GigaOm Radar for Identity Threat Detection and Response (ITDR) v3

Identity is a crucial component of any organization's IT infrastructure, serving as the way to manage access to its IT assets.

Both human and nonhuman identities carry privileges that make them prime targets for cyberattackers. Therefore, attempts to steal identities and their associated credentials are becoming increasingly common and sophisticated, making it more difficult to identify and stop these attacks. It is not only the sophistication of such attacks, which now leverage automation and generative AI (GenAI) to conduct reconnaissance and execute large-scale campaigns, but the sheer scale of the attack surface with complex identity ecosystems spanning cloud services, SaaS platforms, and on-prem environments, making the attacker's job easier and the defender’s job more complex.

Proactive, technology-led tooling is needed to tackle this challenge, leading to the development of the identity threat detection and response (ITDR) market. ITDR tools help identify and mitigate potential threats autonomously, accurately, and more quickly than human security teams can, and leading solutions now incorporate AI-driven analytics, predictive risk scoring, and automated incident response for faster threat identification and mitigation. Emerging capabilities such as AI-enhanced SecOps copilots and deception technology are becoming mainstream, enabling proactive defense and reducing alert fatigue.

Any business, regardless of size or industry, is at risk of an identity breach. Cybercriminals will use identity to gain access to the business systems they will use to carry out attacks (ranging from data theft to ransomware attacks and large-scale fraud) on that organization, its partners, or its customers. Finding effective ways to identify threats and quickly reduce the risk they pose must be a priority in any organization’s cybersecurity strategy. ITDR has the potential to become a major component in addressing the risk posed by identity-based attacks.

The ITDR market continues to evolve to address these new challenges. Vendors are differentiating through advanced AI capabilities, comprehensive multi-IdP integration, and lifecycle management for nonhuman identities (NHIs), including agentic AI. The market continues to evolve with a focus on platforms that deliver proactive protection, deep integration, and scalable automation.

The ITDR market vendors continue to evolve from two main approaches. Specialist ITDR platforms are built to tackle identity specifically and to work alongside a customer’s existing stack. Broad platform vendors have made identity a core part of existing threat detection platforms, adding identity telemetry to sophisticated engines to deliver identity-focused responses.

This is our third year evaluating the ITDR space. This report builds on our previous analysis and considers how the market has evolved over the last year.

This GigaOm Radar report examines 20 of the top ITDR solutions and compares offerings against capabilities (table stakes, key features, and emerging features) and nonfunctional requirements (business criteria). It provides an overview of the market, identifies leading ITDR offerings, and helps decision-makers evaluate these solutions so they can make a more informed investment decision.

To help prospective customers find the best fit for their use case and business requirements, we assess how well ITDR solutions are designed to serve specific target markets and deployment models (Table 1).

For this report, we recognize the following market segments:

• Small-to-medium business (SMB): In this category, we assess solutions on their ability to meet the needs of small and midsize organizations. Here, ease of use and deployment are more important than extensive management functionality and feature set.

• Large enterprise: Here, offerings are assessed on their ability to support large and business-critical projects. Optimal solutions in this category strongly focus on flexibility, performance, scalability, and the ability to integrate into existing environments effectively.

• Managed service provider (MSP): Increasingly, organizations across all IT disciplines are looking to managed services to augment in-house capabilities. Here, we assess vendors on how effectively they support MSPs, both technically and commercially, or on their ability to offer their own managed services.

In addition, we recognize the following deployment models:

• SaaS: These solutions exist exclusively in the cloud and are managed by the service provider. Their benefits include simplicity, quick scaling, and flexible licensing. Although some parts, like scanners, might need physical installation, for this report, a SaaS solution is one where the central management and intelligence features are provided as SaaS.

• Self-hosted (on-prem): With these solutions, the main management and intelligence components are entirely installable on-prem, either in the customer’s data center or a colocation facility. They are not shared and are dedicated to a single customer.

• Self-hosted (cloud): These solutions feature main management and intelligence components installable on cloud-based machines within a customer's cloud tenant. They are dedicated and specific to a single customer.

• Vendor-managed service: In this model, the vendor handles all management and operations. For this report, this means it is fully managed by the vendor directly and not by one of its partners. However, comanagement (shared operations between provider and customer) is also acceptable.

Table 1. Vendor Positioning: Target Market and Deployment Model

Table 1 components are evaluated in a binary yes/no manner and do not factor into a vendor’s designation as a Leader, Challenger, or Entrant on the Radar chart (Figure 1).

“Target market” reflects which use cases each solution is recommended for, not simply whether that group can use it. For example, if an SMB could use a solution but doing so would be cost-prohibitive, that solution would be rated “no” for SMBs.

All solutions included in this Radar report meet the following table stakes—capabilities widely adopted and well implemented in the sector:

• Posture assessment

• Common IDP integration

• Central dashboard

• Central alerting

• Manual incident response

• Risk prioritization

Tables 2, 3, and 4 summarize how each vendor in this research performs in the areas we consider differentiating and critical in this sector. The objective is to give the reader a snapshot of the technical capabilities of available solutions, define the perimeter of the relevant market space, and gauge the potential impact on the business.

• Key features differentiate solutions, highlighting the primary criteria to be considered when evaluating an ITDR solution

• Emerging features show how well each vendor implements capabilities that are not yet mainstream but are expected to become more widespread and compelling within the next 12 to 18 months

• Business criteria provide insight into the nonfunctional requirements that factor into a purchase decision and determine a solution’s impact on an organization

These decision criteria are summarized below.

Key Features

• Nonhuman identity (NHI) security: This refers to digital identities assigned to applications, services, scripts, bots, and other processes. These identities are vital for machine-to-machine communication, API integrations, cloud workloads, and various automated tasks. This risk is exacerbated by the increased use of AI tools. These identities are becoming more vulnerable to risks and require mitigation measures, just like human accounts.

• Proactive protection: Responding to a threat is important, but proactively preventing it is essential. Platforms with proactive features, like gathering intelligence on potential account sharing or using deception technology to detect attacks, can reduce the likelihood of actual incidents. The use of posture management checks, allowing customers to get a proactive view of security misconfigurations, is also an extremely valuable capability.

• Extended IAM integration: Discovering identity threats can be complex because identities exist in multiple locations. As a result, solutions that offer a wide range of integrations with various identity platforms, whether they are cloud, SaaS, or on-prem, will provide a more comprehensive understanding of risk.

• AI-enhanced SecOps: The use of AI assistants in ITDR solutions will help make them more proactive by detecting threats before they cause significant damage, more accurate by reducing false positives and improving threat detection, and more efficient by automating tasks and reducing the workload on security teams.

• Compliance management: Solutions should be capable of measuring identity threats against established compliance and governance standards. Mapping identity risk to frameworks like MITRE ATT&CK helps organizations use consistent terminology to describe threats and risks. Additional value is gained from vendors offering comprehensive support across a wide range of legal, security, and privacy frameworks.

• Enterprise security reporting: Gaining proper insight into identity threats will benefit all organizations. Solutions should offer a broad range of reports, including benchmarking, risk analysis, audit logging, and risk scoring.

• Automated incident response: For effectiveness, ITDR solutions must automate threat response, isolate attacks, and prevent their spread through actions such as sign-out, access blocking, and account disabling, either natively or via third-party tools.

• Incident response analysis: Organizations must investigate incidents to identify threats, understand their occurrence, and mitigate future risks. Solutions should log the actions leading to events, enabling detailed investigations by security teams. Those using AI tools effectively in areas such as prioritization, attack path mapping, and summarization will also bring additional value.

Table 2. Key Features Comparison

Emerging Features

• Risk-adaptive access controls: Identity risk is rapidly evolving, but customers prefer to avoid overly restrictive or harsh controls. Therefore, tools that can dynamically adjust or enforce access controls based on real-time identity risk assessments add value and effectiveness. Solutions, for example, that can step up authentication, restrict certain actions, or integrate with conditional access policies as a user’s risk level changes can help provide a more dynamic and appropriate response to risk.

