[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:identity-threat-detection":3},{"control":4,"products":25,"stories":74,"lessons":118,"related":143,"compare":164},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.","Monitoring of identity systems such as Active Directory, Entra ID and Okta for signs of misuse: impossible travel, stolen session tokens, privilege escalation and attack paths to admin rights.","An attacker with valid credentials looks like an employee to most tools. ITDR catches the abuse of identity itself, which is how many intrusions now move from one account to control of the whole domain. It shortens the time an intruder has before encryption or data theft starts.",[11,12,13,14],"Which identity systems does it watch: on-premises Active Directory, Entra ID, Okta, others?","Can it detect stolen session tokens, not just password attacks?","Does it show attack paths to admin rights so we can close them before anyone uses them?","Can it respond automatically, for example by revoking sessions or forcing re-authentication?","Risk: an intruder using valid credentials goes unnoticed until impact. Control: ITDR on all identity providers, alerting to the security operations team. Owner: security operations lead. Measure: time to detect identity misuse in exercises.",[17,18,19,20],"NIS2 Art. 21(2)(b): incident handling","DORA Art. 10: detection of anomalous activities","CIS Control 8: audit log management","ISO\u002FIEC 27001:2022 A.8.16: monitoring activities",{"name":22,"slug":23},"Access Control","access-control","2026-10-16T12:48:02.187069+00:00",[26,34,42,50,58,66],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"total":75,"last_days":76,"recent":77},1055,369,[78,83,88,93,98,103,108,113],{"slug":79,"title":80,"published_at":81,"brief":82},"connectwise-suspends-cloud-backup-after-attackers-compromise-microsoft-365-tenan-1a74dd","ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants","2026-10-18T08:23:02+00:00","ConnectWise disables cloud backup after attackers compromise Microsoft 365 tenants.",{"slug":84,"title":85,"published_at":86,"brief":87},"hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack-622bd9","Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack","2026-10-17T15:18:51+00:00","Hackers compromised Microsoft 365 tenants via ConnectWise's Cloud Backup service.",{"slug":89,"title":90,"published_at":91,"brief":92},"bae-systems-cyberattack-disrupts-us-federal-court-operations-d1065e","BAE Systems cyberattack disrupts US federal court operations","2026-10-16T07:37:35+00:00","BAE Systems cyberattack disrupts US federal court notice system.",{"slug":94,"title":95,"published_at":96,"brief":97},"cisa-malcolm-307fc4","CISA Malcolm","2026-10-15T12:00:00+00:00","CISA Malcolm suffers from six vulnerabilities, including authentication bypass and SSRF.",{"slug":99,"title":100,"published_at":101,"brief":102},"microsoft-seizes-yam-store-and-phishing-kit-domains-linked-to-1b-malicious-messa-e0d594","Microsoft Seizes YAM Store and Phishing Kit Domains Linked to 1B Malicious Messages","2026-10-15T10:34:53+00:00","Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI, and Iron Man services.",{"slug":104,"title":105,"published_at":106,"brief":107},"ghostaction-compromises-about-1-900-github-accounts-targets-over-30-000-reposito-871699","GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories","2026-10-15T08:45:10+00:00","GhostAction campaign compromises 1,900 GitHub accounts, targets 30,000+ repositories.",{"slug":109,"title":110,"published_at":111,"brief":112},"langflow-s-critical-authenticated-rce-flaw-targeted-in-1-423-honeypot-exploit-at-43828a","Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts","2026-10-15T07:07:05+00:00","Critical RCE vulnerability in Langflow exploited in 1,423 honeypot attempts.",{"slug":114,"title":115,"published_at":116,"brief":117},"palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution-bc4412","Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution","2026-10-15T06:59:54+00:00","Palo Alto Networks patches PAN-OS zero-day exploited for remote code execution.",[119,123,127,131,135,139],{"slug":120,"title":121,"published_at":122},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","2026-10-18T10:20:20.475+00:00",{"slug":124,"title":125,"published_at":126},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":128,"title":129,"published_at":130},"bae-systems-breach-disrupts-federal-court-infrastructure-via-supply-chain-attack","BAE Systems Breach Disrupts Federal Court Infrastructure via Supply Chain Attack","2026-10-16T08:20:29.888+00:00",{"slug":132,"title":133,"published_at":134},"multiple-critical-vulnerabilities-found-in-cisa-malcolm-network-traffic-analyzer","Multiple Critical Vulnerabilities Found in CISA Malcolm Network Traffic Analyzer","2026-10-15T18:22:08.348+00:00",{"slug":136,"title":137,"published_at":138},"billion-message-phishing-infrastructure-dismantled-by-microsoft-and-partners","Billion-Message