Episode 24: ITDR Unpacked: Attackers Are Now Logging In

Adam

Welcome to the deep dive. So if you're in the security trenches right now, you uh you definitely know the old perimeter model, the way we built everything around. It's well, it's basically dead. Attackers aren't really focused on, you know, breaking in anymore.

Christina

No, they found a shortcut.

Adam

Exactly. They're just logging in.

Christina

That really is the critical shift, isn't it? I mean, Microsoft's data says over 80% of breaches now involve identity. That's that's huge. Eighty percent. It's not just some alarming stat. It kind of points to a fundamental failure in how we thought about security. You know, the idea that the network boundary was solid. Right. But if an attacker just waltz in the front door with like a valid key, well, your firewalls don't really see it.

Adam

It doesn't matter anymore. Okay. So our mission today then is to really unpack this security category built for this problem: identity threat detection and response. ITDR. We want to get into what it is, why it matters so much now, and crucially, how it closes this uh massive blind spot that a lot of traditional tools just miss.

Christina

And maybe the most urgent number to start with is this. In 2024, 71% of attacks used valid credentials. 71%. Wow. So identity really has become the new perimeter. It's porous, it's everywhere. The moment an attacker gets hold of an account, whether they steal it or you know buy it cheap off some dark red marketplace, they instantly look like a trusted insider.

Adam

Okay, let's pivot off that. Section one, the core problem. Why are our traditional security tools, well, failing this identity test? Yeah. The old playbook, it was malware, right? Exploiting vulnerabilities. Dropping files, finding bugs. But now the weapon is the user account itself or a token, your credential.

Christina

And that's exactly where the traditional tools, well, they stumble. Take EDR, endpoint detection, and response. EDR is, look, it's fantastic technology for spotting suspicious processes or, you know, malicious files on a machine. Sure. But what happens when the attacker uses a perfectly valid identity? There might be no malware file, nothing for EDR to hook onto.

Adam

Because the activity looks legit.

Christina

On the surface, yes. It looks like maybe, you know, Bob from accounting logging in. EDR is fundamentally file-centric or process-centric. But this attack, it's identity-centric. EDR is just functionally blind to that kind of misuse.

Adam

Okay, that makes sense for EDR. But what about Syme? You know, security information and event management, they collect tons of logs, right? Can't a good analyst just write the right rules to catch these credential attacks?

Christina

Uh that's a really common question, and it's a critical distinction. Symes are brilliant collectors. Yes, they gather everything. But um, they often lack the deep behavioral intelligence needed for context.

Adam

Context.

Christina

Yeah. Think of it like this: a Syme collects all the letters arriving at a house. Great. But does it inherently know what normal mail looks like for that specific person? Does it know that getting three letters a day is normal, but 300 is weird?

Adam

Probably not out of the box.

Christina

Exactly. Or that logging in at 9 a.m. is normal, but 3 a.m. is suspicious for that user. Attackers specifically weaponize valid accounts because they can often mimic legitimate behavior just enough to fly under the radar of those general-purpose rule-based SIEM detections.

Adam

So basically, without ITDR, you, the listener, you're stuck being reactive. Totally. You're always chasing the intrusion after it happened, trying to clean up the mess once the attacker's already been lurking, maybe moving laterally for days, completely unseen.

Christina

Which guarantees maximum dwell time. And that's, you know, that's what turns a small breach into a massive headline grabbing disaster.

Adam

Which leads us perfectly into section two. Let's properly define ITDR and talk about what it actually does. So formally, ITDR is focused squarely on detecting threats that use stolen or abused identities, right?

Christina

Correct. It does this by monitoring uh things like authentication logs, looking closely at account behavior over time, access patterns, basically trying to spot those subtle anomalies much, much sooner.

Adam

And what kind of signals are we talking about? It's not just failed logins, I assume.

Christina

Oh no, much more than that. ITDR is really looking for those specific post-compromised behaviors, the indicators that someone's already in and doing bad things. Like what? Okay, so uh things like multi-factor authentication bypass attempts or um impossible travel logins. That's a classic.

Adam

Where someone logs in from London and then five minutes later from Tokyo.

Christina

Exactly. Physically impossible, or maybe uh dormant accounts suddenly springing back to life after months or years. That's always suspicious.

Adam

Right. And what about once they're inside, trying to get more power?

Christina

Precisely. ITDR is really good at spotting privilege escalation attempts, lateral movement trying to jump from one system to another. And it's also critical for detecting those really sophisticated high-level compromises.

Adam

Like admin accounts.

Christina

Yes, including really nasty stuff like golden ticket attacks or Kerberos attacks. These are complex, but basically they let an attacker forge the highest level of trust. It's like they've minted their own master key to the entire digital kingdom.

Adam

Wow. Okay. And if ITDR spots these signals early, how does it actually help stop the attack? How does it limit that lateral movement?

Christina

It's the R in ITDR, the response. This isn't just about alerts. Good ITDR integrates tightly with your identity and access management, your IAM system. Oh, okay. So when it detects something really dodgy, maybe that impossible travel followed immediately by an attempt to access a super sensitive server, the system doesn't just flag it. It can trigger an automated response.

Adam

Like what? Shutting the account down.

Christina

Exactly. Or forcing an immediate password reset, maybe invalidating all the current login sessions for that user. You're actively cutting the attacker's connection before they deploy ransomware or start stealing gigabytes of data.

Adam

Got it. So early detection plus automated response. That makes sense. But you mentioned integration, and that brings up the silo problem, right? All this data lives in different places, which takes us to section three: silos versus synthesis. That operational friction must be a nightmare.

Christina

It's probably the single biggest headache for security teams today, honestly. You're constantly jumping between screens, EDR for endpoints, SIEM for logs, maybe NDR for network traffic, IAM for identity.

