# Best ITDR Solutions for Business (2026)

Compare 7 ITDR solutions, like Microsoft Defender for Identity, CrowdStrike and SentinelOne, on identity attack detection, inline blocking and alert noise.

We pick every solution on this list [on merit](https://cybersectools.com/methodology#shortlist-order). Featured vendors that made the list are shown first.

Source: https://cybersectools.com/shortlists/best-itdr-solutions
Updated: 2026-11-01
Edition: Fall 2026.
Reviewed by Nika (Nikoloz) Kokhreidze, CybersecTools.

## Executive summary

As of November 2026, CybersecTools tracks 405 companies that sell IAM solutions as their main business. Identity Threat Detection and Response is part of that family. The largest groups are based in the United States, Canada and Israel. In the last 12 months they raised $4.3B across 60 funding rounds, 24 companies were acquired and 34 new companies started in the last two years.

From that field we chose seven solutions that spot and stop attacks on your user accounts, from stolen passwords to attackers moving between machines. Microsoft Defender for Identity suits companies on Microsoft, because it watches on-premises Active Directory and feeds alerts into the rest of the Defender stack. CrowdStrike Falcon Next-Gen Identity Security fits teams already on Falcon, since identity alerts sit next to endpoint alerts in one console. SentinelOne Singularity Identity Security suits SentinelOne customers, because identity protection runs in the same agent.

The main choice is between an add-on to a platform you already run and a standalone product. Silverfort sits inside the sign-in flow and can block a risky login or ask for MFA, while Proofpoint and Vectra AI focus on detection.

Ask each vendor how many alerts a normal week brings, because alert noise is the most common complaint in this category.

## How we evaluated

We looked at 79 identity threat detection and response solutions from 58 companies, and the 7 on this page made the cut. We combined our judgment from years of leading enterprise security programs with market data from [Mandos](https://mandos.io/data/companies?utm_source=cybersectools.com&utm_medium=shortlist), our market intelligence platform, and with the vendor and review pages listed under Sources at the end of this page. For customer feedback, we left out paid reviews, reviews by vendor staff or partners, review campaigns and anything older than two years, so you get an accurate view of what customers say.

Four traits mattered most: detection of identity attacks in Active Directory and cloud identity providers; response such as blocking, MFA or disabling accounts; finding risky settings before attackers do; and fit with the security products you already run. Our IAM and PAM shortlists cover sign-in and privileged accounts. The order follows how widely each product is used by teams like yours. Company momentum shows how the vendor itself is growing, so a market leader can rank first with a lower score.

Read the full method: https://cybersectools.com/methodology#why

## What is Identity Threat Detection and Response

Identity threat detection and response (ITDR) products watch how accounts sign in and what they do, then flag and stop attacks that use stolen or misused logins. They monitor Active Directory and cloud identity providers such as Microsoft Entra ID. They catch attacks like password spraying, Kerberoasting and lateral movement, and many also find risky settings before attackers do.

This matters because attackers rarely break in anymore when they can log in. Once they hold one account, they move toward admin rights. ITDR shows that path and can cut it off, which other security products often miss because the activity looks like normal work.

### Compare Identity Threat Detection and Response solutions

This analysis focuses on seven ITDR solutions. The table compares them on vendor, who each one is best for, deployment model and the NIST CSF functions they cover.

| # | Solution | Best for | Starting price | Deployment | Company size | NIST CSF functions |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [Microsoft Defender for Identity](https://cybersectools.com/tools/microsoft-defender-for-identity) | Microsoft shops with on-premises Active Directory | Contact sales | Hybrid | SMB to Enterprise | Protect, Detect, Respond |
| 2 | [CrowdStrike Falcon Next-Gen Identity Security](https://cybersectools.com/tools/crowdstrike-falcon-identity-security) | Teams already running CrowdStrike Falcon | Contact sales | Cloud | SMB to Enterprise | Protect, Detect |
| 3 | [SentinelOne Singularity Identity Security](https://cybersectools.com/tools/sentinelone-singularity-identity-security) | SentinelOne customers adding identity protection | Contact sales | Hybrid | SMB to Enterprise | Identify, Protect, Detect, Respond |
| 4 | [Silverfort Identity Threat Detection & Response (ITDR)](https://cybersectools.com/tools/silverfort-identity-threat-detection-and-response-itdr) | Companies that want to block risky logins inline | Contact sales | Hybrid | SMB to Enterprise | Protect, Detect, Respond |
| 5 | [Zscaler Identity Protection](https://cybersectools.com/tools/zscaler-identity-protection) | Zscaler customers wanting identity risk checks | Contact sales | Cloud | SMB to Enterprise | Identify, Detect, Respond |
| 6 | [Proofpoint Identity Threat Defense](https://cybersectools.com/tools/proofpoint-identity-threat-defense) | Companies wanting to find and close attack paths | Contact sales | Cloud | Mid-Market to Enterprise | Detect, Respond |
| 7 | [Vectra AI ITDR](https://cybersectools.com/tools/vectra-ai-identity-coverage) | Microsoft and AWS shops with hybrid identities | Contact sales | Hybrid | Mid-Market to Enterprise | Detect |