• AI agent security: Risks surrounding the use of AI are developing rapidly, and AI agents represent the next frontier of NHI risks to organizations. AI agents, unlike traditional NHIs, are autonomous, take actions, and often have broad permissions, with the potential that their scope and behavior change. Securing AI agents requires new approaches beyond traditional NHI security, and this will be an increasing demand for any identity threat prevention tool.

• Predictive identity threat prevention: While proactively reducing risk and quickly detecting identity-based attacks are crucial, the ability to identify potential indicators of an identity attack is equally essential in the modern identity security toolkit. This marks an evolution from reactive ITDR to proactive identity threat prevention and response (ITPR) and is vital for reducing the risk of identity compromise. It will also be much more effective than trying to identify and stop attacks in real time.

• Identity attack path analysis: Tools that can analyze and visualize potential attack paths showing how an adversary could move laterally or escalate privileges through various identity links and misconfigurations are a powerful security capability. Customers increasingly will want this type of visibility to support them in identifying potential attack pathways through an organization, providing them with the ability to close potential risk paths ahead of any attack.

Table 3. Emerging Features Comparison

Business Criteria

• Flexibility: Customer needs are dynamic, requiring equally adaptable solutions. They must integrate with existing systems, provide a range of deployment models, and be sufficiently versatile to meet a business's changing demands.

• Scalability: Organizations need adaptable solutions that can scale with and evolve as needs change. This can mean scaling to meet increasing user numbers or evolving technical and business requirements, like new applications or the acquisition of new businesses.

• Ease of management: Identity security is challenging. Solutions should simplify management and lower operational costs. User-friendly interfaces, reliable support, training, and guidance help with this, along with strong commercial backing to aid customers in adopting the technology.

• Cost transparency: Solutions should provide transparent pricing, allowing customers to quickly assess the potential investment they need to make. Vendors that do this help increase adoption and improve product value, resulting in better customer ROI. Other factors that can impact cost, such as the ease of integration into existing systems, should also be taken into account. Additionally, solutions that utilize automation can promote cost efficiency and reduce overall expenses.

• Ecosystem: Many ITDR vendors provide additional value through management tools, reporting platforms, and threat analysis solutions, along with nontechnical options like educational events and professional services. Organizations should also consider the range of available partners within a vendor ecosystem.

• Interoperability: An ITDR strategy cannot be effective in a silo. Solutions must therefore integrate with the tools customers already use, including operational tools such as service desk systems and SIEM solutions. These integrations are key to ensuring ITDR is part of the organization's existing security workflows.

Table 4. Business Criteria Comparison

The GigaOm Radar plots vendor solutions across a series of concentric rings, with those positioned closer to the center being judged as having the most complete solution. The chart characterizes each vendor on two axes—balancing Maturity versus Innovation and Feature Play versus Platform Play—while providing an arrowhead that projects each solution’s expected evolution over the coming 12 to 18 months.

Figure 1. GigaOm Radar for ITDR

As you can see in Figure 1, the ITDR market is well served with a diverse range of vendors. This reflects the diversity of approaches in the ITDR market, ranging from broad Platform Play solutions that address identity threats comprehensively to Feature Play vendors that focus on specific identity platforms or targeted methods such as deception technology.

The rapidly changing nature of the identity threat is also reflected in the evolving landscape of vendors addressing it, as evidenced by the near-equal distribution across the Maturity and Innovation hemispheres. All vendors continue to innovate in their solutions, but those on the Innovation side are often driving significant changes to their platforms through acquisition.

There are no Entrants on the chart, with the vendors in the report divided between Leaders and Challengers. This indicates that not only does the sector have some strong vendors executing well across all metrics, but these vendors will continue to be challenged and pushed to maintain strong delivery by a range of competitors, including several near the edge of the Leaders circle that will keep developing their platforms and pushing those ahead of them. The Leaders in the report tend to excel in specific areas, including the ability to respond to and support incident investigation. Their strength lies in supporting operational efficiency with targeted and well-executed use of AI to enhance SecOps efficiency. They also tend to be strong in proactive identity threat mitigation strategies, whether through technology such as deception techniques or the increasing use of identity security posture management, allowing customers to identify risk vectors and address them proactively.

Development pace across all vendors remains strong, in line with the evolving nature of the identity threat. However, a few vendors were highlighted as Outperformers. These vendors not only delivered a range of significant additions to their platforms but also maintained aggressive roadmaps and demonstrated strong capabilities in emerging areas, including agentic AI security and dynamic identity controls.

Compared to our previous report, there have been some changes in chart positioning and vendor counts. The number of vendors has increased from 16 to 20, indicating more vendors meeting our metrics. This number also reflects some changes, as certain vendors have been removed due to acquisitions or because ITDR is no longer offered as a standalone solution, having been absorbed into broader platforms and becoming a feature rather than a separate ITDR product.

The chart depicts a buoyant market, with a variety of strong vendors that are continually evolving. The distribution of vendors across the chart's quadrants illustrates different approaches and focuses, which should assist organizations seeking to address ITDR, as vendors should engage to satisfy both broad and specific needs.

In reviewing solutions, it’s important to keep in mind that there are no universal “best” or “worst” offerings; every solution has aspects that might make it a better or worse fit for specific customer requirements. Prospective customers should consider their current and future needs when comparing solutions and vendor roadmaps.

INSIDE THE GIGAOM RADAR

To create the GigaOm Radar graphic, key features, emerging features, and business criteria are scored and weighted. Key features and business criteria receive the highest weighting and have the most impact on vendor positioning on the Radar graphic. Emerging features receive a lower weighting and have a lower impact on vendor positioning on the Radar graphic. The resulting chart is a forward-looking perspective on all the vendors in this report, based on their products’ technical capabilities and roadmaps.

Note that the Radar is technology-focused, and business considerations such as vendor market share, customer share, spend, recency or longevity in the market, and so on are not considered in our evaluations. As such, these factors do not impact scoring and positioning on the Radar graphic.

For more information, please visit our Methodology.

Acalvio: ShadowPlex Identity Protection

Solution Overview

Acalvio specializes in identity-based deception technology, applying AI to generate realistic decoys that blend into enterprise environments and surface attacker activity at the earliest stages of an attack.

ShadowPlex Identity Protection is a solution that specializes in using deception technology for ITDR. It is built around three components: Identity Security Posture Management (ISPM), Identity Attack Paths, and Identity Honeytokens. The ISPM capability detects misconfigurations and risky postures across Active Directory (AD) and cloud identity stores, while the Identity Attack Paths component maps lateral movement routes an attacker could exploit to reach high-value targets. The honeytoken layer deploys AI-generated honey accounts and tokens designed to be indistinguishable from legitimate credentials, triggering high-fidelity alerts upon interaction. Native integrations with Microsoft Defender for Identity (MDI) and Microsoft Defender for Endpoint (MDE), as well as CrowdStrike Identity Protection and CrowdStrike EDR, enable agentless honeytoken deployment with alerts surfaced in those platforms’ consoles. Cloud coverage extends across Azure, AWS, GCP, and OCI. The solution has expanded to include nonhuman and AI agent identities, with honeytokens applicable to service accounts, API keys, and AI agent credentials. BloodHound integration enhances the native attack path analysis capability. Deployment supports SaaS and self-hosted models. Integration can now be completely agentless, aiding deployment at scale. Acalvio maintains an AD plug-in to provide users with real-time honeytoken alerts. The platform has demonstrated scalability in environments with more than 300,000 endpoints and more than 100 identity stores.

Acalvio is positioned as a Challenger and Fast Mover in the Maturity/Feature Play quadrant of the ITDR Radar chart.

Strengths

Acalvio scored well on a number of decision criteria, including:

• Proactive protection: Acalvio’s deception technology aims to proactively protect organizations by setting traps that lure attackers into harmless honey trap identities. These traps predict threats and trigger instant alerts when detected. With high-quality alerts from deception, security teams can utilize ShadowPlex to automatically isolate compromised endpoints.