Phishing Infrastructure Dismantled by Microsoft and Partners","2026-10-15T12:20:54.937+00:00",{"slug":140,"title":141,"published_at":142},"langflow-rce-flaw-actively-exploited-via-unvalidated-command-injection","Langflow RCE Flaw Actively Exploited via Unvalidated Command Injection","2026-10-15T10:21:22.699+00:00",[144,148,152,156,160],{"slug":145,"name":146,"problem":147},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":149,"name":150,"problem":151},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":153,"name":154,"problem":155},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":157,"name":158,"problem":159},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",{"slug":161,"name":162,"problem":163},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"microsoft\u002Fdefender-for-identity":165,"okta\u002Fidentity-threat-protection":183,"crowdstrike\u002Ffalcon-identity-protection":200,"huntress\u002Fmanaged-itdr":217,"vectra-ai\u002Fvectra-ai-platform":231,"acalvio\u002Fshadowplex-identity-protection":243},{"hq_country":166,"also_provides":167,"reviews":168,"affected":181,"reported":182},"US",[],[169,172,175,178],{"label":170,"url":171},"AV-TEST: business results for Microsoft Defender","https:\u002F\u002Fwww.av-test.org\u002Fen\u002Fantivirus\u002Fbusiness-windows-client\u002Fmanufacturer\u002Fmicrosoft\u002F",{"label":173,"url":174},"ITPro: Microsoft Defender for Business review (2024)","https:\u002F\u002Fwww.itpro.com\u002Fcloud\u002Fcloud-security\u002Fmicrosoft-defender-for-business-review-feature-filled-enterprise-security-for-small-businesses",{"label":176,"url":177},"PeerSpot: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fmicrosoft-defender-for-endpoint-reviews",{"label":179,"url":180},"Gartner Peer Insights: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fmicrosoft-defender-for-endpoint",244,105,{"hq_country":166,"also_provides":184,"reviews":185,"affected":198,"reported":199},[],[186,189,192,195],{"label":187,"url":188},"TechRadar: Okta review (2023)","https:\u002F\u002Fwww.techradar.com\u002Freviews\u002Fokta-review",{"label":190,"url":191},"PeerSpot: Okta Platform user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fokta-platform-reviews",{"label":193,"url":194},"Gartner Peer Insights: Okta Workforce Identity user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fokta-workforce-identity",{"label":196,"url":197},"CSO Online: Okta bets on identity to control AI agents, but is identity enough? (2026)","https:\u002F\u002Fwww.csoonline.com\u002Farticle\u002F4225230\u002Fokta-bets-on-identity-to-control-ai-agents-but-is-identity-alone-enough.html",1,3,{"hq_country":166,"also_provides":201,"reviews":202,"affected":215,"reported":216},[],[203,206,209,212],{"label":204,"url":205},"SE Labs enterprise endpoint test Apr-Jun 2026: CrowdStrike Falcon","https:\u002F\u002Fselabs.uk\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fsecurity-evaluation-test-report-enterprise-crowdstrike-falcon-2026-07-factsheet.pdf",{"label":207,"url":208},"AV-Comparatives EPR test 2025: CrowdStrike Falcon Enterprise","https:\u002F\u002Fwww.av-comparatives.org\u002Fwp-content\u002Fuploads\u002F2025\u002F09\u002FEPR_CrowdStrike_2025.pdf",{"label":210,"url":211},"Gartner Peer Insights: CrowdStrike Falcon user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcrowdstrike-falcon",{"label":213,"url":214},"PeerSpot: CrowdStrike Falcon user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fcrowdstrike-falcon-reviews",4,15,{"hq_country":166,"also_provides":218,"reviews":219,"affected":229,"reported":230},[],[220,223,226],{"label":221,"url":222},"Gartner Peer Insights: Huntress Managed EDR user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fhuntress-managed-edr",{"label":224,"url":225},"PeerSpot: Huntress Managed EDR user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fhuntress-managed-edr-reviews",{"label":227,"url":228},"The Register: Huntress's attacker surveillance splits infosec community (2025)","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2025\u002F09\u002F12\u002Fhuntresss-attacker-surveillance-splits-infosec-community\u002F865218",0,54,{"hq_country":166,"also_provides":232,"reviews":236,"affected":229,"reported":198},[233],{"slug":234,"name":235},"network-detection-response","Network detection and response (NDR)",[237,240],{"label":238,"url":239},"Gartner Peer Insights: Vectra AI Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fvectra-ai-platform",{"label":241,"url":242},"PeerSpot: Vectra AI user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fvectra-ai-reviews",{"hq_country":166,"also_provides":244,"reviews":248,"affected":229,"reported":229},[245],{"slug":246,"name":247},"deception","Deception and honeypots",[249],{"label":250,"url":251},"Gartner Peer Insights: ShadowPlex Advanced Threat Defense user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fshadowplex-advanced-threat-defense"]