Vendors change prices, so check before you buy.

**See every Identity Threat Detection and Response solution we list**

The full Identity Threat Detection and Response market, filtered by company size, deployment and NIST coverage.

[Browse Identity Threat Detection and Response solutions →](https://cybersectools.com/categories/itdr)

### 1. Microsoft Defender for Identity

**[Microsoft](https://mandos.io/data/companies/microsoft?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. Identity threat detection and response solution for Active Directory

Redmond, United States · Founded 1975 · Public company · Momentum 59/100 (Mandos)

Certifications: SOC 2, ISO 27001, FedRAMP, PCI DSS, HIPAA

**Best for:** Microsoft shops with on-premises Active Directory

Product page: https://cybersectools.com/tools/microsoft-defender-for-identity

#### At a glance

- Vendor: Microsoft
- Headquarters: Redmond, United States
- Founded: 1975
- Ownership: Public company (MSFT)
- Deployment: Hybrid
- Company size: SMB, Mid-Market, Enterprise
- NIST CSF: Protect, Detect, Respond
- Pricing: Contact sales

#### Our take

Microsoft Defender for Identity uses sensors on your on-premises servers and connectors for cloud identity providers to detect identity attacks. It also finds risky settings and can respond automatically to accounts that look compromised. It covers non-human identities too.

Its alerts flow into Microsoft Defender XDR, so they join endpoint and email alerts in one incident. It also works with privileged access products such as Idira, BeyondTrust and Delinea.

It leads this list because most companies still run on-premises Active Directory, and this product watches it from the inside while feeding the same Defender incidents your analysts already work. If you are a Microsoft shop, it is often the shortest path to identity detection. If your endpoint and SOC stack is not Microsoft, weigh how much of that value carries over.

#### Microsoft Defender for Identity main features

- Dedicated sensors for on-premises infrastructure
- Purpose-built connectors for cloud identity providers
- Proactive posture and vulnerability management
- Advanced identity threat detections
- Automated response to compromised identities
- Pre-installed agent deployment
- Enhanced identity inventory
- Non-human identity protection

#### Microsoft Defender for Identity main integrations

Idira, BeyondTrust, Delinea

#### What customers say

Sentiment: 36% positive · 41% mixed · 23% negative (from first-hand public reviews and comments, 2025 to 2026).
Most criticized: False positives, Stability.

Defender for Identity watches on-premises Active Directory for signs of credential theft and unusual sign-ins, and it fits naturally for companies already on Microsoft 365 and Entra ID. Reviewers say it catches identity attacks they would struggle to spot otherwise, and several found it quick to deploy. The catch is noise and upkeep, because normal activity sets off many alerts that someone has to clear, and the sensors on domain controllers need the right ports and settings or they stop reporting.

#### Before you buy

Where it is strong:

- Alerts join other Defender alerts in one incident
- Sensors built for on-premises Active Directory
- Automated response to compromised identities

Ask in the demo:

- Check which Microsoft license includes it
- Plan time for sensor setup and health checks
- Ask how to tune alerts for your environment

### 2. CrowdStrike Falcon Next-Gen Identity Security

**[CrowdStrike](https://mandos.io/data/companies/crowdstrike?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. Identity security platform protecting identities across attack chains

Austin, United States · Founded 2011 · Public company · Momentum 74/100 (Mandos)