• Nonhuman identity (NHI) security: NHI discovery and inventory are available across on-prem and cloud environments, including service accounts, API keys, and application accounts. It uses honeytokens representing deceptive NHIs for threat detection. It also integrates with Wiz to extend beyond AD to provide cloud NHI visibility.

• AI-enhanced SecOps: ShadowPlex AI copilot offers a natural language Q&A interface. Its built-in threat analytics engine performs automated summarization, prioritization, correlation, and enrichment of deception events. ShadowPlex AI creates natural language summaries of threats and automated MITRE ATT&CK mappings to assist in threat analysis, with alert prioritization ensuring the most critical alerts are addressed first.

Opportunities

Acalvio has room for improvement in a few decision criteria, including:

• Compliance management: Acalvio’s compliance reporting currently focuses on analysis against the NIST and CIS global frameworks. Expanding this to include more security and privacy frameworks will give customers better insight into how identity relates to compliance and its overall impact.

• Extended IAM integration: Acalvio offers prebuilt integrations with AD, Entra ID, AWS IAM, GCP IAM, Google Workspace, Okta, Ping Identity, and Wiz, as well as APIs for custom integrations. Adding more prebuilt integrations would help customers adopt Acalvio’s technology more quickly and improve its identity protection coverage.

• Automated incident response: The vendor relies heavily on third-party integrations to implement its automated capabilities. Its deception technology delivers high-accuracy threat identification, resulting in precise automated responses. Customers using CrowdStrike Identity Protection or Microsoft Defender for Identity can use this integration to automatically block at-risk IDs and automate deception technology. Building more native responses may not strategically align with Acalvio’s approach, so expanding integrations will give customers the opportunity to incorporate Acalvio into broader identity protection.

Purchase Considerations

ShadowPlex licenses are issued per user. Licenses are subscription based, with a typical minimum commitment of 12 months. Acalvio offers enterprise licensing options for large organizations that need multiple ShadowPlex modules. Pricing details are available through a sales and partner portal. Customers can also purchase the solution via the Cloud Service Provider marketplaces or through the CrowdStrike/Microsoft marketplace. Additionally, Acalvio offers tiered support packages: standard, premier, and premier plus.

ShadowPlex is delivered as a SaaS service and is designed for agentless deployment, reducing deployment complexity. Configuration may require integrations with existing EDR and identity solutions such as CrowdStrike Falcon or Microsoft Defender for Identity. In multicloud environments, IAM honeytoken registration is handled through infrastructure-as-code modules such as Terraform. The vendor's built-in orchestration and AI-assisted honeytoken recommendations are intended to reduce the need for professional services engagements, with self-service onboarding and scaling workflows supported through the SaaS console. The vendor also offers self-paced training materials, instructor-led sessions, and periodic community workshops.

ShadowPlex is suitable for SMBs, large enterprises, and the MSP market.

Use Cases

ShadowPlex is well suited for organizations looking to supplement existing detection controls with high-fidelity deception technology. It works well for those looking to protect Active Directory and Entra from attacks (including stealth techniques such as Kerberoasting and Silver Ticket) through honey account interaction. It also helps customers with early warning of cloud identity attacks via multicloud honeytoken triggers across environments. For customers looking to protect nonhuman and AI agent accounts, it can support those with honeytoken interaction with these accounts.

BeyondTrust: Identity Security Insights

Solution Overview

BeyondTrust is a cybersecurity company specializing in identity and access security, with deep expertise in privileged access management (PAM) and broader identity risk across hybrid environments. Its product portfolio spans PAM, remote access, and identity threat detection and response.

Identity Security Insights is BeyondTrust’s ITDR product, offered as a SaaS platform that seamlessly integrates with on-prem, cloud, and SaaS identity infrastructure without agents. The solution continuously gathers identity telemetry from supported platforms, including Active Directory, Entra ID, Okta, AWS, GCP, GitHub, Salesforce, ServiceNow, and OpenAI, and uses AI and ML analytics to identify risky configurations, suspicious activities, and active threats. Identity Security Insights functions as a standalone product and within the broader Pathfinder Platform. Its True Privilege Graph enhances ITDR by providing deeper privilege relationship mapping across hybrid environments. BeyondTrust also continues to expand coverage in emerging identity areas, such as discovery and risk assessment of AI agent identities across OpenAI, Microsoft Copilot, Azure, AWS Bedrock, Google, ServiceNow, and Salesforce, as well as secrets exposure detection across cloud environments and source code repositories. The platform offers job-specific dashboards for cloud, NHI, secrets, and AI agent views. Response actions integrate with SIEM, SOAR, ticketing, and collaboration tools, with more automated remediation capabilities available through BeyondTrust’s PAM and Password Management modules.

BeyondTrust is positioned as a Challenger and Fast Mover in the Maturity/Platform Play quadrant of the ITDR Radar chart.

Strengths

BeyondTrust scored well on a number of decision criteria, including:

• Extended IAM integration: BeyondTrust has integrations with leading IdPs, including Active Directory, Entra ID, Okta, PingOne, AWS, Azure, Google Cloud, and a range of SaaS applications. It also supports API-based extensibility for custom integrations.

• Proactive protection: With its ability to integrate with a wide range of platforms, BeyondTrust can collect risk telemetry across on-prem, cloud, and SaaS environments and use this information to develop a comprehensive understanding of risk. Through integration with its other ecosystem tools, it can provide clear recommendations for proactive risk mitigation and automate them.

• Incident response analysis: The BeyondTrust True Privilege identity risk rating for instant impact assessment provides an immediate view of impacts. Its True Privilege Graph helps investigators rapidly trace attack paths across accounts, privileges, and secrets. It also further helps investigations by providing event correlation with timeline reconstruction and mapping to the MITRE ATT&CK framework and NIST SP 800-53.

Opportunities

BeyondTrust has room for improvement in a few decision criteria, including:

• Compliance management: While BeyondTrust maps identity security to MITRE ATT&CK and NIST, it does not extend this to broader security and privacy compliance frameworks. It can be used to assist operations teams with tasks such as audit preparation and compliance assessment reporting, and customization is available to align with specific regulatory requirements or internal governance. However, BeyondTrust could provide more prebuilt compliance framework support to make it easier for customers to evaluate how identity impacts their compliance status.

• Automated incident response: BeyondTrust provides automation features, such as enforcing just-in-time (JIT) access to privileged accounts and the ability to pause, terminate, or review sessions. However, its Identity Security Insights mainly function as a risk assessment and prioritization platform. Automating many responses requires using other modules, like Password Management and PAM. It also supports SOAR/SIEM integration to extend capabilities. Adding more response actions directly within that platform, rather than relying on external integrations, would simplify adoption and enable automation for customers with less advanced systems.

• Nonhuman identity (NHI) security: While BeyondTrust offers NHI discovery across cloud and on-prem environments, including service accounts, API keys, OAuth apps, certificates, secrets in code, as well as AI agent identity discovery for MS Copilot, Azure AI, AWS Bedrock, OpenAI, Google, Salesforce, and ServiceNow, it provides detections and recommendations, which are followed by remediation guidance, much of which extends existing capabilities rather then specific NHI security. However, the vendor has continued to develop this area, adding features like distinct NHI reporting, dashboards, and lifecycle management (potentially using its Pathfinder platform) that can significantly enhance these capabilities.

Purchase Considerations

Identity Security Insights is licensed on a per-user, per-month SaaS subscription basis. Pricing is not listed on the vendor’s website and requires direct contact with BeyondTrust. Organizations should note that while Insights functions as a standalone ITDR product, to access other elements of the Pathfinder platform, it will need additional BeyondTrust modules, which have separate licensing costs.

Deployment is mainly agentless, relying on native APIs and directory integrations, which reduces implementation complexity. The platform is offered as SaaS, eliminating the need for on-prem infrastructure management. BeyondTrust provides professional services support, with implementation help available through both the vendor and its partner channels.

