ITDR: The Security Layer That Watches Your Logins, Not Just Your Laptops

Picture this: no alarms, no malware alerts, no strange files. Just an employee’s account quietly logging in at 2 a.m., creating a mail rule that forwards invoices to an outside address, and registering a new “backup” MFA device. Every step used valid credentials. Every step looked like normal administration.

This is what most modern breaches actually look like. Attackers don’t break in anymore—they log in. Industry incident reports consistently show that stolen or abused credentials are the leading way attackers get a foothold. Which raises an uncomfortable question: if the attacker looks exactly like your employee, what’s watching for that?

The answer is ITDR—Identity Threat Detection and Response.

What ITDR actually is

You may already have EDR (Endpoint Detection and Response) watching your laptops and servers for malicious behavior. ITDR applies the same idea to identities. Instead of watching devices, it watches accounts: logins, MFA events, permission changes, token activity, and the small configuration tweaks attackers make to stay hidden.

Where EDR asks “is this device doing something malicious?”, ITDR asks “is this person really this person—and should this account be doing that?”

What ITDR catches that other tools miss

• Impossible travel and improbable logins—a sign-in from Denver at 4:55 p.m. and Kyiv at 5:10 p.m. is not a business trip.

• MFA fatigue attacks, where an attacker spams push notifications until a tired employee taps Approve.

• Session token theft, which lets attackers skip the password and MFA entirely by stealing an already-authenticated session.

• Malicious inbox rules and OAuth app grants—the quiet persistence tricks used in business email compromise.

• Privilege escalation, like a standard user suddenly being added to an admin role at midnight.

• Dormant and orphaned accounts that come back to life—often a former employee’s access being exploited.

Why prevention alone isn’t enough

MFA, conditional access, and strong passwords are essential—and determined attackers still get past them through phishing kits that proxy logins in real time, token theft, and simple human error. Prevention lowers the odds; it can’t make them zero. ITDR is the safety net for when someone gets through: detection measured in minutes instead of the weeks it typically takes to discover a compromised account.

That time gap is the whole story. An attacker inside a mailbox for an hour is an incident. An attacker inside a mailbox for three weeks is wire fraud, data theft, and a very awkward call to your customers.

What response looks like

Detection without response is just a more stressful newsletter. Real ITDR closes the loop automatically: revoke the active session, force a password reset, block the suspicious sign-in, disable the malicious mail rule, and alert a human to investigate. Done well, the account is contained before the attacker finishes their coffee.

Where to start

• Turn on the identity protection features already included in your Microsoft 365 licensing—many businesses own them and have never enabled them.

• Review who holds admin roles and remove standing privileges nobody uses.

• Alert on new inbox rules, new MFA device registrations, and consent grants to third-party apps.

• Feed identity alerts to someone who actually watches them—a dashboard nobody reads is not detection.

• Test it: simulate a suspicious login and time how long it takes anyone to notice.

Identity is the new perimeter, and for most businesses it’s the least-watched one. Entice builds ITDR into our managed security stack—monitored around the clock, with response measured in minutes. If you’re not sure what would happen if one of your accounts were compromised tonight, that’s exactly the conversation to have with us this week.