ITDR: Identity Threat Detection and Response in CIAM

Key takeaways

• ITDR, Identity Threat Detection and Response, is the security category for detecting and responding to identity-based attacks in real time, distinct from traditional auth analytics.
• The 2026 attack surface that ITDR addresses: token theft, session hijacking, OAuth consent phishing, MFA bypass, lateral movement after initial compromise.
• Workforce ITDR (Push, Permiso, Silverfort, Microsoft Defender for Identity) and CIAM-side ITDR (Auth0 Adaptive MFA, Descope risk, Authsignal, Castle.io) are both growing categories.
• ITDR overlaps with adaptive auth at the entry point but extends through the entire session lifecycle, every action gets risk-scored, not just the login.
• Most CIAM ship ITDR-adjacent features (anomaly detection, breached credential alerts, suspicious session detection); dedicated ITDR tools layer on top for deeper detection and SOC integration.

Why ITDR exists

ITDR became a recognized security category around 2022-2023 as Gartner formalized the gap between EDR (endpoint) and traditional IAM analytics. By 2026 it's a mature category with workforce-focused vendors, CIAM-integrated capability, and a clear operational pattern.

What ITDR detects

The detection categories that matter:

Token / session theft. A session cookie issued to Alice on her laptop is now being used from a different IP, different fingerprint, different geography. Possible cookie theft via malware or phishing kit.

OAuth consent phishing. A user clicks a link, lands on a real OAuth consent screen for a malicious app requesting broad scopes (mailbox read, file access). Once granted, the malicious app has API access without ever touching the user's password. Detection: anomalous consent scope, unfamiliar app, unusual user behavior pre-consent.

MFA bypass / fatigue. Attacker has the password (from breach, phishing, infostealer); spams push notifications until the user approves to make it stop. Detection: rapid push notification volume, user behavior inconsistent with intentional sign-in.

Suspicious session activity. A normal user suddenly performs admin actions, queries unusual data, or accesses resources they don't normally touch. Detection: behavioral baseline plus anomaly scoring.

Credential reuse from breach. A user logs in with credentials matching a recent third-party breach. Detection: breached-credential database check at sign-in.

Lateral movement. Initial compromise of one account followed by privilege escalation, role changes, or access to other accounts. Detection: identity graph analysis across the account population.

Where the signals come from

Modern ITDR composites several signal classes:

• Device fingerprinting, browser fingerprints, mobile device IDs, behavioral biometrics
• Network signals, IP reputation, geo/velocity, ASN, VPN/Tor detection
• Authentication metadata, factor used, recovery flows triggered, MFA bypass indicators
• Session telemetry, token reuse patterns, refresh behavior, idle/active patterns
• OAuth telemetry, consent grants, scope changes, app reputation
• Behavioral baselines, per-user normal patterns of login times, locations, action types
• Threat intelligence, known phishing kits, breached credentials, malicious IPs
• Identity graph, relationship between accounts, privilege levels, ownership

The risk score is the composite. A login from a new device in an unusual country at an unusual time using a credential that appears in a breach database is high-risk; the same login from the user's normal device on their normal IP is low-risk.

ITDR vs adaptive auth

The two overlap; the distinction is scope:

• Adaptive auth scores the login event. The decision is "challenge for additional verification?" The signals end at session establishment.
• ITDR scores the entire identity runtime. Every action, token use, consent grant, role change, admin operation, gets risk-scored. The decision is "allow / challenge / block / alert" continuously.

For the entry-point details, see the adaptive risk-based authentication guide. For the broader ATO context, see the account takeover defense guide.

Two market segments

The ITDR market has roughly bifurcated:

Workforce ITDR, focused on the employee identity surface. Dominant vendors: Push Security, Permiso, Silverfort, Microsoft Defender for Identity, Crowdstrike Falcon Identity, Oort (acquired by Cisco). Integrates with workforce IdPs (Okta, Microsoft Entra) plus SIEM and EDR.

CIAM-side ITDR, focused on the customer identity surface. Either built into the CIAM (Auth0 Adaptive MFA, Descope risk, AWS Cognito Advanced Security) or as a CIAM-adjacent product (Authsignal, Castle.io, Kasada). Integrates with the CIAM's authentication and session management.

What CIAM ships natively

Most modern CIAM ship ITDR-adjacent features without calling them ITDR:

• Geo/velocity anomaly detection
• Breached credential alerts (HaveIBeenPwned integration)
• Device-fingerprint-based suspicious session detection
• Adaptive MFA challenge based on risk score
• Token revocation and session invalidation APIs

For most mid-market deployments, this native capability is sufficient. Dedicated ITDR is justified when:

• The security team has a SOC and needs deep telemetry integration
• The business is in a regulated industry with explicit ITDR requirements
• A documented incident has shown the gap between native CIAM capability and the actual attack surface

Operational pattern

A working ITDR deployment includes:

1. Telemetry pipeline. All identity events (auth, session, consent, role change) flow to a central store with structured fields. CIAM audit logs are the source.
2. Detection rules. Both vendor-provided (built-in detection) and custom (organization-specific patterns).
3. Risk scoring. Composite score per session, per action.
4. Response actions. Auto-revoke session, force step-up MFA, alert SOC, page on-call. Different triggers for different score thresholds.
5. Incident workflow. Triage queue, investigation tools, response playbooks. SOC team owns this.

For the technical session-management primitives that ITDR builds on, see the session management guide.

Vendor selection

For most B2B SaaS in 2026:

1. Use the CIAM's native ITDR-adjacent features first. Auth0 Adaptive MFA, Descope risk, Cognito Advanced Security, Microsoft Entra Risky Sign-ins.
2. Layer dedicated CIAM-side ITDR if the native isn't enough. Authsignal for B2B SaaS adding deeper risk; Castle.io for B2C.
3. Workforce ITDR for the employee side. Push, Permiso, Silverfort, separate from the CIAM choice.

ITDR is best understood as a maturing layer on top of the CIAM, not a replacement. The CIAM provides identity primitives and entry-point auth; ITDR extends the same security posture through the entire session lifecycle.