Certifications: SOC 2, ISO 27001, FedRAMP, PCI DSS, HIPAA

**Best for:** Teams already running CrowdStrike Falcon

Product page: https://cybersectools.com/tools/crowdstrike-falcon-identity-security

#### At a glance

- Vendor: CrowdStrike
- Headquarters: Austin, United States
- Founded: 2011
- Ownership: Public company (CRWD)
- Deployment: Cloud
- Company size: SMB, Mid-Market, Enterprise
- NIST CSF: Protect, Detect
- Pricing: Contact sales

#### Our take

CrowdStrike Falcon Next-Gen Identity Security protects human, non-human and AI identities as part of the Falcon platform. It covers on-premises Active Directory and cloud identities in Entra ID and Okta.

Because it runs on the Falcon platform, identity activity sits next to endpoint activity, which helps when you follow an attacker from a laptop to an account.

It earns its place for teams already on Falcon, because you add a module to an agent you already run instead of deploying something new. It covers both Entra ID and Okta, so it fits mixed identity estates. It detects and stops attacks but does not manage access, so keep your governance and PAM plans separate.

#### CrowdStrike Falcon Next-Gen Identity Security main features

- Continuous identity security
- Coverage of human identities
- Coverage of non-human identities
- Coverage of AI identities

#### CrowdStrike Falcon Next-Gen Identity Security main integrations

Active Directory, Entra ID, Okta

#### What customers say

Sentiment: 91% positive · 9% mixed · 0% negative (from first-hand public reviews and comments, 2026).
Most praised: Integrations, Setup, Asset discovery.
Most criticized: False positives, Missing features.

Falcon Identity Security watches for identity attacks such as stolen credentials and lateral movement across on-site and cloud user directories, and that visibility is what customers value most. It's quick to deploy, especially for teams already on Falcon, since identity and endpoint activity then sit in one console. The catch is tuning, because it flags legitimate users and older apps at first and takes longer than expected to quiet down. It also detects threats rather than managing access, so you still need separate identity governance and privileged access products.

#### Before you buy

Where it is strong:

- Identity and endpoint activity in one console
- Covers Active Directory, Entra ID and Okta
- Protects human, non-human and AI identities

Ask in the demo:

- Ask how it is licensed next to your Falcon modules
- Plan time to tune alerts after rollout
- Confirm it covers every identity provider you run

### 3. SentinelOne Singularity Identity Security

**[SentinelOne](https://mandos.io/data/companies/sentinelone?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. Identity threat detection and response platform for hybrid environments

Mountain View, United States · Founded 2013 · Public company · Momentum 73/100 (Mandos)

Certifications: SOC 2, ISO 27001, FedRAMP, PCI DSS, HIPAA, FIPS 140

**Best for:** SentinelOne customers adding identity protection

Product page: https://cybersectools.com/tools/sentinelone-singularity-identity-security

#### At a glance

- Vendor: SentinelOne
- Headquarters: Mountain View, United States
- Founded: 2013
- Ownership: Public company (S)
- Deployment: Hybrid
- Company size: SMB, Mid-Market, Enterprise
- NIST CSF: Identify, Protect, Detect, Respond
- Pricing: Contact sales

#### Our take

SentinelOne Singularity Identity Security collects endpoint and identity activity through one agent. It detects credential theft, privilege escalation and lateral movement in real time. It also checks Active Directory and cloud identity providers for risky settings, watches for leaked credentials and uses decoys to catch attackers early.

It works with identity providers such as Microsoft Entra ID, Okta, Ping Identity, Duo Security and SecureAuth.

Singularity Identity is here because it adds decoys and leaked-credential checks on top of detection, which gives you early warning before an attacker reaches a domain controller. It makes most sense if SentinelOne already runs on your endpoints. Ask what the full feature set takes to switch on beyond the base deployment, so you budget for it up front.

#### SentinelOne Singularity Identity Security main features

- Unified endpoint and identity telemetry collection via single agent
- Real-time detection of credential theft and privilege escalation
- Active Directory and cloud identity provider monitoring
- Identity posture management and misconfiguration detection
- Active deception technology for early threat detection
- Dark web credential exposure monitoring
- Automated remediation workflows for compromised identities
- Correlation of endpoint and identity activity

#### SentinelOne Singularity Identity Security main integrations

Microsoft Entra ID, Okta, SecureAuth, Active Directory, Ping Identity, Duo Security

#### What customers say

Singularity Identity is valued for alerts that arrive on time and carry enough context to act on, which helps teams focus on real identity threats instead of noise. Basic setup goes quickly, but reaching the full feature set takes longer and often means paid training or professional services.

