Identity Detection and Response

Use Cases

Identity Security Posture and Identity Detection and Response address what has become the dominant attack vector: identity is the new perimeter, and the majority of breaches now involve credential compromise, MFA bypass, or abuse of legitimate access rather than malware.

A quick terminology note first: the industry-standard acronyms are ISPM (Identity Security Posture Management) and ITDR (Identity Threat Detection and Response). ISPM is the preventive/posture side, which focuses on the state of your identity infrastructure — finding misconfigurations, excessive privileges, and weaknesses before they're exploited. ITDR is the detection/response side, which focuses on active threats against identities — detecting credential theft, token abuse, privilege escalation, and lateral movement in progress. Most modern platforms combine them, similar to how CSPM and CWPP converged into CNAPP.

Features & Modules

The core features and modules are:

‍ISPM (VOC companion) goals include:

• Identity inventory and visibility. Continuously discover every human and non-human identity (service accounts, machine identities, OAuth apps, API keys, workload identities) across AD, Entra ID, Okta, Ping, Google Workspace, AWS IAM, and SaaS apps. Shadow identities and orphaned accounts are a major risk.‍
• Misconfiguration detection. Surface weak MFA enrollment, legacy authentication still enabled, password policy gaps, stale accounts, dormant privileged users, unconstrained delegation in AD, risky conditional access policies, and similar exposures.‍
• Privilege and entitlement analysis. Identify excessive permissions, standing privileged access, privilege escalation paths (especially in AD/Entra ID — Tier 0 exposure, ADCS misconfigurations, shadow admins), and toxic permission combinations.‍
• Attack path mapping. Chain individual weaknesses into exploitable paths — e.g., compromised user → Kerberoastable service account → domain admin. This is the BloodHound-style analysis that's now table stakes.‍
• Compliance and policy enforcement. Map identity posture against frameworks (NIST 800-53 AC/IA families, CMMC, ISO 27001, SOC 2) and enforce policies like JIT access, least privilege, and separation of duties.‍
• Hygiene at scale. Track and reduce stale accounts, unused privileges, never-logged-in users, expired credentials, and certificate sprawl.

ITDR (SOC companion) goals include:

• ‍Detect identity-based attacks in real time. Catch credential stuffing, password spray, AS-REP roasting, Kerberoasting, Golden/Silver/Diamond tickets, DCSync, DCShadow, token theft, session hijacking, OAuth consent phishing, and MFA fatigue attacks.‍
• Detect post-authentication abuse. Spot anomalous behavior after a valid login — impossible travel, atypical resource access, unusual privilege use, suspicious app consent grants, suspicious API calls from valid sessions.‍
• Detect identity infrastructure compromise. Monitor for attacks against the identity providers themselves — AD/Entra ID tampering, federation trust abuse (Solorigate-style), changes to authentication policies, backdoor account creation.‍
• Respond and contain. Disable accounts, force re-authentication, revoke sessions and tokens, trigger conditional access policies, and isolate compromised identities — ideally automated through SOAR or native IdP integrations.‍
• Investigation and forensics. Provide identity-centric timelines that correlate sign-ins, token issuance, permission changes, and resource access across the hybrid identity fabric.

ISPM/ITDR overlaps with and complements:

• IAM/IGA: governance and lifecycle — ISPM tells you what's wrong with how IGA is being used
• PAM: privileged credential vaulting — ISPM finds the privileged accounts PAM should be managing
• CIEM: the cloud IAM slice of ISPM, often bundled into CNAPP
• EDR/XDR: endpoint-centric detection — ITDR fills the identity gap that EDR can't see
• SIEM: log aggregation — ITDR provides the identity-specific detection logic that generic SIEM rules miss

Our solution covers both ISPM and ITDR, not necessarily covering all the features described above, generating findings and alerts for:

• identity breaches (username/password, tokens, etc.) available for attackers on the (public, deep, dark) web for an initial access; understand if the breach can be exploited on the identity repository (password changes, token expired?)
• check for EntraID misconfigurations that would allow the attacker to expand his control
  
• providing remediation suggestions, case management (resolve, snooze findings), and response capabilities (disable account, change password, etc.)

‍