What is ITDR?

Cyberattacks now cost organizations ~$3.6 million per incident (World Economic Forum)

Gartner uses the Identity Threat Detection and Response (ITDR) category to describe solutions that protect identity systems like Active Directory (AD). Because many attacks involve identity systems like AD and Azure AD, Gartner devised the category for ITDR solutions that can help protect your business and strengthen operational resilience in the face of increasing cyber threats.


More than 90% of enterprises use AD and Azure AD to control access to user accounts, systems, and services—a treasure trove for cyber attackers.


ITDR is getting a lot of industry attention and CISO buzz. But any successful ITDR strategy must start with Microsoft Active Directory. Learn how IT and security leaders evaluate ITDR solutions—and what you should look for to strengthen operational resilience.


Protect My Identity Systems

Aside from ransomware demands and regulatory fines, successful attacks can gobble up resources, cause extended downtime, and severely damage your reputation with consumers. Guarding AD and Azure AD—the keys to your digital kingdom—with ITDR tools makes it more difficult for attackers who breach endpoint defenses to do damage and gain additional leverage once inside your network. They can also help you spot attacks in progress so that you can shut down attackers and repair any harm as quickly as possible.

What does a successful ITDR solution look like?

End-to-end baggage process

A successful ITDR solution focuses on the entire attack lifecycle—before, during, and after an attack—providing prevention, detection, automatic remediation, and recovery. And it offers specific protection for AD and Azure AD.

Other critical factors for ITDR include:

  • Security posture assessment and real-time monitoring
  • Fast, malware-free multi-forest AD backup and recovery
  • Automatic remediation of detected threats
  • Risk scoring, risk prioritization, and remediation guidance
  • Post-breach forensics analysis