#### Before you buy

Where it is strong:

- Identity protection in the same agent as endpoint defense
- Decoys that catch attackers early
- Checks for risky settings and leaked credentials

Ask in the demo:

- Ask which modules include account response
- Check the setup guides for the decoys
- Test detection on your own Active Directory

### 4. Silverfort Identity Threat Detection & Response (ITDR)

**[Silverfort](https://mandos.io/data/companies/silverfort?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. Detects & blocks identity-based threats in real-time across hybrid environments

Tel Aviv, Israel · Founded 2016 · $223M raised · Momentum 52/100 (Mandos)

Certifications: SOC 2, ISO 27001

**Best for:** Companies that want to block risky logins inline

Product page: https://cybersectools.com/tools/silverfort-identity-threat-detection-and-response-itdr

#### At a glance

- Vendor: Silverfort
- Headquarters: Tel Aviv, Israel
- Founded: 2016
- Deployment: Hybrid
- Company size: SMB, Mid-Market, Enterprise
- NIST CSF: Protect, Detect, Respond
- Pricing: Contact sales

#### Our take

Silverfort Identity Threat Detection & Response (ITDR) sits inside the sign-in flow, so it sees every login and access attempt across Active Directory, cloud and SaaS apps. It inspects protocols such as Kerberos and learns how each identity normally behaves.

It detects attacks such as Pass-the-Hash, Pass-the-Ticket, Kerberoasting, DCSync and password spraying. Because it sits inline, it can deny access, ask for MFA or end a session while the attack is still happening.

Silverfort is the standalone pick for prevention, because it can stop a risky login instead of only raising an alert. That fits you if you need MFA on old systems and protocols that never supported it. Since it sits in the sign-in path, plan how you test and roll it out so a wrong block does not lock out real users.

#### Silverfort Identity Threat Detection & Response (ITDR) main features

- Real-time monitoring of all authentication and access attempts
- Protocol anomaly detection for Kerberos and other authentication protocols
- Identity behavior baseline analysis
- Detection of Pass-the-Hash, Pass-the-Ticket, Kerberoasting, and DCSync attacks
- Detection of brute force, password spraying, and credential stuffing
- Inline blocking and access denial
- MFA challenge enforcement during suspicious authentication
- Session termination capabilities

#### Silverfort Identity Threat Detection & Response (ITDR) main integrations

Active Directory, Entra ID, Okta, Ping, AWS, CrowdStrike

#### Before you buy

Where it is strong:

- Blocks risky logins while they happen
- MFA prompts for suspicious sign-ins
- Covers Active Directory, cloud and SaaS apps

Ask in the demo:

- Ask how it fits into your sign-in flow
- Test what users see when it asks for MFA
- Ask for customer references at your size

**Alternatives to each solution on this list**

The closest Identity Threat Detection and Response alternatives for every pick, matched on features and integrations.

[See Identity Threat Detection and Response alternatives →](https://cybersectools.com/alternatives)

### 5. Zscaler Identity Protection

**[Zscaler](https://mandos.io/data/companies/zscaler?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. ITDR solution for continuous identity monitoring and threat detection

San Jose, United States · Founded 2008 · Public company · Momentum 68/100 (Mandos)

Certifications: SOC 2, ISO 27001, ISO 27017, ISO 27018, FedRAMP, PCI DSS

**Best for:** Zscaler customers wanting identity risk checks

Product page: https://cybersectools.com/tools/zscaler-identity-protection

#### At a glance

- Vendor: Zscaler
- Headquarters: San Jose, United States
- Founded: 2008
- Ownership: Public company (ZS)
- Deployment: Cloud
- Company size: SMB, Mid-Market, Enterprise
- NIST CSF: Identify, Detect, Respond
- Pricing: Contact sales

#### Our take

Zscaler Identity Protection is built into Zscaler Client Connector, the Zscaler agent on each device. It scores identity risk, watches for changes to settings and permissions, and finds exposed or weak passwords on endpoints.