The solution is suitable for SMBs, large enterprises, and MSP markets, although it may be better suited to those managing complex hybrid identity environments.

Use Cases

Identity Security Insights is well suited to organizations seeking continuous visibility across a complex hybrid identity estate. Key scenarios include proactive identification and remediation of risky identity configurations, including excessive privileges, stale accounts, and policy violations across human, machine, and AI identities. It also aids those wishing to identify and understand shadow admin relationships and indirect privilege paths that are not visible through standard directory queries.

CrowdStrike: CrowdStrike Falcon Identity Protection

Solution Overview

CrowdStrike provides cybersecurity solutions spanning endpoint, cloud, and identity security, taking an adversary-centric approach to threat prevention and detection across the enterprise. Its Falcon platform is the unifying architecture across all product areas.

Falcon Next-Gen Identity Security includes CrowdStrike’s ITDR offering and operates as a module within the cloud-native Falcon platform and shares a single agent and unified console with other Falcon capabilities. The solution comprises five components: Identity Threat Detection (ITD), Identity Threat Protection (ITP), Falcon Privileged Access (FPA), FalconID, and Falcon Shield. ITD provides visibility and detection, ITP adds real-time prevention and conditional access policies, and FPA delivers JIT access controls with continuous authorization for Active Directory, Entra ID, and local admin on endpoints. Its acquisition of SGNL also extends Zero Standing Privileges across SaaS applications, additional IdPs, and cloud. Falcon Shield provides identity visibility and SaaS security posture management across more than 200 SaaS applications. On-prem directory integration requires a single agent on domain controllers, and cloud directories connect via API. A defining characteristic is cross-domain correlation: identity telemetry is enriched with endpoint, cloud, and SaaS data through the Falcon platform and CrowdStrike Next-Gen SIEM, enabling detection of attack chains that span multiple environments. Real-time conditional access policies allow dynamic enforcement of MFA, access blocks, or step-up authentication based on live risk signals. Charlotte AI provides agentic detection triage, investigation support, and SOAR workflow automation. CrowdStrike continues to extend its identity coverage, with insider threat profiling drawing on HR system data and expanding visibility into AI agent identities.

CrowdStrike is positioned as a Leader and Fast Mover in the Maturity/Platform Play quadrant of the ITDR Radar chart.

Strengths

CrowdStrike scored well on a number of decision criteria, including:

• Nonhuman identity (NHI) security: CrowdStrike provides comprehensive NHI discovery across cloud (AWS, Entra, GCP), on-prem (Active Directory), AI agent platforms (OpenAI, Anthropic, Copilot), and SaaS (more than 200 applications, including Workday and Salesforce). The solution provides contextual enrichment showing linked accounts, privileges, and cloud resource access. It detects anomalies and behavioral deviations and provides risk scoring for NHIs (risky, privileged, compromised). It also offers conditional access policies for NHIs and provides NHI compliance mapping to frameworks, including NIST and SOC 2.

• AI-enhanced SecOps: CrowdStrike’s Charlotte AI is a deeply integrated AI copilot with agentic capabilities powered by GenAI and specialized agents. It supports natural language queries across Falcon data, automated detection triage, priority and confidence scoring, and step-by-step response guidance. It assists analysts by supporting playbook generation through promptbooks. Additionally, it offers human-in-the-loop controls that include bounded autonomy, approval workflows, and override capabilities. It also supports advanced automation via tight integration with the CrowdStrike Falcon Fusion SOAR platform.

• Automated incident response: Falcon Fusion SOAR, which is natively integrated into the Falcon platform, provides a no-code automation and orchestration engine that enables teams to automate end-to-end response workflows. Examples include isolating compromised hosts, triggering alerts for specific threats, and automatically notifying teams via tools such as Slack, Teams, or email, as well as through real-time conditional access policies. The solution offers more than 1,500 automated actions, including first-party and third-party tools that can be executed either via CrowdStrike or through integrations with tools such as Okta, Ping, Entra ID, and Fortinet.

Opportunities

CrowdStrike has room for improvement in a few decision criteria, including:

• Compliance management: CrowdStrike maps detections to the MITRE ATT&CK framework throughout the solution, with adversary mapping of TTPs and attack path analysis aligned with MITRE stages. Supported compliance frameworks include NIST, SOC 2, CIS AWS Foundations, CIS Azure Foundations, and CIS Google Workspace Foundations. CrowdStrike-specific frameworks for NHI and AI agents are also available. This could be further enhanced by expanding coverage to include more regional and sector-specific frameworks, such as GDPR-specific, PCI DSS, HIPAA, and regional regulations. It could also add capabilities for customers to define custom compliance frameworks.

• Enterprise security reporting: The solution provides dashboards, reports, and alerts with customizable real-time insights into threats, incidents, and identity security. It functions as a solid reporting platform but could be improved by offering prebuilt integrations with tools like Tableau or Power BI instead of only API options.

• Proactive protection: CrowdStrike offers strong proactive capabilities, including deception technology with honeytoken accounts, honeypots, and honey credentials. It integrates with CrowdStrike threat intelligence and dark web credential monitoring and detects impossible travel, unusual login times, atypical access patterns, and credential stuffing. CrowdStrike could further expand the comprehensiveness of its proactive capabilities by adding the ability to conduct attack simulations, helping its customers build more effective proactive protections.

Purchase Considerations

Falcon Next-Gen Identity Security is licensed on a per-active-identity subscription basis, where active identities are accounts authenticated within the last 90 days, including human and nonhuman identities and service accounts. Hybrid identities synchronized across on-prem and cloud directories are counted once. Retail pricing is available on the CrowdStrike website, but customers are encouraged to contact the vendor or its partner ecosystem for bundled pricing. The Falcon Flex program offers an alternative licensing option, providing customers access to the full Falcon portfolio with the flexibility to expand adoption over time.

The single-agent, cloud-native architecture reduces deployment complexity relative to multicomponent ITDR deployments. Prebuilt integrations and standards-based connectors simplify identity provider onboarding, and the unified Falcon console means identity modules share the same interface as endpoint and cloud security capabilities. A fully managed 24/7 service is available for organizations that prefer to outsource identity threat prevention and response.

Professional services are available directly from CrowdStrike, primarily focused on tuning conditional access policies and reviewing initial detections to accelerate time to value. Training is provided through CrowdStrike University. The solution scales from SMB to large enterprise and is most naturally suited to organizations already using or considering the broader Falcon platform.

Use Cases

Falcon Next-Gen Identity Security addresses three primary scenarios: first, reducing the identity attack surface by identifying and prioritizing misconfigurations, overprivileged accounts, and risky authentication patterns (including across SaaS applications via Falcon Shield) before attackers exploit them; second, detecting and responding to lateral movement and privilege misuse by correlating identity activity with endpoint and cloud telemetry to surface attack chains spanning multiple domains; and third, managing insider risk by combining behavioral access data with HR system signals to identify accounts exhibiting elevated risk patterns, enabling proactive policy enforcement before a threat materializes.

CyberArk: Identity Security Platform

Solution Overview

CyberArk is a long-established identity security vendor with roots in PAM. The vendor was recently acquired by Palo Alto Networks.

The CyberArk Identity Security Platform provides ITDR through a branded capability called CyberArk Threat Detection and Response (TDR), which integrates advanced threat detection and automated response directly within the identity platform instead of offering it as a standalone product. The platform supports workforce, IT, developer, machine, and AI agent identities across hybrid cloud environments, with the TDR architecture focused on four integrated functions: continuous discovery, identity security posture, identity threat detection, and manual and active response. It can be deployed as a self-hosted solution or as a SaaS offering.

