Top Identity Threat Detection And Response (ITDR) Companies
David Roberts
Founder & CEO - ReVerb
10.30.2026
Most serious breaches now involve a valid login somewhere along the way. Attackers phish credentials and session tokens with adversary-in-the-middle kits, buy them from infostealer logs or talk a help desk into resetting MFA. Once inside, they use legitimate accounts to move through Active Directory, Entra ID, Okta and SaaS apps, which looks like normal work to tools that only watch for malware. Generative AI makes the first step easier, producing convincing phishing pages and pretexts at scale.
Identity threat detection and response, usually shortened to ITDR, is the category built for that problem. ITDR tools watch authentication and directory activity for signs of credential abuse, privilege escalation and lateral movement, then respond by revoking sessions, forcing stronger MFA or rolling back risky changes. They complement, rather than replace, identity providers and privileged access tools. Many organizations run ITDR alongside a managed detection and response provider so identity alerts get handled around the clock.
The ten companies below sell ITDR capabilities we verified on their own sites. They range from endpoint platforms with identity modules to specialists in Active Directory recovery and browser-based detection. Every entry is ranked on merit, and no company paid for placement.
Identity Threat Detection And Response (ITDR) Companies At A Glance
Company
Headquarters
Best For
Core Services
CrowdStrike
Austin, USA
Falcon customers wanting identity and endpoint in one console
Best Identity Threat Detection And Response (ITDR) Companies For 2027
1. CrowdStrike — Falcon Identity Protection With Mid-Session Access Revocation
CrowdStrike, headquartered in Austin, Texas, brings identity protection into the same Falcon platform and console it uses for endpoint, cloud and SaaS security. Its identity offering discovers and correlates human, non-human and AI identities across hybrid environments, surfaces overprivileged access, misconfigurations and attack paths, and can replace standing privileges with just-in-time access.
The ITDR piece turns detections into automated responses. As risk changes, Falcon can revoke sessions, require phishing-resistant MFA through FalconID, which is built on FIDO2, or block lateral movement by cutting access mid-session. Because identity, endpoint and browser telemetry share one platform, an analyst can see the compromised laptop and the abused account in the same investigation. CrowdStrike also offers 24/7 monitoring and response through Falcon Complete and Falcon Adversary OverWatch for teams without their own SOC. It is best for organizations already running Falcon on endpoints that want identity detection without adding another vendor.
Microsoft Defender for Identity, from Redmond-based Microsoft, monitors signals from on-premises Active Directory and Microsoft Entra ID, plus other identity systems such as Okta, to detect identity-based attacks across hybrid environments. Sensors run on your identity infrastructure and parse network traffic and Windows events locally, sending only the required signals to a cloud analytics service managed in the Microsoft Defender portal.
Its detections follow the stages of a real intrusion: reconnaissance such as user and group enumeration, compromised credentials such as brute force and suspicious group membership changes, lateral movement, and domain dominance techniques including DCShadow, malicious replication and Golden Ticket activity. It also analyzes lateral movement paths that show how an attacker could reach sensitive accounts, and feeds posture findings into Microsoft Secure Score. Identity alerts are correlated into unified incidents with endpoint and email signals. It is best for organizations already invested in Microsoft 365 E5 or Defender XDR, where it is often already licensed but not fully deployed.
3. Silverfort — Agentless MFA And ITDR For Legacy Systems And Service Accounts
Silverfort was founded in Israel in 2016 and now lists its headquarters in Texas. Its platform sits in the authentication path and enforces policy in real time, blocking, challenging or restricting risky access as it happens. That inline position lets it do something most ITDR tools cannot: extend MFA to systems that never supported it, including legacy applications, command-line tools and OT infrastructure, without agents or code changes.
Silverfort is also strong on non-human identities. It automatically discovers and monitors service accounts, other machine identities and AI agents, then applies controls to them. Service accounts are a favorite path for ransomware operators because they often carry broad privileges and are rarely watched, so being able to lock each one to its expected behavior closes a real gap. It is best for enterprises with older on-premises systems, OT environments or a large estate of service accounts that their identity provider cannot protect on its own.