It detects attacks such as DCSync, DCShadow, Kerberoasting and LDAP enumeration, maps them to MITRE ATT&CK and can contain them through zero trust access rules. Its remediation guidance includes scripts and commands for each finding.

It belongs on this list if you already run Zscaler, because it switches on in the agent your devices already run and can contain an attack through the access rules you already enforce. It also helps you fix Active Directory risks with step-by-step scripts. Outside Zscaler, it has little reason to be your first choice.

#### Zscaler Identity Protection main features

- Identity security assessments with risk scoring
- Real-time monitoring of identity configuration and permission changes
- Detection of DCSync, DCShadow, kerberoasting, and LDAP enumeration attacks
- Endpoint credential exposure identification
- Password analysis for compromised, leaked, or weak passwords
- MITRE ATT&CK framework mapping
- Remediation guidance with video tutorials, scripts, and commands
- Identity attack surface visibility with unified risk scoring

#### Zscaler Identity Protection main integrations

Active Directory

#### Before you buy

Where it is strong:

- Built into the Zscaler agent you may already run
- Risk scoring for identity settings
- Remediation guidance with scripts and commands

Ask in the demo:

- Confirm your Zscaler license includes it
- Ask how containment works with your access rules
- Check coverage for cloud identity providers

### 6. Proofpoint Identity Threat Defense

**[Proofpoint](https://mandos.io/data/companies/proofpoint?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. Identity threat detection and response solution for account protection

Sunnyvale, United States · Founded 2002 · $86M raised · Momentum 57/100 (Mandos)

Certifications: SOC 2, ISO 27001, FedRAMP, PCI DSS, FIPS 140, CSA STAR

**Best for:** Companies wanting to find and close attack paths

Product page: https://cybersectools.com/tools/proofpoint-identity-threat-defense

#### At a glance

- Vendor: Proofpoint
- Headquarters: Sunnyvale, United States
- Founded: 2002
- Deployment: Cloud
- Company size: Mid-Market, Enterprise
- NIST CSF: Detect, Respond
- Starting price: Contact sales

#### Our take

Proofpoint Identity Threat Defense scans continuously for identity exposures and maps the attack paths that lead to your critical assets. It ranks each risk by how easy it is to exploit, finds shadow admins and can fix issues with guidance or automatically.

It detects lateral movement and privilege escalation with agentless decoys, and it captures forensic evidence and timelines of attacker activity. It covers Active Directory and Microsoft Entra ID.

Proofpoint earns its spot for teams that want to shrink the attack surface first, because it shows the shortest routes to your critical assets and helps close them. Its decoys need no agents, which keeps rollout light. It is built for mid-size and large Microsoft estates, so check coverage if you also run another identity provider.

#### Proofpoint Identity Threat Defense main features

- Continuous identity exposure scanning
- Attack path mapping to critical assets
- Risk ranking by exploitability
- Guided or automatic remediation
- Shadow admin detection
- Agentless deception-based detection
- Lateral movement and privilege escalation detection
- Automatic forensic evidence capture

#### Proofpoint Identity Threat Defense main integrations

Active Directory, Microsoft Entra ID

#### Before you buy

Where it is strong:

- Maps attack paths to critical assets
- Finds shadow admins
- Agentless decoys for early detection

Ask in the demo:

- Ask how decoys are placed and maintained
- Test automatic remediation in a pilot
- Check how alerts reach your other security products

### 7. Vectra AI ITDR

**[Vectra AI](https://mandos.io/data/companies/vectra-ai?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. AI-powered ITDR platform detecting identity attacks across hybrid environments

San Jose, United States · Founded 2011 · $353M raised · Momentum 53/100 (Mandos)

Certifications: SOC 2, ISO 27001, FedRAMP, PCI DSS, HIPAA

**Best for:** Microsoft and AWS shops with hybrid identities

Product page: https://cybersectools.com/tools/vectra-ai-identity-coverage

#### At a glance

- Vendor: Vectra AI
- Headquarters: San Jose, United States
- Founded: 2011
- Deployment: Hybrid
- Company size: Mid-Market, Enterprise
- NIST CSF: Detect
- Pricing: Contact sales

#### Our take

Vectra AI ITDR detects attacks on human and machine identities across Active Directory, Microsoft Entra ID, Microsoft 365, Azure and AWS. It looks at how accounts, services and hosts interact to spot credential abuse and privilege misuse.