CyberArk CORA AI acts as the central engine powering all four TDR functions, offering behavioral analytics, natural language interaction, session analysis, and automated policy suggestions. The platform tracks authentication events, privilege escalations, API calls, and secret exchanges to identify anomalies, then responds through the same system that controls access, enabling automated credential rotation, session termination, step-up authentication, and JIT privilege revocation. NHI coverage extends via Secrets Hub, which provides centralized observability and lifecycle management across AWS, Azure, and GCP secret stores. The solution can safeguard identities across legacy systems, on-prem infrastructure, cloud consoles, and SaaS applications.

CyberArk is positioned as a Challenger and Fast Mover in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

CyberArk scored well on a number of decision criteria, including:

• Nonhuman identity (NHI) security: CyberArk offers centralized NHI observability through Secrets Hub, featuring a dashboard that displays coverage across more than 220,000 workloads, 150,000 secrets, AI agents, and PAM accounts. The platform detects and manages secrets in AWS, Azure, and GCP secret stores. An Access Map visually illustrates how secrets connect to target systems, with detailed inventories tracking onboarded candidates and unrotated, idle, expired, and disabled secrets. A dedicated AI agent security solution handles discovery, governance, and credential provisioning for AI agent identities.

• AI-enhanced SecOps: CORA AI leverages AI-driven behavioral analytics to continuously update behavioral baselines. The console dashboards also showcase CORA AI-powered detections. Additionally, it supports natural language interaction, session analysis, anomaly detection, and automated policy creation to help reduce operational overheads.

• Extended IAM Integration: CyberArk integrates with all major IdPs (including AD, Entra ID, Okta, Ping, and Google Workspace), PAM systems, cloud platforms (including AWS, Azure, and GCP), and offers a marketplace with more than 200 integrations. The platform natively supports workforce, IT, developer, and machine identities across hybrid environments. The solutions also provide native support for custom integration development.

Opportunities

CyberArk has room for improvement in a few decision criteria, including:

• Proactive protection: CyberArk provides ISPM with a broad range of policy categories, including segregation of duties, MFA enforcement, governance, terminations, and orphan accounts. Policies are linked to CIS benchmarks to support proactive hardening, with risks categorized by severity, helping customers build a strong proactive baseline. It could be improved further by adding features like deception technology, identity-specific attack simulations, or red team automations.

• Compliance management: CyberArk can assign policy categories and tag them according to CIS benchmarks. It also provides MITRE ATT&CK mapping for detections. Compliance is a key focus of many security programs, and CyberArk could increase its value by supporting additional frameworks like NIST CSF, ISO 27001, NIS2, and DORA. It could also offer prebuilt compliance reports aligned with specific regulatory needs, as well as support for custom frameworks.

• Enterprise security reporting: The solution provides audit-ready reporting with out-of-the-box dashboards that streamline audits and showcase ongoing security monitoring and compliance. Its posture management UI includes separate security findings dashboards with severity classifications and trend analysis. There's an opportunity to improve it further by integrating native BI tool connectors such as PowerBI, Tableau, and Looker. Additionally, it could offer executive-level identity security dashboards with cross-domain KPI aggregation.

Purchase Considerations

The platform supports both SaaS and self-hosted deployment options, with PAM vault components available on-prem and platform services provided via SaaS. Newer TDR and AI features are mainly SaaS-based. Pricing is subscription-driven, based on modules and the number of identities. Pricing details are not publicly available, so customers must contact the vendor or its partner network.

Implementation complexity is an important consideration. The platform architecture includes multiple components, such as vault, session management, secure infrastructure access, secure cloud access, and secure browsing, and professional services are often recommended for initial deployment. For existing CyberArk users, TDR is a logical extension of the platform, reducing deployment risk and effort.

Buyers should assess the implications of the Palo Alto Networks acquisition for product strategy and pricing.

CyberArk is appropriate for SMBs, MSPs, and large enterprises.

Use Cases

The solution is well suited for organizations managing large privileged account estates that require continuous monitoring of post-authentication activity and automated containment of credential misuse, enterprises seeking to unify identity threat detection with access governance within a single platform to eliminate tool sprawl and reduce response times, organizations with a significant NHI population (service accounts, API keys, machine credentials) that need lifecycle management alongside threat detection, and security teams aiming to extend identity protection to AI agents and autonomous workloads as they scale agentic AI adoption.

Delinea: Delinea ITP (Identity Threat Protection)

Solution Overview

Delinea is a cybersecurity company specializing in PAM and identity security. Its product portfolio spans PAM, secrets management, cloud infrastructure entitlement management, GRC, and identity threat detection and response.

Delinea Identity Threat Protection (ITP) is the vendor’s ITDR product. It is delivered as SaaS with agentless API integrations. The solution connects to identity providers, cloud platforms, SaaS applications, and on-prem environments via a lightweight connector, gathering and normalizing identity telemetry into a unified identity graph. This graph enables continuous risk scoring, attack path analysis, and detection across human, nonhuman, and AI agent identities. ITP functions as a standalone ITDR product but gains additional value when combined with Delinea’s broader portfolio, including PAM and secrets management capabilities, allowing for correlated visibility across privileged and standard identities in a single risk view.

Delinea continues to extend its identity coverage across several areas. Enhanced Active Directory threat detection now covers Golden and Silver Ticket attacks, Kerberoasting, and admin enumeration. It also provides real-time monitoring and analysis of privileged sessions (SSH, RDP, PowerShell) to surface risky behavior, and Iris Authorization introduces AI-driven continuous authorization, evaluating risk at access request time and working toward real-time session-level adaptive controls. NHI discovery and protection has been expanded, including visibility into AI agent identities running in cloud service providers, with its recent StrongDM acquisition bringing further NHI lifecycle management and JIT access capabilities into the platform.

Delinea is positioned as a Challenger and Fast Mover in the Maturity/Platform Play quadrant of the ITDR Radar chart.

Strengths

Delinea scored well on a number of decision criteria, including:

• Proactive protection: Delinea offers attack path visualization, proactive threat indicators (such as impossible travel, credential stuffing, and MFA bombing), external threat intelligence enrichment, and automated proactive remediation, which involves blocking, MFA enforcement, and password resets. It also integrates with deception technologies to detect and dynamically flag interactions with deception tools like honeyaccounts and can provide real-time alerts.

• Automated incident response: The solution offers permission minimization, MFA triggers, password resets, and user suspension or blocking. It can also provide dynamic controls through Conditional Access policy updates and, through integration with its broader portfolio, perform automated key or secret rotation when threats are detected. Additionally, it allows for the development of custom playbooks with alert type and risk level conditions.

• Extended IAM integration: IAM integrations include AD, Entra ID, Okta, Ping, Google Admin Directory, and OneLogin, as well as AWS, GCP, and Azure IAM. The solution also provides deep native integration with Delinea PAM (Secret Server, Privileged Remote Access). Additionally, customers can create custom integrations using public APIs.

Opportunities

Delinea has room for improvement in a few decision criteria, including:

• AI-enhanced SecOps: Delinea uses ML to improve threat detection accuracy. However, the platform currently lacks assistance for the security team via AI-driven tools such as a security copilot or agent support. This is increasingly becoming an important consideration for customers as they seek enhanced operational efficiency. Therefore, adding tools like an AI copilot or natural language investigation capabilities will be an asset to customers. The vendor does have these as short-term roadmap items; however, they are not currently available in the product.

• Compliance management: Currently, the solution supports out-of-the-box alignment with several major compliance frameworks, including full mapping to the MITRE ATT&CK framework. Its alerts and posture checks also correspond to their related compliance standards, and customers can map findings to their own custom frameworks or to additional frameworks not natively supported. Extending out-of-the-box support for more frameworks would provide additional value for organizations with strong compliance requirements.

• Nonhuman identity (NHI) security: Currently, Delinea has NHI discovery and monitoring across workload identities, service accounts, managed identities, API/SSH keys, and OAuth applications. It can provide risk scoring, behavioral baselines with anomaly detection, and automated responses, including disabling access and rotating credentials. While this offers a solid foundation, it presents opportunities for Delinea to add a range of enhancements, such as NHI lifecycle management with provisioning and decommissioning workflows. It could also incorporate compliance auditing specifically for NHIs. The vendor's recent acquisition of Strong DM will likely strengthen these capabilities.

