Seeing what identities do with access after login
Estimated reading time: 5 minutes
Every Odyssey begins with a journey into uncertain territory.
For today’s security teams, that territory is the identity environment.
Users, administrators, service accounts, applications, APIs, cloud identities, privileged accounts, and increasingly AI agents all create identities that can access something valuable. And just like Odysseus could not navigate safely by looking only at the horizon, security teams cannot protect identities by looking only at who has access.
They also need to understand what identities are doing.
That is where Identity Threat Detection & Response (ITDR) comes in.
The Identity Attack Surface Has Changed
Identity has become a critical part of the attack path. An attacker does not always need to break through a technical perimeter if they can obtain a legitimate identity and use its existing privileges.
Verizon’s 2025 Data Breach Investigations Report found that compromised credentials were an initial access vector in 22% of analyzed breaches. The 2026 DBIR also continues to identify credential abuse as an important component of modern breaches, alongside vulnerability exploitation and phishing.
The challenge is that a compromised identity can look perfectly legitimate.
The login may be valid.
The password may be correct.
The account may have exactly the permissions it is supposed to have.
The threat is hidden in the context and behavior.
That changes the security question from:
“Who has access?”
to:
“Is this identity behaving as expected?”
IAM Tells You Who Should Have Access. ITDR Watches What Happens Next.
IAM and ITDR are closely connected, but they solve different problems.
Identity & Access Management establishes identities, manages their lifecycle, controls access, and enforces policies.
Identity Threat Detection & Response focuses on identifying suspicious identity activity, investigating potential compromise, and responding to identity-related threats.
Think of IAM as the system that determines who is allowed through the gate.
ITDR is what happens when someone asks:
“Why did this person enter the building at 3:17 AM, use a privileged door, and then change three other access permissions?”
Both perspectives are necessary.
Strong access governance can reduce unnecessary privileges, but it cannot guarantee that a legitimate account will never be compromised. ITDR adds continuous monitoring and investigation to the identity security equation.
What Does ITDR Actually Detect?
ITDR is not about treating every unusual event as an attack. The goal is to identify meaningful deviations and combinations of signals.
Depending on the environment, these can include:
- Unusual authentication patterns
- Suspicious privilege changes
- Unexpected administrator activity
- Repeated failed authentication attempts
- Dormant or rarely used accounts suddenly becoming active
- Service accounts behaving outside their normal patterns
- Unexpected changes to groups, roles, or permissions
- Suspicious activity following a password reset or privilege escalation
- Access from unusual locations, devices, or applications
- Identity activity associated with other security events
A single event may mean very little.
A sequence of events can tell a very different story.
This is why identity telemetry, event correlation, and historical context are so important. Security teams need more than a stream of authentication logs. They need enough context to recognize when ordinary identity activity becomes a potential threat.
From Detection to Response
Transitioning to Detection is only half of ITDR.
Once suspicious identity activity has been identified, the organization needs a response process.
Depending on the severity and confidence of the signal, that response might involve:
- Investigating the identity — Who is the account, what access does it have, and what has it been doing?
- Establishing a timeline — What happened before and after the suspicious event?
- Assessing exposure — Which systems, resources, or privileges could have been affected?
- Containing the threat — Actions may include disabling an account, revoking sessions, resetting credentials, or removing excessive privileges.
- Understanding the root cause — Was the identity compromised, misused, misconfigured, or simply behaving unexpectedly?
- Improving controls — Use the investigation to strengthen policies, access governance, monitoring, and detection rules.
This is where identity forensics becomes especially valuable. Today’s suspicious event may have started with an unnoticed permission change weeks or months earlier.
Without historical identity data, the beginning of the journey can disappear.
The ITDR Journey Starts With Visibility
Organizations do not need to transform their entire IAM environment overnight.
A practical ITDR foundation starts with understanding the identity events already available.
Collect: authentication, access, privilege, account, and configuration events.
Correlate: connect events across identity systems and security domains.
Analyze: establish normal behavior and identify meaningful deviations.
Investigate: use historical context to understand what happened and why.
Respond: contain confirmed or high-confidence identity threats.
Learn: feed investigation findings back into identity governance and security controls.
The objective is not to monitor everything simply because everything can be monitored.
It is to make the identity environment observable enough to recognize when the journey takes an unexpected turn.
The Modern Identity Odyssey
Odysseus survived his journey by understanding the dangers around him, adapting to them, and never assuming that the next part of the voyage would look like the last.
Security teams face a similar challenge.
Identity environments are constantly changing. New applications appear. Permissions evolve. administrators make changes. Service accounts multiply. Cloud identities come and go. And attackers look for opportunities to turn legitimate access into unauthorized control.
ITDR provides the security discipline for navigating that environment.
IAM answers who should have access.
Identity observability shows what is happening.
Identity threat hunting investigates what looks suspicious.
Identity forensics reconstructs what happened.
And ITDR brings these capabilities together around a simple goal:
detect identity threats early, understand what is happening, and respond before a compromised identity becomes a wider security incident.
The Odyssey is not about reaching the destination without encountering danger.
It is about being able to recognize the danger before it determines where you end up.