It offers more than 100 detections for Microsoft environments and 40 for AWS, and it runs on premises, air-gapped, as SaaS or hybrid. It sends alerts to products such as CrowdStrike, SentinelOne, Microsoft Sentinel, Splunk and ServiceNow.

Vectra makes the list for hybrid estates that span Microsoft and AWS, because one product watches identities in both. Its air-gapped option suits regulated or isolated sites that cannot send data to a cloud. It detects rather than blocks inline, so decide which product will act on its alerts.

#### Vectra AI ITDR main features

- Detection of credential attacks including Kerberoasting and brute force
- Monitoring of human and machine identities including service principals
- Graph-based AI algorithm for analyzing account and service interactions
- Coverage for Active Directory, Microsoft Entra ID, Microsoft 365, Azure, and AWS
- Over 100 AI detections for Microsoft environments and 40 for AWS
- MITRE ATT&CK mapping covering 90%+ of relevant techniques
- Attribution to device names and account identities
- Security-enriched metadata across 6 log types and 100+ fields

#### Vectra AI ITDR main integrations

Microsoft Entra ID, CrowdStrike, Microsoft Sentinel, Microsoft Defender for Endpoint, SentinelOne, ServiceNow, Splunk, Active Directory, Microsoft 365, Microsoft Teams, Microsoft Exchange, Microsoft OneDrive, Microsoft SharePoint, Power Automate, Microsoft Azure, AWS S3, AWS EC2, AWS Lambda

#### Before you buy

Where it is strong:

- Covers Active Directory, Entra ID, Microsoft 365 and AWS
- Detections for human and machine identities
- On-premises, air-gapped or SaaS deployment

Ask in the demo:

- Ask whether identity coverage needs the wider Vectra platform
- Check detections for the clouds you run
- Test how alerts reach your SIEM

## How they fit your cybersecurity program (NIST CSF)

NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. The grid shows which functions each pick maps to in our record, so you can see where a solution sits in your program and what it leaves to other controls.

All 7 solutions map to Detect. 2 of 7 map to Identify. 4 of 7 map to Protect. 5 of 7 map to Respond. None map to Govern or Recover.

| Solution | Govern | Identify | Protect | Detect | Respond | Recover |
| --- | --- | --- | --- | --- | --- | --- |
| All solutions on this list | 0 of 7 | 2 of 7 | 4 of 7 | 7 of 7 | 5 of 7 | 0 of 7 |
| Microsoft Defender for Identity | – | – | 1 of 5 (Identity Management, Authentication, and Access Control) | 2 of 2 (Continuous Monitoring, Adverse Event Analysis) | 1 of 4 (Incident Analysis) | – |
| CrowdStrike Falcon Next-Gen Identity Security | – | – | 1 of 5 (Identity Management, Authentication, and Access Control) | 1 of 2 (Continuous Monitoring) | – | – |
| SentinelOne Singularity Identity Security | – | 1 of 3 (Risk Assessment) | 1 of 5 (Identity Management, Authentication, and Access Control) | 2 of 2 (Continuous Monitoring, Adverse Event Analysis) | 2 of 4 (Incident Analysis, Incident Mitigation) | – |
| Silverfort Identity Threat Detection & Response (ITDR) | – | – | 1 of 5 (Identity Management, Authentication, and Access Control) | 2 of 2 (Continuous Monitoring, Adverse Event Analysis) | 1 of 4 (Incident Mitigation) | – |
| Zscaler Identity Protection | – | 1 of 3 (Risk Assessment) | – | 2 of 2 (Continuous Monitoring, Adverse Event Analysis) | 1 of 4 (Incident Mitigation) | – |
| Proofpoint Identity Threat Defense | – | – | – | 2 of 2 (Continuous Monitoring, Adverse Event Analysis) | 2 of 4 (Incident Analysis, Incident Mitigation) | – |
| Vectra AI ITDR | – | – | – | 2 of 2 (Continuous Monitoring, Adverse Event Analysis) | – | – |

Each cell shows how many of the function's NIST CSF 2.0 categories the solution maps to, with the category names.

A product helps you reach these outcomes, but it does not make you compliant on its own. Your people and processes do the rest.

## CISO checklist for selecting an Identity Threat Detection and Response product

Work through these steps in order to go from identity risk to a contract you can defend.

