Identity Threat Detection and Response (ITDR)
Products that detect and respond to attacks on user identities: account takeover, stolen credentials, session hijacking, malicious inbox rules and business email compromise in Microsoft 365, Google Workspace, Entra ID, Okta and Active Directory. Includes software and managed services. Endpoint detection belongs in EDR, and access policy in IAM Platforms.
This category lists 14 products that detect and respond to attacks on user accounts: stolen credentials, hijacked sessions, malicious inbox rules and business email compromise. Most of them watch Microsoft 365. Some also cover Google Workspace, Okta, Cisco Duo or on-premises Active Directory. Endpoint threats sit in EDR, and access policy sits in IAM Platforms.
Several are managed services with analysts who investigate and act for you. Huntress Managed ITDR and Blackpoint Cloud MDR run a 24/7 SOC over Microsoft 365 and Google Workspace accounts, and Blackpoint also covers Cisco Duo. Sherweb Office Protect adds 24/7 SOC review of Microsoft 365 alerts in its MDR tier, and Todyl includes ITDR in its MXDR service.
The rest are tools your own team runs. Petra uses behavioral detection on Microsoft 365 logs and reverses attacker changes to sessions, devices, inbox rules and registered apps. SaaS Alerts from Kaseya monitors Microsoft 365, Google Workspace, Salesforce and Slack for account takeover and compromised sessions. Augmentt Secure and Overe combine breach alerts and automatic response with Microsoft 365 configuration management. CrowdStrike Falcon Identity Protection and Stellar Cyber also watch on-premises Active Directory alongside Entra ID and Okta.
When you compare them, check which identity sources each one watches, whether it can lock an account or revoke sessions without waiting for you, and how much log history it reads when you first connect a tenant.
Products
14Identity threat detection and response for Microsoft 365 and Google Workspace that stops account takeovers and business email compromise.
Identity Threat Detection and Response for Microsoft 365 environments, preventing BEC and token theft.
Cloud detection and response that watches user activity across Microsoft 365, Google Workspace, Salesforce and Slack and sends real-time alerts.
Falcon Identity Protection offers identity threat detection and prevention, protecting against identity-based attacks.
Microsoft 365 security platform for MSPs with SaaS posture management, configuration enforcement, identity threat detection and automated response.
Stellar Cyber identity threat detection and response that correlates identity, endpoint, network and cloud activity.
Blackpoint 24/7 cloud MDR for Microsoft 365, Cisco Duo and Google Workspace identities.
Delinea identity threat detection that uses AI to analyse user behaviour and flag anomalies in real time.
24/7 security analysts, Slack and Teams access, and identity threat detection for partners on the Todyl Platform.
Managed detection and response for Microsoft 365 MSPs, with 24/7 SOC monitoring and PSA ticket creation for ConnectWise and Autotask.
Microsoft 365 security platform for MSPs that applies best-practice baselines in one click and automates breach alerts and remediation.
Protect user accounts from takeover with advanced threat detection and remediation.
Trustifi's Account Takeover Protection uses advanced techniques to detect and prevent unauthorized access to email accounts.
Barracuda visibility, protection and recovery for Microsoft Entra ID identities when credentials are stolen or settings drift.