Purchase Considerations

ITP is licensed on an annual per-user subscription. Pricing is not publicly listed and can be obtained through Delinea’s sales team or authorized partners.

ITP’s deployment is designed to be self-service. Delinea states that a typical onboarding takes two to three hours, and professional services are optional rather than required, but they are available for accelerated onboarding or best-practices guidance. Buyers integrating ITP with Delinea’s PAM tooling should factor in that broader implementation scope when estimating project timelines.

ITP is suitable for SMBs, MSPs, and large enterprises.

Use Cases

ITP addresses several key use cases. It provides businesses with unified identity threat coverage across hybrid and cloud environments, enabling organizations to support complex identity infrastructure across platforms such as on-prem Active Directory, cloud IdPs like Entra ID and Okta, and SaaS platforms. Its integrated ITDR and PAM protection allows organizations managing privileged access through Delinea’s PAM tools to use ITP to correlate posture, access, and activity signals across both privileged and standard identities, reducing investigation efforts when threats affect both layers. It also helps organizations handle NHI risk complexity by allowing security teams to discover, monitor, and assess risk across NHIs (such as service accounts, API keys, OAuth applications, and AI agents), with the ability to detect baseline changes and potential NHI compromise.

Gurucul: REVEAL ITDR

Solution Overview

Gurucul is a global security analytics company that delivers risk intelligence through REVEAL, a cloud-native platform spanning next-generation SIEM, UEBA, ITDR, and insider risk management.

Customers can license capabilities individually or as a comprehensive package. All modules share the same user interface, data fabric, and analytics engine. Gurucul’s ITDR bundle includes Next Generation SIEM, UEBA, SOAR, AI Analyst, Sme AI, Data Pipeline Management, and Identity Analytics, with optional AI Analyst, Sme AI (Co-Pilot), and Data Pipeline Management. Deployment options include SaaS and self-hosting in cloud and on-prem environments. Data collection is primarily agentless via API connectors, Syslog, or S3 ingestion, with lightweight forwarders available for on-prem log collection. The platform excels in comprehensive security analytics, enabling seamless data ingestion, deep customization, and insider threat risk prioritization. It collects telemetry from diverse environments, automates data ingestion, and uses ML-driven analytics to improve threat detection, reduce false positives, and identify zero-day threats.

At the core of REVEAL, the Dynamic Risk Engine neutralizes threats, helping organizations concentrate on high-risk events. Risk models can be tailored to match enterprise risk tolerance, while AI-driven features speed up identity threat detection and response. Analysts can also use natural language search for more efficient investigations. Additionally, Gurucul STUDIO, the platform’s custom analytics and behavioral modeling tool, enables security teams to develop and deploy customized algorithms without needing deep ML expertise. Gurucul continues to make advancements in areas like agentic AI for auto-triage, root cause analysis, and response orchestration.

Gurucul is positioned as a Leader and Fast Mover in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

Gurucul scored well on a number of decision criteria, including:

• Nonhuman identity (NHI) security: The solution offers comprehensive NHI discovery across service accounts, bots, AI agents, cloud workload identities, APIs, and OAuth apps. It is also capable of identifying AI agents as a distinct NHI category. It provides behavioral baselining using hundreds of dedicated NHI ML models and applies dynamic risk scoring to prioritize threats. The platform also enables automated NHI threat response via native SOAR, with the ability to disable accounts, revoke OAuth tokens, rotate API keys (via secrets management integration), and quarantine workloads.

• AI-enhanced SecOps: Gurucul offers a mature suite of AI tools to improve SecOps efficiency. It provides a “subject matter expert” AI that enables natural language search, summaries, report creation, and decision support. It also features an AI SOC analyst to assist with investigations, including incident summarization with threat narratives and “Security Storylines.” Additionally, it automates triage for all alerts, automatically closes false positives, and offers step-by-step remediation guidance with next best action recommendations.

• Automated incident response: Gurucul REVEAL boosts incident response with its integrated SOAR module, using response playbooks to isolate, block, or limit privileges for at-risk identities, both human and machine. The platform offers extensive automation, such as opening, updating, or closing ITSM tickets, enforcing MFA, resetting passwords, and reducing identity entitlements. Its built-in integrations with top EDR solutions (like CrowdStrike, FireEye, Tanium, and CarbonBlack) support additional endpoint actions, including file quarantine and process termination.

Opportunities

Gurucul has room for improvement in a few decision criteria, including:

• Proactive protection: Gurucul REVEAL continuously evaluates all aspects of identity security by analyzing data from multiple sources, leveraging Gurucul Threat Labs Threat Intelligence-as-a-Service and integrated third-party intelligence feeds. Providing this capability natively would simplify and accelerate user adoption.

• Compliance management: Gurucul REVEAL provides extensive compliance reporting by mapping detections and threats to the MITRE ATT&CK framework with ready-made MITRE dashboards and reports. The platform supports a variety of global compliance standards, including GDPR, HIPAA, SOX, NIST, and ISO 27001. Although customers can currently customize policies or create new ones to meet specific compliance needs, this could be further improved through ongoing expansion of supported regulations.

• Enterprise security reporting: Gurucul REVEAL offers more than 1,500 ready-made reports, including nontechnical ones that show business value, risk trends, and progress toward key security KPIs. Reports can be customized, run manually, or scheduled for email delivery. Future updates could include integrations with enterprise reporting tools like Power BI and Tableau to improve data visualization and analytics. Users do have the ability to export data to Excel or CSV and import it into other tools using those formats.

Purchase Considerations

REVEAL ITDR is available under two main licensing models: data volume-based pricing, measured in gigabytes per day, and usage-based pricing per user, asset, or entity. Both models require a minimum 12-month subscription. Gurucul also continues to offer perpetual licensing for specific needs, such as certain government contracts. Pricing is not publicly disclosed and can be obtained through a direct quote from Gurucul or an authorized partner.

SaaS deployments are typically easier for customers. Those self-hosting on-prem or in the cloud will need to provision and support their own infrastructure. Gurucul offers its SmartStart package, a fixed-cost engagement to quickly deliver value for most new customers. For complex environments, its internal professional services team and partner ecosystem are available for ongoing management and specialized support.

Gurucul is suitable for SMBs, large enterprises, and MSPs.

Use Cases

REVEAL ITDR addresses multiple customer use cases. It helps detect credential compromise by continuously monitoring user and entity behavior for deviations from established baselines, enabling high confidence identification of compromised credentials and account misuse. It also helps prevent data exfiltration through behavioral analytics to spot abnormal data access patterns, especially abnormal transfers to external or unauthorized locations. Additionally, it leverages identity analytics, peer group comparison, and ML model chaining to identify and mitigate the risk of malicious or negligent insider activity.

Imprivata: Enterprise Access Management (EAM)*

Solution Overview

Imprivata is an ITDR specialist. In October 2025, Imprivata acquired Verosint to incorporate Verosint’s AI-driven risk signaling into the Imprivata access management platform.

Imprivata operates at the IdP event layer, collecting authentication events, user behavior, and access patterns through API integrations with Okta, Microsoft Entra ID, Ping Identity, ForgeRock, and Auth0. Its agentless, cloud-native approach uses preloaded historical data without requiring agents, code deployments, or on-prem infrastructure. Key features include extensive detection across more than 1,200 behavioral signals aimed at ATO, credential misuse, insider threats, and synthetic fraud, along with an identity graph that maps connections among human, nonhuman, and service account identities. Verosint’s Vera AI analyst is used for triaging alerts through endpoint and HR data correlation and automated response workflows that enforce MFA step-up, session termination, account suspension, or forwarding to SIEM.