1. **List your identity providers, on premises and in the cloud.** Coverage differs between Active Directory and cloud identity.
2. **Check what your current endpoint or Microsoft licenses include.** You may already own part of this.
3. **Decide whether you need detection only or inline blocking.** Inline products change your sign-in flow.
4. **Run a pilot on your own Active Directory.** Real data shows alert volume better than a demo.
5. **Count alerts and false positives during the pilot.** Alert noise is the most common complaint.
6. **Test the response steps, such as MFA or disabling an account.** Response speed decides how far an attacker gets.
7. **Ask how service accounts and AI agents are covered.** Non-human identities are a growing target.
8. **Confirm how alerts reach your SIEM and ticketing.** Identity alerts are often the start of a larger incident.
9. **Price the full identity count for three years.** Add-ons and tiers often change the total.

**Compare Identity Threat Detection and Response solutions side by side**

Features, integrations, NIST coverage and deployment for every Identity Threat Detection and Response solution we list, in one table.

[Compare Identity Threat Detection and Response solutions →](https://cybersectools.com/compare)

## Other solutions we considered for this shortlist

We looked at 57 products for this list. These did not make the 7 above but are worth a look for the right team.

1. [Teleport Identity Security](https://cybersectools.com/tools/teleport-identity-security) · Teleport
   Identity threat detection and response platform for cloud infrastructure
2. [8Layers Cloud Identity Threat Detection](https://cybersectools.com/tools/8layers-cloud-identity-threat-detection) · 8Layers
   Cloud identity threat detection and response platform for human and non-human IDs
3. [Cisco Identity Intelligence](https://cybersectools.com/tools/cisco-identity-intelligence) · Cisco
   AI-powered identity visibility and threat detection solution
4. [Darktrace IDENTITY](https://cybersectools.com/tools/darktrace-identity) · Darktrace
   AI-powered identity threat detection and response for cloud and SaaS environments
5. [Abnormal SaaS Account Takeover Protection](https://cybersectools.com/tools/abnormal-saas-account-takeover-protection) · Abnormal Security
   AI-based account takeover detection and response for SaaS collaboration apps
6. [Saviynt ISPM](https://cybersectools.com/tools/saviynt-ispm) · Saviynt
   Identity Security Posture Management platform for identity risk detection
7. [Bitdefender GravityZone Identity Threat Detection](https://cybersectools.com/tools/bitdefender-gravityzone-identity-threat-detection-and-response) · Bitdefender
   ITDR platform integrated with XDR for identity protection and threat detection
8. [Huntress Managed ITDR](https://cybersectools.com/tools/huntress-managed-itdr) · Huntress
   Managed ITDR solution for 24/7 identity threat detection and response
9. [Delinea Identity Threat Protection](https://cybersectools.com/tools/delinea-identity-threat-protection) · Delinea
   Monitors identities for threats and provides remediation recommendations.

Explore all Identity Threat Detection and Response solutions: https://cybersectools.com/categories/itdr

## Conclusion

Start with the platform you already run. If you are on Microsoft, Defender for Identity may already be in your license. If you run CrowdStrike or SentinelOne on your endpoints, their identity products add coverage without a new agent.

If you want to block risky logins while they happen, Silverfort sits in the sign-in flow. Proofpoint helps you find and close attack paths, Zscaler adds identity risk checks to its agent, and Vectra AI covers Microsoft and AWS identities. For sign-in and privileged accounts, see our IAM and PAM shortlists.

## Frequently Asked Questions

### What is ITDR?

Identity threat detection and response watches how accounts sign in and behave, then flags and stops attacks that use stolen or misused logins. It covers Active Directory and cloud identity providers.

### How is ITDR different from IAM?

IAM decides who can sign in and what they can reach. ITDR watches what happens after sign-in and catches attackers who use a valid login.

### Do I need ITDR if I already have EDR?

Often yes. EDR watches devices, while ITDR watches accounts. An attacker with a stolen password can sign in to cloud apps without touching a device you protect. Some products here run in the same agent as EDR.

### Can ITDR block an attack, or only detect it?

It depends on the product. Some sit in the sign-in flow and can block a login or ask for MFA. Others detect and alert, and some can disable an account automatically.

