Most attacks today do not break anything. They sign in with a stolen password or a stolen session. ITDR is the security layer that watches for that: sign-ins from places or devices a person never uses, floods of MFA prompts, sessions copied from a fake login page, and risky app permissions.
Detection is only half of it. The response part ends the attacker's sessions, resets the password and sign-in methods, and removes what the attacker added, such as a hidden forwarding rule.
For an MSP, ITDR matters because identity is shared across every client tool. One taken-over mailbox can lead to invoice fraud, data theft and access to other systems.
What ITDR watches for
- Impossible travel and sign-ins from unusual devices
- MFA fatigue (push bombing)
- Stolen session tokens and risky app consent
How Centeye handles it
Centeye Gatewatch watches every sign-in across Microsoft 365 and Google Workspace, spots the ones that aren't really your people, and shuts them out before money or data moves.
Gatewatch: identity protection (ITDR) →Go deeper: What is ITDR?