ShadowPlex Identity Protection
Decoy accounts and credentials that expose identity attacks and credential misuse early.
Access Control
Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
Addresses 369 stories in our coverage in the last 90 days 6 products that provide it
What it is
Monitoring of identity systems such as Active Directory, Entra ID and Okta for signs of misuse: impossible travel, stolen session tokens, privilege escalation and attack paths to admin rights.
How to value it
An attacker with valid credentials looks like an employee to most tools. ITDR catches the abuse of identity itself, which is how many intrusions now move from one account to control of the whole domain. It shortens the time an intruder has before encryption or data theft starts.
Questions to ask a vendor
- 1Which identity systems does it watch: on-premises Active Directory, Entra ID, Okta, others?
- 2Can it detect stolen session tokens, not just password attacks?
- 3Does it show attack paths to admin rights so we can close them before anyone uses them?
- 4Can it respond automatically, for example by revoking sessions or forcing re-authentication?
For your risk register
- Risk
- An intruder using valid credentials goes unnoticed until impact.
- Control
- ITDR on all identity providers, alerting to the security operations team.
- Owner
- Security operations lead.
- Measure
- Time to detect identity misuse in exercises.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Falcon Identity Protection
Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.
Huntress Managed ITDR
Managed detection of suspicious activity in Microsoft 365 and Entra ID.
Microsoft Defender for Identity
Detects attacks against on-premises Active Directory and hybrid identities.
Okta Identity Threat Protection
Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.
Vectra AI Platform
Detection of attacker behaviour across network, identity and cloud.
Recent stories it addresses
1055 stories in total- 18 Oct 2026ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise disables cloud backup after attackers compromise Microsoft 365 tenants.
- 17 Oct 2026Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers compromised Microsoft 365 tenants via ConnectWise's Cloud Backup service.
- 16 Oct 2026BAE Systems cyberattack disrupts US federal court operations
BAE Systems cyberattack disrupts US federal court notice system.
- 15 Oct 2026CISA Malcolm
CISA Malcolm suffers from six vulnerabilities, including authentication bypass and SSRF.
- 15 Oct 2026Microsoft Seizes YAM Store and Phishing Kit Domains Linked to 1B Malicious Messages
Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI, and Iron Man services.
- 15 Oct 2026GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction campaign compromises 1,900 GitHub accounts, targets 30,000+ repositories.
- 15 Oct 2026Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Critical RCE vulnerability in Langflow exploited in 1,423 honeypot attempts.
- 15 Oct 2026Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Palo Alto Networks patches PAN-OS zero-day exploited for remote code execution.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.