Identity-based attacks — not malware or network intrusions — are now the leading cause of enterprise breaches, with over 80% of incidents involving compromised credentials. This article explains what Identity Threat Detection and Response (ITDR) is, the most common identity attack patterns, and how AI-driven behavioral baselines catch credential compromise that signature-based and threshold-based rules consistently miss.
Identity-based attacks are now the #1 vector for enterprise breaches. According to Verizon's 2025 Data Breach Investigations Report, over 80% of breaches involve compromised credentials — making identity threat detection (ITDR) one of the most critical capabilities a security team can invest in.
For most of the 2010s, perimeter and endpoint defenses — firewalls, antivirus, network intrusion detection — were the primary focus of enterprise security investment, because most attacks still arrived as malware delivered through the network edge. That balance shifted as organizations moved workloads to the cloud and adopted single sign-on, which consolidated access behind one set of credentials rather than many separate systems. Attackers followed the path of least resistance: phishing and credential-stuffing a single identity provider login is far cheaper than developing malware that evades modern endpoint detection. The formal discipline of ITDR emerged around 2022 as analyst firms recognized that identity systems needed the same dedicated detection and response treatment traditionally reserved for endpoints and networks.
Identity Threat Detection and Response (ITDR) is the practice of detecting attacks that exploit compromised user credentials, service accounts, or privilege escalation paths — rather than malware or network intrusion techniques. Modern attackers increasingly favor identity attacks because they're harder to detect with traditional endpoint and network tools.
These same credential-abuse and lateral-movement patterns are also the earliest precursor signals in a ransomware attack — which is why identity telemetry is often the highest-leverage data source for catching attacks before damage occurs.
Traditional SIEM rules for identity threats are brittle — they fire on obvious anomalies (new country login) but miss sophisticated attacks that stay within "normal" parameters. AI-based ITDR systems work differently:
AI builds a behavioral profile for every user, service account, and device — capturing normal login times, typical locations, usual application access patterns, and average data volumes. Deviations trigger investigation, not just rule matches.
A single anomalous event (a login from a new IP) might be legitimate travel. But a new IP login followed by an MFA push-accept, followed by an unusual S3 download, followed by a Salesforce bulk export — that's a credential compromise chain. AI correlates these cross-source signals in real time.
If a user authenticates from London at 9am and from Singapore at 11am, that's physically impossible. AI identity threat detection flags this immediately, regardless of whether it matches a predefined rule.
Case study scenario: A 40-person logistics company's finance director clicks a phishing link disguised as a DocuSign request and enters her Microsoft 365 credentials, which the attacker harvests in real time via an AitM proxy that also captures her MFA-approved session token. Eleven minutes later, the stolen session authenticates from a data center IP in a country the director has never visited, then immediately attempts a bulk mailbox export of finance-related emails. AI-based ITDR correlates the new-IP login with the export attempt and the absence of any travel booking signal, flags the session as compromised, and forces re-authentication before the export completes.
Key Insight: Identity threats rarely look like traditional attacks. They use legitimate credentials, generate normal-looking event logs, and stay below threshold-based alert rules. Only behavioral AI can reliably catch them.
Book a 30-minute demo and see AI-powered threat detection live in your environment.