What is ITDR? Identity Threat Detection & Response, explained for SMBs

For years, security advice for small businesses centred on the laptop: put antivirus on every machine and you’re covered. That advice is now out of date. Attackers have worked out that the fastest way into a modern business isn’t a laptop. It’s a login.

This guide explains what identity threat detection and response (ITDR) is, what it catches, why multi-factor authentication (MFA) alone doesn’t close the gap, and how to check whether your business is covered.

What is ITDR?

Identity threat detection and response (ITDR) watches the accounts people sign in with, and responds when one of them is being misused. It covers your identity provider, usually Microsoft Entra ID (the sign-in behind Microsoft 365) or Google Workspace, and the apps connected to it.

Antivirus and EDR ask “is this file or program malicious?” ITDR asks two different questions about every sign-in:

Is this really the person?
Should this account be doing this?

When the answer to either is no, ITDR responds: it ends the attacker’s sessions, resets sign-in, and removes whatever the attacker set up while they were inside.

Why identity became the front door

The shift shows up in every major threat report:

More than 97% of identity attacks are password attacks, and identity-based attacks rose 32% in the first half of 2025. (Microsoft Digital Defense Report 2025)
Identity is the primary intrusion surface, not endpoints or malware. (Coveware Q4 2025)
Stolen credentials rose to the second most common way in, at 16% of investigations, driven by password-stealing malware. (Mandiant M-Trends 2025)
Credential abuse was the most common first step in breaches, at 22%. (Verizon 2025 Data Breach Investigations Report)

In short, the attacker often doesn’t need to hack anything. They sign in with a password they bought, guessed or tricked out of someone.

Why MFA alone isn’t enough

MFA is the single most useful control most businesses can switch on. Microsoft says phishing-resistant MFA can stop more than 99% of password attacks, even when the attacker has the right username and password.

But not all MFA is phishing-resistant, and attackers have learned to go around the rest:

MFA fatigue. The attacker has the password and sends prompt after prompt until the person taps “approve” to make it stop. (How to stop it)
Session theft. A fake login page sits in the middle of a real sign-in, the person completes MFA, and the attacker copies the session that results. They never need the second factor again. (How AiTM phishing works)
Risky app consent. The person is tricked into granting an app access to their mail and files. No password is needed after that.
Gaps in coverage. A shared mailbox, an old admin account or a legacy app without MFA.

That last point is more common than it sounds. Sophos found that in ransomware attacks where stolen credentials were the root cause, 97% of victims had MFA switched on in some form. The gaps were in the places nobody had checked.

Think of MFA as the lock and ITDR as the camera that notices someone picking it, or walking in through a window you forgot about.

What ITDR catches

A good ITDR layer looks for the signs that separate a real person from an attacker wearing their credentials:

Impossible travel. A sign-in from Chicago at 9:00, then another from overseas at 9:20.
Sign-ins from anonymising networks and the hosting services attackers rent.
Password sprays. One wrong password tried across dozens of accounts at once, looking for the one that works.
MFA prompt floods. Many prompts in a few minutes, followed by an approval.
Stolen sessions replayed from a browser or device the person has never used.
Accounts gaining power. A user suddenly made an admin, a new sign-in method added, or an account dormant for months waking up.
What attackers leave behind. Inbox rules that hide replies, mail forwarded to an outside address, or someone given access to a mailbox.
Risky app consent. An app granted access to mail and files, and AI assistants opening files on someone’s behalf.

Each of these on its own can be innocent. A real business trip looks like impossible travel at first glance. What makes ITDR useful is joining them up: an odd sign-in followed by a new forwarding rule two minutes later is not a business trip.

A worked example: the invoice that almost got paid

Here’s an illustrative example of how an identity attack plays out at a 30-person firm.

9:02 am. The office manager gets an email that looks like a shared document from a supplier. She clicks, sees a Microsoft sign-in page, enters her password and approves the MFA prompt on her phone. The page was fake. It passed her sign-in through to Microsoft and kept a copy of the session.

9:05 am. The attacker uses the copied session from another country. Microsoft sees a valid session and lets it in. No password or MFA prompt is needed.