Adam

And then maybe a separate ITDR tool on top.

Christina

Right, which just adds another console, another set of alerts for already stretched teams, especially for MSPs and MSSPs. Alerts get missed, context gets lost because the tools aren't talking to each other effectively.

Adam

So the answer is integration, embedding ITDR.

Christina

Yes, exactly. The power move here is leveraging what's often called OpenXDR, that's extended detection and response. The extended part is key.

Adam

How so?

Christina

By embedding ITDR directly into a platform that's already unifying all your other security, daily, endpoint, network, cloud, logs, you kill that friction. You get correlated insights. The system sees the whole picture. In one place. In one place. That correlation is like the magic sauce. It automatically connects seemingly random disconnected events into a single coherent attack story.

Adam

Okay, let's make that real. Give us an example. How does that unified view actually help an analyst on the ground?

Christina

Okay, think about this scenario. We see this happen. An attacker buys a single stolen login credential, maybe for like $15 on some forum. Cheap. Unbelievable. And that one credential can end up causing millions in damages. Now, watch how an integrated platform, an open XDR with embedded ITDR, handles it. Okay. First, the system sees a user login from, say, an unusual country, a bit suspicious, that's identity data. Right. Minutes later, maybe the same user tries to access a domain controller or some other privileged system that's access data, maybe endpoint data triggering too. Then they start downloading a large volume of sensitive files that's pulling in log data, network data.

Adam

So instead of the analyst getting three separate, maybe low priority alerts, a weird login, an admin access attempt, a big download, which they might ignore because they get hundreds of alerts a day.

Christina

Exactly. Alert fatigue is real. But the integrated platform sees the connections, it automatically stitches those events together. They're in print. It presents one single high-priority, high-confidence alert, a contextualized attack story. The analyst isn't drowning in noise. They're looking at something meaningful with the context already built in. That means faster, way more accurate response.

Adam

That makes a huge difference. Which brings us nicely to section four, the strategic advantages. Let's start with efficiency gains. For security operations, especially MDR providers, efficiency is everything, right? It's a competitive edge.

Christina

Absolutely. Time is money, and false positives cost a fortune. Embedded ITDR delivers huge efficiency improvements. That automated correlation we just talked about, it slashes the time analysts spend manually digging through logs, trying to connect dots.

Adam

Less manual work.

Christina

Way less. And the identity context helps them prioritize much faster using risk scoring. Is this risky behavior coming from a regular user or a privileged admin? That changes the priority instantly.

Adam

And this leads to better metrics.

Christina

Definitely. You see real measurable improvements in your mean time to detect, MTTD, and your mean time to respond, MTTR. You're literally getting faster at finding and stopping threats.

Adam

Okay, efficiency is key. What about compliance and trust? Customers need proof, their security is solid, especially around identity.

Christina

And regulators demand it. ITDR is absolutely vital here. It provides the hard evidence, the verifiable metrics you need to satisfy major frameworks. Think NIST, CSF, ISO 27, Theo Zero 1, SUS C2, High PayA, CIS controls.

Adam

They all care about identity protection.

Christina

Deeply. So by actively monitoring identity threats and showing you can respond, you generate proof. Measurable data showing you're managing identity risk effectively. That's gold for audits, for cyber insurance, and for building trust with your clients.

Adam

And finally, let's talk commercial opportunities. This sounds like a strong area for service providers, for MSSPs. Why is identity risk such a good place to focus for, say, upselling services?

Christina

It's almost easy mode for upselling, relatively speaking. Why? Because every single client understands identity risk, at least instinctively. They all use Microsoft 365 or Azure AD or Google Workspace.

Adam

Yeah, it's universal.

Christina

They get the value of those accounts and they get the potential pain if they're compromised. The ROI for protecting cloud access, protecting those core identities, it's immediately obvious. It's often an easier conversation than selling, say, more complex infrastructure security.

Adam

So it allows MSSPs to shift the conversation.

Christina

Exactly. They can move from just being seen as you know monitoring tools to being proactive attack disruptors focused on the client's most visible assets, their user accounts.

Adam

And you can structure this into service tiers, drive more recurring revenue.

Christina

Absolutely. It lends itself perfectly to tiered offerings. You could have an essential tier, maybe basic identity monitoring and alerting, then an advanced tier adding things like Emoeba user and entity behavior analytics, plus some automated response like locking accounts. And then maybe a premium tier with full incident response support, deep dives into lateral movement, maybe even threat hunting focused on identity. For partners using platforms like enhanced.io, for instance, they get these ITDR alerts baked right into their workflows, unified reporting, without necessarily needing a huge expansion of their own analyst team. They leverage the platform's intelligence.

Adam

Makes sense. Leverage the platform, scale the protection. Okay, so let's wrap this up. We started with that pretty stark reality. Identity is ground zero now. Attackers log in, they don't break in. And ITDR isn't just nice to have anymore. It's really essential for closing that huge visibility gap. It helps MSSPs level up their services and build, you know, real customer trust with measurable results.

Christina

Yeah, it's become foundational. And that brings me to maybe a final thought, something provocative for you, the listener, to chew on.

Adam

Okay, let's hear it.

Christina

Given that ITDR is moving from being a bolt-on accessory to being integral, right in the middle of the detection pipeline, ask yourself this. What operational assumptions in your current security setup does an identity first approach immediately expose as, well, flawed or vulnerable?

Adam

Hmm. Interesting question.

Christina

Because the MSSPs, the security teams that really win in the next couple of years, they'll be the ones who fundamentally re-architect their defenses around identity, not just cling to the crumbling perimeter. That's the strategic shift.