The solution also helps speed up investigations by creating attack timelines, natural language summaries of anomalies, and SOAR workflows integrated with Slack and Teams. The platform supports workforce protection by detecting lateral movement and privilege escalation, as well as preventing customer identity fraud, including fake account creation and session hijacking. Threat detection extends to NHIs like API keys, service principals, and emerging AI agents, with risk scores enhanced by device posture and geolocation signals. Dashboards offer prioritized threat views, investigation workflows, and compliance reports for audit trails. This positions Imprivata for security teams needing lightweight, API-driven ITDR that can be deployed across cloud directories and SaaS environments.

Imprivata is positioned as a Challenger and Fast Mover in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

Imprivata scored well on a number of decision criteria, including:

• AI-enhanced SecOps: Verosint’s Vera AI provides a robust range of SecOps support to improve efficiency. It includes assistance with triaging threats, investigating security events, and carrying out quick response actions at scale and in real time. Vera works within Slack (or other productivity tools) for smooth investigation with one-click incident response. The platform also uses AI-driven behavioral analytics, ML-based circadian rhythm models, and OSINT intelligence to further enhance its detection and response capabilities.

• Automated incident response: Automated responses are provided with preconfigured security workflows and customizable playbooks. Response actions include enforcing MFA, blocking compromised accounts, one-click incident response via Slack (through Vera), and adaptive authentication with step-up challenges when risk levels rise.

• Incident response analysis: Investigation and forensics features are available, with unified observability and context for faster correlation, triage, and issue prioritization. Real-time identity event data offers visibility into authentication incidents, user behaviors, and access patterns. Vera AI accelerates investigation through threat triage and event analysis. The Explorer feature also supports detailed event investigation.

Opportunities

Imprivata has room for improvement in a few decision criteria, including:

• Nonhuman identity (NHI) security: The platform monitors user accounts for unusual activity, credential stuffing, and account takeovers. However, it currently lacks dedicated NHI management to identify service accounts or API keys. NHI poses a significant risk to its customers, and developing more targeted NHI capabilities will provide greater value and help tackle this complex issue.

• Compliance management: The platform provides monitoring and reporting of identity activity for audits. However, it lacks more formal compliance reporting to assist customers in meeting identity-related compliance requirements. Adding support, especially in areas like reporting and compliance dashboards, would help customers with strong compliance needs.

• Proactive protection: Verosint offers continuous monitoring of identity activity using AI-powered behavioral analytics that establish baselines and identify deviations. OSINT identity intelligence improves risk assessment during login and throughout the user journey. There is an opportunity to further enhance this by providing additional proactive features, such as identity posture assessments and integration with or delivery of deception technology and dark web credential monitoring.

Purchase Considerations

Imprivata is a subscription-based solution with a per-user pricing model. It offers both a free trial and a complimentary risk assessment. Support and training are included with purchase.

As a SaaS-only platform with an API-based integration model, the deployment footprint is light. The documentation states that it can begin detecting threats immediately upon integration using imported historical event data, without a model training period. Documentation, interactive demos, webinars, live online training, and in-person training are available.

The solution is suitable for SMBs, large enterprises, and MSPs.

Use Cases

The solution covers three main use case categories. First, workforce identity threat detection and response: the platform continuously monitors employee account activity across connected identity providers, using AI-powered behavioral analytics and OSINT identity intelligence to identify threats like account takeover, credential stuffing, insider threats, and MFA bypass attempts, with automated workflows to block, challenge, or escalate authentication for high-risk accounts. Second, customer identity fraud prevention: the platform applies the same detection and response features to customer-facing CIAM environments, tracking account activity and fraud patterns at a large scale across many events, with automated prevention that can be deployed without changing code on web applications or devices. Third, AI-assisted investigation and response: the Vera agentic AI enables security teams to analyze suspicious accounts in bulk, execute targeted responses such as session revocation and account suspension, and generate custom incident reports and automated playbooks within Slack or Microsoft Teams, all without requiring access to a separate security console.

LinkShadow: ITDR

Solution Overview

LinkShadow is a cybersecurity analytics vendor operating across network, identity, and data security.

LinkShadow ITDR is deployed as a virtual appliance, available on-prem, in customer cloud infrastructure, or as a vendor-hosted SaaS instance. Integration with identity stores is managed through an agentless plugin model, supporting platforms such as Active Directory, Microsoft Entra ID, and Google Workspace. The solution is built on its cybersecurity mesh architecture, CyberMeshX, which allows its ITDR, NDR, and DSPM modules to share a common data layer and integration engine. When deployed as part of the CyberMeshX platform, it functions as a standalone solution, automatically correlating identity anomalies with network and data activity, thereby reducing the manual correlation work typically required across separate tools. It offers a comprehensive visual timeline of an identity’s lifecycle across the environment, mapping every authentication event and file access to a single, searchable narrative. Additionally, it includes an Exposure view for auditing identity store configurations against best practice standards like CIS and NIST. Using advanced ML, it establishes an identity baseline to detect threats such as impossible travel and privilege escalation by predicting expected user behavior and identifying real-time anomalies.

It also includes a zero-code integration engine that lets customers instantly connect their existing identity providers (AD, Azure AD/Entra ID, Okta, Ping) and response tools (IAM, SIEM, SOAR) without writing custom scripts.

LinkShadow is positioned as a Challenger and Fast Mover in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

LinkShadow scored well on a number of decision criteria, including:

• Incident response analysis: LinkShadow provides incident overview pages, case management for tracking investigations, and correlation across telemetry sources, including endpoint telemetry, network activity, and cloud platform logs. It also offers case management features to monitor investigation status, evidence, actions taken, and outcomes. Additionally, it maps incidents and related activities to MITRE ATT&CK techniques and provides root cause analysis to identify initial compromise vectors, such as credential misuse or abnormal authentication behaviors.

• Extended IAM integration: LinkShadow ITDR is designed to go beyond traditional Active Directory and Microsoft Entra ID environments, enabling centralized monitoring of identities across multiple IAM, PAM, and cloud platforms. The solution supports integration with AWS IAM, Google Cloud IAM, Azure RBAC, PAM solutions (including CyberArk, BeyondTrust, and Sectona), and allows customers to create custom integrations.

• Enterprise security reporting: LinkShadow offers customizable reports with drill-down features. It provides executive dashboards focused on enhancing identity security posture over time. Incident-based reports include incident summaries, alert and incident timelines, and investigation and response activity reports. Customers can personalize report content, dashboards, and dashboard widgets to create tailored reporting information.

Opportunities

LinkShadow has room for improvement in a few decision criteria, including:

• Nonhuman identity (NHI) security: LinkShadow ITDR offers basic discovery of service accounts and machine identities across Active Directory and cloud platforms. It provides inventory capabilities and can identify privileged service accounts. It currently lacks several advanced features, such as identity baselining and risk scoring, but there are plans to develop these features.

• Proactive protection: LinkShadow offers integration with deception technologies, can detect early signs of attack (such as impossible travel, unusual login times, and atypical access patterns), features its own threat intel, and supports integration with external threat intelligence feeds using STIX, TAXII, and CSV/XML-based Threat Feeds. It can further enhance this through improved attack path visualization, automated preventative actions, and customizable remediation workflows. Many of these features are planned, and delivering them will be essential to remain competitive in the ITDR market.

• Automated incident response: LinkShadow offers basic automated actions via API integrations with Active Directory, SIEM/SOAR, and ticketing systems. These actions include disabling accounts, resetting passwords, and creating tickets. There are opportunities for enhancement in areas like AI-driven responses, severity-based tiering, and approval workflows. These improvements are on the vendor's roadmap, and successfully implementing them will be key to maintaining its competitive edge.

Purchase Considerations

LinkShadow ITDR is licensed on a per-user or per-identity subscription basis, with a minimum commitment of one year. Multiyear contracts for three or five years are also available. Pricing is not publicly listed and must be obtained directly from the LinkShadow sales team or through its distributor and reseller channels.

Deployment requires a virtual environment (such as VMware or Hyper-V) for on-prem installations, or appropriate API permissions for cloud and SaaS configurations. The platform is designed to be commissioned by a skilled IT or security team and does not need endpoint agents. For complex deployments or custom automated response playbooks, the vendor recommends using its professional services.

