ITDR vs EDR: what's the difference, and do you need both?

For years, protecting a business meant protecting its computers. Antivirus became EDR, and EDR became the tool most MSPs put on every laptop they manage. Then attackers changed what they go after. Today most of them don’t break into a laptop at all. They sign in.

That shift is why identity threat detection and response (ITDR) now sits next to endpoint detection and response (EDR) on most security shortlists. They sound alike, and both end in “detection and response”, but they watch completely different things. Here’s the plain-English difference, and how to decide which clients need which.

The short answer

EDR watches devices. It runs as an agent on each laptop and server and watches what programs do: what starts, what it spawns, what files it touches, what it connects to.
ITDR watches identities. It reads sign-in records and account changes from Microsoft 365, Entra ID and Google Workspace, and asks two questions about every login: is this really the person, and should this account be doing this?

EDR sees the machine. ITDR sees the account. An attack that never touches a machine you manage is invisible to EDR, and an attack that never touches an account is invisible to ITDR.

Why identity became the front door

The numbers from the last year all point the same way:

82% of detections were malware-free in 2025. Attackers used valid credentials and trusted tools instead of malicious files. (CrowdStrike 2026 Global Threat Report)
79% of ransomware attacks started with an identity-based approach, such as phishing for credentials or using stolen logins. (Sophos State of Ransomware 2026)
The average attacker moved from first access to other systems in 29 minutes, and the fastest in 27 seconds. (CrowdStrike 2026 Global Threat Report)

When the first move is a sign-in, the first chance to catch it is at the sign-in. That’s the job EDR was never built to do.

What EDR catches (and misses)

EDR is strong at:

Malware arriving on a machine, checked against known threats.
Ransomware behaviour, like hundreds of files being renamed in seconds or file-recovery snapshots being deleted.
Attackers driving a machine by hand: a Word document starting PowerShell, a remote-access tool nobody approved.
Someone switching off security software before an attack.

EDR can’t see:

A sign-in from a stolen session on the attacker’s own laptop.
An inbox rule that hides invoice emails, created in Microsoft 365 from abroad.
A user quietly made an admin, or a new MFA method added to their account.
An app granted full access to someone’s mailbox.

None of those happen on a device you manage, so there is nothing for an endpoint agent to see.

What ITDR catches (and misses)

ITDR is strong at:

Sign-ins that aren’t the person: impossible travel, anonymising networks, a stolen session replayed from an unknown browser.
Password sprays across many accounts, and floods of MFA prompts sent to wear someone down.
Accounts gaining power: new admins, dormant accounts waking up, new sign-in methods.
What attackers leave behind in the mailbox: hiding rules, outside forwarding, delegated access.
Apps and service accounts granted access to mail and files.

ITDR can’t see:

Malware running on a laptop.
Ransomware encrypting a file server.
A remote-access tool installed at 1 am.

ITDR vs EDR, side by side

What it watches: EDR watches programs on laptops and servers. ITDR watches sign-ins, accounts and app access in the cloud.
How it’s deployed: EDR needs an agent on every device. ITDR connects to Microsoft 365 or Google Workspace by API, with nothing to install on devices.
Typical first catch: For EDR, a malicious file or a suspicious process. For ITDR, a sign-in that isn’t the person.
Typical response: EDR stops the process and cuts the machine off the network. ITDR ends the sessions, resets the password and sign-in methods, and removes what the attacker added.
Blind spot: EDR misses everything that happens in the cloud account. ITDR misses everything that happens on the device.

A worked example: one attack, two views

This is an illustrative example, not a real client. A 25-person accounting firm, managed by an MSP, runs Microsoft 365 with EDR on every laptop.

Monday, 8:50 am. A partner clicks a fake “shared document” link and signs in on a page that copies her session.
Monday, 9:20 am. The attacker replays the session from a hosting network abroad. ITDR sees it: a session that doesn’t match her laptop, from an anonymising network. EDR sees nothing: her laptop is fine.
Monday, 9:24 am. The attacker adds an inbox rule that moves anything mentioning “wire” to an unused folder. ITDR sees it. EDR doesn’t.
Monday, 10:05 am. The attacker emails the office manager with a link to “updated payment software”. She runs it. EDR sees it: a new remote-access tool that the firm has never used, started from a download. ITDR sees nothing on the device.

With EDR alone, the MSP finds out at step 4, after the mailbox has been in the attacker’s hands for most of an hour. With ITDR alone, they catch steps 2 and 3 but miss the laptop. With both, and something joining them, it’s one attack with one timeline.

Do you need both?

For most clients, yes. If a client uses Microsoft 365 or Google Workspace and has laptops, both front doors are open. Still, the order matters when budgets are tight:

Start with ITDR if the client’s work, money and data live in Microsoft 365 or Google Workspace, they handle payments or invoices by email, or they already have Microsoft Defender on every machine.
Start with EDR if the client runs servers or on-site systems that would stop the business if encrypted, or if their laptops have nothing beyond basic antivirus.
Add the other within the quarter. Attacks move from one to the other in minutes, as the example shows.

Checklist: is this client covered?

Every sign-in to Microsoft 365 or Google Workspace is watched, not just failed ones.
Someone is alerted to impossible travel and sign-ins from anonymising networks.
New admins, new MFA methods and dormant accounts waking up raise an alert.
New inbox rules and forwarding to outside addresses are flagged.
Apps granted access to mail and files are listed and reviewed.
Every laptop and server runs EDR, not just antivirus.
Security being switched off on a machine raises an alarm.
An identity alert and an endpoint alert about the same person end up in the same case.

How Centeye covers both

Centeye Gatewatch is ITDR for Microsoft 365 and Google Workspace. It watches every sign-in, spots stolen sessions, password sprays, MFA prompt floods and risky app consent, and at your setting ends the sessions, resets sign-in and removes the rules the attacker added. Centeye Ironwatch is a lightweight EDR agent for Windows and Mac that works beside Microsoft Defender. It follows every program back to what started it and stops ransomware early.

Praxis joins them, so the stolen session, the inbox rule and the remote-access tool in the example above land as one case with one timeline, not three alerts in two consoles.

New to the terms? Read what ITDR is, EDR vs MDR for small business, or browse the security glossary. Want to see it on your own tenants? Start a free trial.

Frequently asked questions

Is ITDR the same as EDR?

No. EDR watches devices: programs, files and processes on laptops and servers. ITDR watches identities: sign-ins, account changes and app access in services like Microsoft 365 and Google Workspace.

Does Microsoft Defender include ITDR?

Defender for Endpoint is EDR. Microsoft sells identity protection separately, and which features you get depends on your Microsoft 365 and Entra ID licences. Check what’s actually switched on in each client’s tenant rather than assuming.

Can ITDR stop ransomware?

Not directly, since ransomware runs on devices. But most ransomware starts with a stolen login, so ITDR can catch the attack at the first step, before anything reaches a laptop or server.

What does ITDR need to run?

Usually an admin connection to Microsoft 365 or Google Workspace by API. There’s nothing to install on devices, so it can be running in minutes.

Which should an MSP sell first?

Lead with whichever gap the client has. Many small businesses already have endpoint protection from Microsoft but nothing watching sign-ins, which makes ITDR the quickest gap to close.

Figures cited from the CrowdStrike 2026 Global Threat Report and the Sophos State of Ransomware 2026 report. The worked example is illustrative. Centeye describes only capabilities that ship in the product today.