwords.
- Service Principal Privilege Escalation: Identifying orphaned machine identities in AWS or Azure with permanent administrative privileges and no credential rotation.
"Identity is the primary attack surface of the modern cloud era. Defending the endpoint without continuous identity monitoring leaves half of the kill chain undetected."