4. Semperis — AD Threat Detection With Automatic Rollback And Forest Recovery
Semperis, headquartered in Hoboken, New Jersey, focuses on identity resilience for hybrid Active Directory and Entra ID. Its Directory Services Protector scans continuously for hundreds of indicators of exposure and compromise across account security, Group Policy, Kerberos, delegation and Entra ID, and gives a posture score with prioritized remediation guidance.
What sets Semperis apart is response and recovery. It monitors the AD replication stream rather than only security logs, so it can track changes that log-based tools miss, and it can automatically revert risky changes in AD and Entra ID that happen too fast for a human to catch, down to individual attributes and group members. If the worst happens, its Active Directory Forest Recovery product is built for cyber-first restoration, and Semperis also offers disaster recovery for Entra tenants plus identity forensics and incident response services. It is best for large enterprises where losing Active Directory would halt the business, and for teams preparing for ransomware recovery.
SentinelOne, headquartered in Mountain View, California, built Singularity Identity largely on technology from Attivo Networks, which it acquired in 2022. The product detects credential theft and privilege escalation in Active Directory and cloud identity providers, blocks lateral movement across endpoints and domains, and automates workflows that disable compromised identities and force password changes.
Deception is the distinctive part. Singularity Identity deploys decoys designed to lure intruders and expose reconnaissance early, which gives high-confidence alerts because legitimate users have no reason to touch them. It also surfaces credentials exposed on the dark web, enforces conditional access with session blocking and MFA reauthentication, and assesses hybrid identity systems for misconfigurations. Supported identity providers include Entra ID, Okta, Ping, SecureAuth and Duo. Because it shares an agent and console with SentinelOne endpoint protection, identity and endpoint alerts are correlated and users and devices can be isolated together. It is best for SentinelOne customers and teams that want deception as part of their identity detection.
Okta, headquartered in San Francisco, sells Identity Threat Protection with Okta AI for customers who want ITDR built into their identity provider. Rather than checking risk only at login, it monitors user behavior, device health and other context throughout a session, scoring both session risk and user risk. That lets it catch session hijacking through signals such as impossible travel or a sudden change in device posture or network.
When risk rises, Okta can issue an on-demand MFA challenge, terminate sessions, apply restrictions such as read-only access or require re-authentication with phishing-resistant MFA. Universal Logout can end sessions across all supported apps and devices at once, which is useful both during an attack and when an employee leaves. Through the Shared Signals Framework, it exchanges events with tools such as CrowdStrike, Zscaler, Palo Alto Networks and Jamf, so a compromised device flagged elsewhere can trigger a session revocation in Okta. Okta has also brought in the ITDR company Permiso. It is best for Okta customers who want risk response inside the identity layer itself.
Proofpoint, headquartered in Sunnyvale, California, approaches ITDR from two directions. First, it scans identity infrastructure for the misconfigurations and exposures attackers use, ranks each by how easy it is to exploit and how close it is to critical assets, and maps attack paths from endpoints to those assets. Automated Risk Cleanup can purge cached credentials, fix misconfigurations and remove unneeded access, while Shadow Admin Detection finds privileged accounts your PAM tool does not manage.
Second, it uses agentless deception with more than 75 decoy types, requiring no agents, sensors or system changes. Any contact with a decoy indicates compromise, which keeps false positives very low. When an attacker trips one, automated forensics collects their tools and an activity timeline, and an attacker’s-eye view shows which systems they touched and how close they got to critical assets. Alerts flow to SIEM, SOAR and EDR tools. It is best for security teams that want to shrink identity attack paths proactively and get high-fidelity alerts when someone starts exploring them.
8. Vectra AI — Graph-Based Detection Of Kerberos, NTLM And Entra ID Abuse
Vectra AI, headquartered in San Jose, California, detects identity attacks from the network and cloud side. It monitors human and machine identities across Active Directory, Entra ID, Microsoft 365, Azure and AWS, looking for credential abuse, privilege escalation, lateral movement and misuse of legitimate access. A graph-based AI model tracks interactions between accounts, services and hosts to spot attackers abusing privileges.
On Active Directory, Vectra names specific techniques it detects, including suspicious NTLM relay, RDP tunneling, DCERPC misuse, Kerberos ticket abuse and LDAP enumeration. It can also detect attacks inside encrypted protocols such as LDAPS and SMBv3 without decrypting traffic. Analysts can lock down a compromised identity directly from the investigation workflow. Because it sees identity, network and cloud activity together, Vectra is useful for catching an attacker who pivots from an on-premises account into Entra ID or AWS. It is best for hybrid organizations that want identity detection backed by network visibility.