### Does ITDR cover service accounts and AI agents?

Several products here cover non-human identities, such as service accounts and machine identities, and some now cover AI agents. Ask each vendor what it covers today.

## Sources

These are the pages we reviewed for each pick: the vendor's own product page and website, its market data on Mandos, and every review page we read for customer feedback.

1. **Microsoft Defender for Identity** · Microsoft: [Product page](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-for-identity/) · [Microsoft website](https://www.microsoft.com/) · [Market data on Mandos](https://mandos.io/data/companies/microsoft?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [Gartner Peer Insights](https://www.gartner.com/reviews/product/microsoft-defender-for-identity) · [PeerSpot](https://www.peerspot.com/products/microsoft-defender-for-identity-reviews) · [Reddit: defender for identity sensor 3x](https://www.reddit.com/r/DefenderATP/comments/1qzz68a/defender_for_identity_sensor_3x/) · [Reddit: microsoft defender for identity health issues](https://www.reddit.com/r/DefenderATP/comments/1pd3sr7/microsoft_defender_for_identity_health_issues/) · [G2](https://www.g2.com/products/microsoft-defender-for-identity/reviews) · [Reddit: defender for identity or not](https://www.reddit.com/r/AZURE/comments/1ca8hkx/defender_for_identity_or_not/) · [Reddit: deploying microsoft defender for identity mdi my](https://www.reddit.com/r/DefenderATP/comments/1mcc5h1/deploying_microsoft_defender_for_identity_mdi_my/) · [Reddit: microsoft atp microsoft defender for identity](https://www.reddit.com/r/AZURE/comments/oz4m71/microsoft_atp_microsoft_defender_for_identity/)
2. **CrowdStrike Falcon Next-Gen Identity Security** · CrowdStrike: [Product page](https://www.crowdstrike.com/en-us/platform/next-gen-identity-security/) · [CrowdStrike website](https://www.crowdstrike.com/) · [Market data on Mandos](https://mandos.io/data/companies/crowdstrike?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [G2](https://www.g2.com/products/falcon-identity-protection/reviews) · [Gartner Peer Insights](https://www.gartner.com/reviews/product/falcon-next-gen-identity-security) · [PeerSpot](https://www.peerspot.com/products/crowdstrike-falcon-next-gen-identity-security-reviews)
3. **SentinelOne Singularity Identity Security** · SentinelOne: [Product page](https://www.sentinelone.com/platform/identity/) · [SentinelOne website](https://www.sentinelone.com/) · [Market data on Mandos](https://mandos.io/data/companies/sentinelone?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [Gartner Peer Insights](https://www.gartner.com/reviews/product/singularity-identity) · [Reddit](https://www.reddit.com/r/SentinelOneXDR/comments/1qojw3f/identity_security_detection_response_idr_setup/) · [G2](https://www.g2.com/products/sentinelone-singularity-identity-detection-response/reviews) · [PeerSpot](https://www.peerspot.com/products/sentinelone-singularity-identity-reviews)
4. **Silverfort Identity Threat Detection & Response (ITDR)** · Silverfort: [Product page](https://www.silverfort.com/platform/identity-threat-detection-and-response/) · [Silverfort website](https://www.silverfort.com/) · [Market data on Mandos](https://mandos.io/data/companies/silverfort?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos)
5. **Zscaler Identity Protection** · Zscaler: [Product page](https://www.zscaler.com/products-and-solutions/zscaler-itdr/) · [Zscaler website](https://www.zscaler.com/) · [Market data on Mandos](https://mandos.io/data/companies/zscaler?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos)
6. **Proofpoint Identity Threat Defense** · Proofpoint: [Product page](https://www.proofpoint.com/us/products/identity-threat-detection-response/) · [Proofpoint website](https://www.proofpoint.com/) · [Market data on Mandos](https://mandos.io/data/companies/proofpoint?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [Gartner Peer Insights](https://www.gartner.com/reviews/product/proofpoint-identity-threat-defense)
7. **Vectra AI ITDR** · Vectra AI: [Product page](https://www.vectra.ai/products/itdr) · [Vectra AI website](https://www.vectra.ai/) · [Market data on Mandos](https://mandos.io/data/companies/vectra-ai?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [PeerSpot](https://www.peerspot.com/products/vectra-ai-reviews)

---

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md.

More on the vendors on this list: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=shortlist-md