Identity Threat Detection and Response has become increasingly important as the traditional boundaries around business networks have started to disappear. There was a time when securing a business network largely meant protecting that boundary with a firewall at the edge, antivirus on the computers and policies controlling who could access what.

That boundary is much harder to define today.

Employees work from different locations and devices. Email, files and collaboration tools sit in the cloud. A Microsoft 365 account can provide access to Outlook, Teams, SharePoint, OneDrive and a growing list of connected services.

For an attacker, that account can be more useful than compromising the computer itself.

This is where Identity Threat Detection and Response, usually shortened to ITDR, comes into the picture.

Why Identity Threat Detection and Response Matters

A compromised identity does not always look like an attack.

If somebody tries hundreds of passwords against an account and fails every time, something is obviously wrong. If they log in successfully with the correct credentials, the situation becomes more difficult.

As far as the system is concerned, authentication worked.

The problem is that the person behind that login may not be the employee whose name appears on the account.

Attackers have several ways of getting to that point. Credentials can be stolen. An authenticated browser session can be hijacked. A user can accidentally grant permissions to a malicious application. In some cases, an attacker can work around security controls without ever needing to install malware on the user's computer.

Once access has been gained, what happens next can look surprisingly normal.

That is the gap ITDR is intended to cover.

Instead of focusing only on whether a username and password were accepted, identity monitoring pays attention to what an account is doing and whether that activity makes sense.

A Login Should Not Automatically Equal Trust

Consider an employee who normally works from the same region, accesses roughly the same services and follows a fairly predictable working pattern.

Now something changes.

Their account starts authenticating in an unusual way. New permissions are granted. Security settings are altered. Mailbox rules appear unexpectedly. Sessions are opened that do not fit the user's normal activity.

None of these events necessarily proves that an account has been compromised.

Together, however, they may give IT teams a very good reason to investigate.

That difference matters.

Modern security cannot simply ask, "Did this person enter the correct credentials?"

It also needs to ask, "Does what this account is doing actually make sense?"

MFA Still Matters, but It Cannot Do Everything

Multi-factor authentication remains one of the most effective ways to protect business accounts, and businesses should absolutely be using it.

It should not, however, be treated as the final word on identity security.

Attackers adapt.

Some techniques target authenticated sessions rather than passwords. Others rely on users approving something they should not, or granting access to an application that looks convincing enough to escape suspicion.

In those situations, MFA may have done exactly what it was designed to do.

The attacker has simply found another route.

ITDR adds another layer by watching activity after authentication has taken place. If something begins behaving like a compromised account, the organisation has a chance to react even though the original login appeared successful.

Email Makes a Good Example

Business Email Compromise shows why this kind of visibility is useful.

An attacker who gets into an employee's mailbox does not have to do anything dramatic.

In fact, staying quiet may be far more valuable.

They can watch conversations, learn who deals with payments and wait for the right opportunity. They may create mailbox rules to hide certain messages or forward information elsewhere.

Then an invoice arrives.

A payment is being discussed.

Banking details need to be confirmed.

The attacker steps into a real conversation using a real company account.

That is far more convincing than a badly written phishing email from an unfamiliar address.

By monitoring changes and unusual behaviour around the identity, there is a better chance of spotting the compromise before somebody transfers money or sensitive information to the wrong place.

Spotting It Is Only Part of the Job

There is another important word in ITDR: response.

An alert saying that an account might be compromised is useful, but the value drops quickly if nobody acts on it.

A response may involve blocking the account, revoking existing sessions, forcing the user to authenticate again, resetting credentials, removing suspicious application access or undoing changes made inside the account.

How quickly that happens can make a significant difference.

If an identity is compromised during the night, an attacker should not automatically have until the next morning before anybody notices.

This is one of the reasons continuous security monitoring is becoming increasingly important for businesses that depend heavily on cloud platforms.

The objective is not to generate more alerts. Most IT teams already have enough of those.

The objective is to identify the alerts that actually matter and act on them before a suspicious login becomes a serious incident.

Identity Is Now Part of the Perimeter

The old idea of everything important sitting safely inside the office network no longer reflects how most businesses operate.

People work remotely. Applications are hosted elsewhere. Company information follows users across devices and services.

That makes identity one of the most important control points in the environment.

Firewalls still matter. Endpoint protection still matters. MFA still matters.

ITDR is not a replacement for any of them.

It deals with a different question: what happens when somebody gets hold of an identity that those other security layers consider legitimate?

For businesses that have moved significant parts of their day-to-day operations into Microsoft 365 and other cloud services, it is a question worth asking before an incident provides the answer.

UIT helps businesses take a layered approach to cybersecurity, covering the people, devices, identities and services their organisations rely on every day. To discuss the security controls currently protecting your environment, visit our Contact Us page.

This article is the first in our four-part September series looking at how modern businesses can strengthen security beyond traditional endpoint protection.

Next week, we'll look at Security Awareness Training and why technology alone cannot protect an organisation if employees are not prepared for the threats landing in their inboxes every day.