9. Push Security — Browser-Based Detection Of AiTM Phishing And Session Hijacking
Push Security, headquartered in St Albans, England, with an office in London, detects identity attacks at the point where most of them now happen: the browser. Its extension works alongside existing browsers rather than replacing them, collects browser telemetry and uses autonomous agents to detect and block attacks. It covers adversary-in-the-middle phishing, ClickFix lures, session hijacking, device code and consent phishing, and malicious OAuth integrations and extensions.
Push also shows how employees actually log in to SaaS apps, including ghost logins that bypass SSO and accounts using breached credentials, and uses in-browser guardrails to push MFA and SSO adoption. It discovers shadow SaaS and AI tools, tracks what data users share with them and captures risky uploads. That browser-level view fills a gap identity providers cannot see, since many SaaS logins never touch the IdP at all. It is best for cloud-first, SaaS-heavy companies where AiTM phishing kits and stolen session tokens are the main identity threat.
10. BeyondTrust — Identity Security Insights Across Privileged Accounts And Cloud Entitlements
BeyondTrust, headquartered in Atlanta, Georgia, is best known for privileged access management, and its Identity Security Insights product adds identity threat detection on top. It gives a centralized view of identities across the IT estate, flags identity-based anomalies and known attack techniques ranked by severity, and ties each detection to the affected identities and accounts.
The product leans toward reducing exposure as well as catching attacks. It discovers and maps permissions across multiple clouds, gives per-identity risk factors to prioritize least-privilege fixes, and suggests ways to shrink the attack surface and right-size cloud entitlements through its CIEM capabilities. BeyondTrust says setup takes under 30 minutes with findings the same day. Pairing those insights with BeyondTrust’s privileged access tools lets teams act on what they find, for example by removing standing admin rights an attacker could abuse. It is best for organizations that already use BeyondTrust PAM or want identity detection closely tied to privilege reduction.
How To Choose An Identity Threat Detection And Response (ITDR) Company
ITDR products overlap with identity providers, PAM, endpoint protection and SIEM. These questions help you find the tool that closes your actual gaps.
Where Do Our Identities Actually Live?
Map your identity estate first: on-premises Active Directory, Entra ID, Okta or another IdP, SaaS apps with local logins, cloud IAM in AWS or Azure, and service accounts. Tools such as Semperis and Microsoft Defender for Identity are strongest on AD, Okta and Push Security on cloud and SaaS sessions, and Vectra AI and CrowdStrike across hybrid estates. Pick the one that covers the systems an attacker would most want.
Can It Respond, Or Only Alert?
Identity attacks move fast once an attacker holds a valid session. Ask whether the product can revoke sessions, force phishing-resistant MFA, disable accounts or roll back directory changes automatically, and which of those actions need a human to approve. If nobody watches alerts overnight, a SOC as a service provider can handle the response side.
How Does It Handle Service Accounts And AI Agents?
Non-human identities now outnumber people in most environments, and AI agents are adding more. Ask how the vendor discovers service accounts, baselines their behavior and enforces controls on them without breaking the applications that depend on them. Silverfort, CrowdStrike and Okta all put specific emphasis here.
Will It Fit Our Existing Stack?
If you already run CrowdStrike, SentinelOne or Microsoft Defender, their identity modules share a console and agent with tools you already manage, which lowers cost and effort. Standalone specialists often go deeper on one problem. Check SIEM and SOAR integrations and whether the vendor supports shared signals with your IdP.
How Do We Test That It Works?
Run a proof of concept against real attack techniques, not just a demo. An internal penetration test or red team exercise that includes Kerberoasting, credential dumping and token theft will show which detections fire and how quickly the tool responds.
Conclusion
Stolen credentials and hijacked sessions are now the most common way in, and AI-generated phishing makes them easier to collect. The best identity threat detection and response (ITDR) companies watch authentication and directory activity closely, respond automatically when an account turns hostile and help you remove the exposures attackers rely on. Start with where your identities live and which platforms you already run, shortlist two or three vendors from this list and test them against real attack techniques before you commit.