9:07 am. The attacker creates an inbox rule: anything mentioning “invoice” or “payment” goes to an unused folder and is marked read.

Without ITDR, the attacker reads her mail for two weeks, then replies to a real supplier thread asking the accounts team to pay a new bank account. The firm finds out when the real supplier chases the unpaid invoice.

With ITDR, the session from another country, the browser that doesn’t match her laptop and the hidden inbox rule land in one case within minutes. Every session ends, the password and sign-in methods reset, and the rule is removed. She gets a short “was this you?” message, and the business keeps its money.

For how this links to the payment-fraud side, read what business email compromise is.

Doesn’t Microsoft already include this?

Partly. Microsoft’s own risk-based sign-in protection, Microsoft Entra ID Protection, needs Microsoft Entra ID P2, and P2 is not included in Microsoft 365 Business Premium. Without it, much of the detail behind risky sign-ins is hidden. Business Premium does include Conditional Access, which lets you set sign-in rules, but rules are not the same as something watching every sign-in and acting on what it sees.

That’s why many small businesses that rely on Microsoft 365 have endpoint protection on every laptop and nothing watching the sign-ins that matter most. For the full picture, read is Microsoft Defender enough for small business?, or Microsoft ITDR explained for what Defender for Identity and Entra ID Protection each cover.

ITDR vs EDR vs MFA

MFA makes it harder to sign in with a stolen password. It’s prevention.
EDR watches what runs on laptops and servers. It sees malware and attackers on the machine, but not a sign-in from somewhere else.
ITDR watches the sign-ins and what accounts do afterwards. It sees the attacker who never touches your laptops.

You need all three. Read ITDR vs EDR for a side-by-side comparison.

Checklist: is your business covered?

How Centeye does ITDR

Centeye Gatewatch watches every sign-in across Microsoft Entra ID and Google Workspace. It catches stolen sessions, impossible travel, password sprays, MFA prompt floods, accounts gaining power, hidden inbox rules and risky app consent. When it finds a takeover, it ends every session, resets the password and sign-in methods, and removes what the attacker added, at the setting you choose. Every fix is checked afterwards at Microsoft or Google.

Because Kavach, Centeye’s security operations agent, joins identity events with email and endpoint signals, a phishing email followed by an odd sign-in and a new forwarding rule becomes one case, the way a human analyst would see it. Gatewatch connects with one admin sign-in, needs nothing installed on laptops, and most tenants are connected in under 10 minutes.

Want to know where one tenant stands today? The free Identity Exposure Check is a read-only script that checks admins, MFA, foreign sign-ins, unused accounts and app access, and writes a report on your own computer.

Frequently asked questions

What does ITDR stand for?

Identity threat detection and response. It detects attacks on the accounts people sign in with, and responds by shutting the attacker out.

Is ITDR only for big companies?

No. Coveware’s Q4 2025 data put the median ransomware victim at 200 employees. Small businesses run on Microsoft 365 and Google Workspace accounts just like big ones, and usually have fewer people watching them.

Do I still need MFA if I have ITDR?

Yes. MFA stops most password attacks before they start. ITDR catches the ones that get around it.

Does ITDR need software on every laptop?

Not for Gatewatch. It connects to Microsoft Entra ID or Google Workspace directly. Adding endpoint protection lets it check whether a session came from a known, healthy laptop.

How fast can ITDR respond?

At the “Handle it” setting, Centeye ends every session and resets sign-in on its own as soon as it is sure, then tells you after. At “Ask me first”, it prepares the fix and runs it the moment you approve, from a phone if needed.

New to these terms? Our security glossary has plain-English definitions. Want to see ITDR running on your own Microsoft 365 or Google Workspace? Start a free trial.

Figures cited from the Microsoft Digital Defense Report 2025, the Coveware Q4 2025 quarterly ransomware report, Mandiant M-Trends 2025, the Verizon 2025 Data Breach Investigations Report and the Sophos State of Ransomware 2026 report. Microsoft licensing per Microsoft’s Entra service description. The worked example is illustrative.