Key Takeaways
- Identity and Access Management (IAM) remains essential for establishing who should have access, but it is primarily a preventative control.
- Identity Threat Detection and Response (ITDR) adds the critical capability to detect and respond when legitimate credentials are abused in real time.
- Gartner identifies credential misuse as the leading cause of breaches, with more than half of organizations experiencing machine‑identity incidents and AI‑driven attacks expected to halve exploitation windows by 2027.
- Effective ITDR requires identity telemetry to flow into the Security Operations Center (SOC) so that anomalous identity behavior can be correlated with endpoint, network, and cloud signals.
- Stellar Cyber integrates ITDR directly into its Open XDR SecOps Platform, avoiding a separate console and enabling unified detection, enrichment, and automated response.
- The latest Stellar Cyber 6.6 release improves login‑anomaly fidelity (Impossible Travel, location anomalies) with customizable suppression, username prioritization, and ASN enrichment, delivering detection delays of 5–10 minutes after data ingestion.
- Upon detecting suspicious identity activity, Stellar Cyber can enrich events with identity details and trigger actions such as disabling users, confirming compromise, or revoking sign‑in sessions.
- The security paradigm is shifting from a one‑time “should this identity have access?” decision to continuous verification: “What is this identity doing now—and should we trust it?”
Introduction: The Evolving Identity Threat Landscape
Enterprises have long relied on Identity and Access Management (IAM) to answer the foundational question of who should be granted access to which resources. While IAM continues to be a cornerstone of security hygiene, attackers have shifted tactics: instead of trying to bypass authentication, they steal or forge legitimate credentials and then operate inside the trusted identity perimeter. This change transforms the identity problem from a static gate‑keeping issue into a dynamic monitoring challenge, where the focus moves from preventing unauthorized entry to detecting malicious use of already‑trusted identities.
IAM’s Role and Limitations
IAM solutions enforce policies such as multi‑factor authentication, least‑privilege access, and identity lifecycle management. They excel at ensuring that only authorized users and service accounts can obtain credentials in the first place. However, IAM is fundamentally preventive; once an identity is authenticated, the system assumes trust unless another control flags abnormal behavior. Consequently, attacks that exploit valid credentials—such as pass‑the‑hash, credential stuffing, or compromised service accounts—can evade IAM entirely, leaving a blind spot that attackers readily exploit.
What ITDR Adds: Detection and Response
Identity Threat Detection and Response (ITDR) was created to fill exactly this gap. As Gartner articulates, ITDR functions as the second and third layers of identity defense: detection of anomalous identity activity and rapid response to stop an active attack. Unlike IAM, which asks “should this identity be trusted?” ITDR continuously asks “is this trusted identity behaving like an attacker?” By monitoring identity telemetry in real time and correlating it with broader security signals, ITDR enables security teams to spot compromised accounts before they can cause significant damage.
Real‑World Impact: Credential Misuse Statistics
The urgency of ITDR is underscored by recent data. According to the 2025 Verizon Data Breach Investigations Report cited by Gartner, credential misuse was the leading cause of security breaches. Additionally, Gartner’s machine‑identity research revealed that more than 50 % of surveyed organizations had experienced at least one cybersecurity incident involving compromised machine identities. Looking ahead, Gartner predicts that by 2027 AI agents will automate credential theft and disrupt authentication channels, cutting the exploitation window for exposed accounts by roughly 50 %. These trends illustrate why identity security must operate “in the now,” combining preventive controls with immediate detection and response.
Integrating Identity Data into SOC Operations
An identity breach rarely remains confined to the identity system; attackers often move from a compromised account to cloud applications, internal networks, and endpoints. For defenders, this means that identity context must be visible to the Security Operations Center (SOC) alongside other telemetry. Gartner specifically recommends integrating IAM‑originated incidents into SOC response and threat‑hunting workflows. Supporting this, the 2024 IAM Leadership Survey found that organizations with tight collaboration between IAM and cybersecurity teams achieved a 30 % improvement in meeting IAM goals. When identity data flows freely into the SOC, analysts can correlate a suspicious login with unusual file access, lateral movement, or data exfiltration, dramatically reducing the time to understand and contain an incident.
Stellar Cyber’s Approach to ITDR
Stellar Cyber takes a unified stance by embedding ITDR directly into its Open XDR SecOps Platform rather than deploying a separate identity‑only console. This design allows identity telemetry from sources such as Active Directory, Microsoft Entra ID, and Okta to be ingested alongside endpoint, network, cloud, and log data. By keeping all signals within a single platform, analysts avoid context‑switching and can apply the same correlation, prioritization, and automation rules used for other threat types. The result is a streamlined workflow where identity anomalies are treated as integral components of the broader attack picture, not isolated alerts.
Enhancements in Stellar Cyber 6.6
The recent Stellar Cyber 6.6 release advances the platform’s ITDR capabilities in several concrete ways. Login‑anomaly detection—particularly for Impossible Travel and User Location anomalies—has been refined for higher fidelity, with customizable suppression rules to reduce noise and better username prioritization to focus on high‑risk accounts. Additionally, ASN (Autonomous System Number) enrichment provides geographic and network‑origin context for Impossible Travel alerts, improving accuracy. Stellar Cyber reports an expected detection delay of only 5–10 minutes after data ingestion for these anomalies, although upstream ingestion delays can extend that window. This near‑real‑time visibility ensures that security teams can act while an attack is still in progress.
From Detection to Action: Response Capabilities
Detecting suspicious identity behavior is only half the battle; timely response is essential. Stellar Cyber enables automated enrichment of identity events with detailed user or service‑account information, supporting actions such as disabling a user account, confirming a compromise, or revoking active sign‑in sessions via Microsoft Entra ID. When an Impossible Travel alert fires, for example, the platform can automatically trigger a session revocation and notify the SOC analyst for further investigation. This creates the operational progression that ITDR demands: detect anomalous identity behavior, understand it within the full attack context, prioritize the risk based on correlated signals, and respond before the attacker can deepen their foothold or exfiltrate data.
Beyond Prevention: Continuous Trust Assessment
The evolving threat landscape forces a philosophical shift in how organizations view trust. Rather than treating authentication as a one‑time decision that grants implicit trust for the duration of a session, security teams must continuously evaluate whether an identity’s current actions align with expected behavior. Gartner forecasts that by 2028, 70 % of CISOs will leverage identity visibility and intelligence tools to shrink the IAM attack surface and lower credential‑compromise risk. This proactive stance mirrors the broader move toward zero‑trust architectures, where trust is never assumed and is constantly verified through real‑time telemetry and adaptive policies.
Conclusion: IAM Protects the Identity, ITDR Protects the Moment
In summary, IAM remains indispensable for establishing who should have access and ensuring strong authentication hygiene. Yet, as attackers increasingly exploit legitimate credentials, organizations need a complementary capability that watches what those trusted identities are doing in real time. ITDR delivers that visibility and response power, turning identity from a static gate into a dynamic sensor within the security stack. By integrating identity telemetry into the SOC, enriching alerts with contextual data, and enabling swift automated actions, platforms like Stellar Cyber exemplify how modern security can close the gap between prevention and detection. Ultimately, the maxim holds true: IAM protects the identity; ITDR protects the moment.