The solution supports SMBs, large enterprises, or MSPs. The vendor specifies a minimum deal size of at least 100 to 500 users or identities.

Use Cases LinkShadow ITDR addresses multiple use cases. This includes helping organizations reduce exposure from Active Directory and Entra ID misconfigurations by providing continuous visibility into identity posture, identifying stale accounts, privilege creep, and configuration drift before they can be exploited. Security teams facing threats that bypass PAM controls or disable MFA enforcement use the platform's correlation of identity signals with behavioral baselines to detect unauthorized privilege usage, even if attackers have circumvented standard access controls. Organizations managing geographically distributed workforces or high-risk remote access scenarios utilize the platform's impossible travel and anomalous access detection to identify compromised credential use in real time.

Microsoft: Defender for Identity

Solution Overview

Microsoft is a leading global software and cloud services company. Microsoft’s ITDR solution is built on Defender for Identity, which leverages telemetry and capabilities from the M365 platform, including Entra ID and Defender XDR.

Defender for Identity provides visibility into the identity inventory, identifies at-risk individuals, and offers insights on compromised identities, including attack details and response guidance. The integration between Entra and Defender creates a continuous feedback loop where identity signals inform security detections in real time, and threat intelligence from Defender directly impacts access decisions in Entra. Defender for Identity monitors identity signals from on-prem Active Directory, Microsoft Entra ID, and other IAM solutions (such as Okta). It analyzes signals using behavioral analytics, threat intelligence, and known attack patterns to detect suspicious activity throughout the entire identity attack lifecycle. Defender for Identity streams identity signals into the Microsoft Defender portal, where they are correlated with data from endpoints, email, SaaS applications, cloud workloads, and other security sources. It also supports proactive risk reduction by assessing identity configurations to highlight security weaknesses commonly exploited by attackers, enabling teams to address risks before they are exploited. This includes security posture assessment via its Secure Score capability.

Microsoft has introduced AI-powered incident prioritization into its Defender platform, helping reduce SOC noise by automatically managing lower-severity alerts and highlighting only high-quality, actionable incidents.

Microsoft is positioned as a Challenger and Fast Mover in the Maturity/Feature Play quadrant of the ITDR Radar chart.

Strengths

Microsoft scored well on a number of decision criteria, including:

• AI-enhanced SecOps: Microsoft Security Copilot is integrated throughout the Defender ecosystem, including Defender for Identity. Copilot offers natural language queries, incident summaries, guided investigations, and remediation suggestions. It also provides AI-powered identity summaries that contextualize user risk. Additionally, it helps speed up investigations by translating complex alerts into natural language and supports proactive threat hunting. Analysts receive guided response steps for quick containment and can automate repetitive triage tasks using autonomous agents.

• Automated incident response: Microsoft's extensive portfolio of tools, integrated with Defender for Identity, offers a range of automated response actions. Users can be automatically disabled, sessions revoked, and MFA enforced. There are also more sophisticated automated responses, such as Conditional Access policy enforcement, device isolation through Defender for Endpoint, and automated investigation and remediation workflows. Additionally, Microsoft Sentinel integration allows for the creation of SIEM-based playbooks to support complex orchestrations.

• Incident response analysis: Defender for Identity offers detailed threat investigation within the unified Defender XDR portal. Attack path analysis, incident timelines, and entity-level investigations are available, with integration across the Microsoft 365 estate providing strong contextual data. Security Copilot further assists with investigations through natural language queries and incident summaries.

Opportunities

Microsoft has room for improvement in a few decision criteria, including:

• Compliance management: Identity risk is aligned with MITRE and the CIS benchmark, and an assessment of compliance with these standards is available. However, there is no broader reporting on other business compliance frameworks.

• Nonhuman identity (NHI) security: Defender for Identity can detect and report on service accounts and cloud application accounts within the Microsoft ecosystem. It emphasizes risks related to NHIs through Entra ID workload identities. However, Microsoft does not extend these capabilities beyond the Microsoft ecosystem and currently lacks dedicated NHI behavioral baselining and compliance reporting.

• Proactive protection: Microsoft Secure Score offers posture management that helps customers address security configuration risks. Platform telemetry supports proactive controls such as blocking high-risk sign-ins and detecting risky user behavior. Its close integration with Conditional Access allows the enforcement of restrictions. However, the platform does not go beyond this, as it lacks deception technology and attack simulation capabilities, both of which are valuable for providing customers with proactive insights.

Purchase Considerations

Defender for Identity is available as part of various license plans, including Microsoft 365 E5 and A5 licenses, Enterprise Mobility + Security E5/A5, and the standalone Microsoft Defender for Identity plan. M365 licenses are subscription-based, charged per user, per month. Licensing options are accessible through the Microsoft 365 portal or Cloud Solution Provider partners, with pricing details available on Microsoft’s website.

For organizations already invested in the M365 ecosystem, deployment is as simple as enabling the functions of Defender for Identity. When on-prem AD integration is required, the unified sensor for domain controllers reduces the steps needed to activate identity protections on-prem. If needed, deployment support is available from Microsoft or its partner professional services.

The solution is suitable for SMBs and large enterprises.

Use Cases

Defender for Identity best serves M365 customers aiming to prevent, detect, and respond to identity-based threats within their existing Microsoft environment. Its main strength is in setups where Active Directory, Entra ID, and M365 workloads are the primary identity platforms, enabling unified threat detection across on-prem and cloud identities with minimal additional tools.

Netwrix: ITDR Suite

Solution Overview

Netwrix is an identity-first security vendor focused on helping IT and security teams protect critical assets across hybrid environments. Its portfolio spans identity management, PAM, data security posture management, endpoint security, and ITDR.

Netwrix’s ITDR Suite combines capabilities developed through organic growth and acquisitions, including the integration of PingCastle’s Identity security posture management, a widely used Active Directory risk assessment tool that is also available as a free service. The Netwrix ITDR Suite is a multicomponent solution rather than a single platform. It includes PingCastle and Access Analyzer for identity risk assessment, Netwrix Threat Manager for behavioral monitoring and detection, Netwrix Threat Prevention for actively blocking high-risk directory actions, and Netwrix Identity Recovery for quick restoration after identity-based attacks. Each component targets a specific phase of the identity threat lifecycle and focuses on Active Directory and Entra ID environments. The suite supports both self-hosted and SaaS deployment. For on-prem AD, lightweight agents are installed on domain controllers for activity collection and, when applicable, enforcement of preventive controls. Recent additions include monitoring and blocking AD certificate services to counteract certificate-based attack paths, ML-based discovery of service accounts, and AI-guided remediation suggestions.

The solution offers robust Microsoft directory capabilities and active prevention features that stop critical directory changes before they happen, including safeguarding sensitive processes through domain controller-level controls.

Netwrix is positioned as a Challenger and Fast Mover in the Maturity/Feature Play quadrant of the ITDR Radar chart.

Strengths

Netwrix scored well on a number of decision criteria, including:

• Proactive protection: Netwrix offers comprehensive proactive controls. This includes deception technology using honeytokens inserted into endpoint memory to detect credential dumping and LDAP reconnaissance. It provides attack path visualization, showing lateral movement routes within AD, and also detects impossible travel, unusual login times, and atypical access patterns. Its integration of PingCastle enhances Microsoft directory identity security posture management, helping customers identify potential security risks that can be proactively addressed.

• Nonhuman identity (NHI) security: Netwrix discovers and inventories NHIs within Microsoft directories, including service accounts and application accounts. It uses ML-based discovery to identify unmanaged NHIs. It provides contextual information on group memberships, privileges, and authentication protocols and highlights abnormal authentication patterns. Threat Manager offers automatic responses to NHI threats. Netwrix also plans to release a new service dashboard that will specifically highlight NHI risks in the near future.

• Enterprise security reporting: Netwrix offers built-in dashboards and reports for identity risk findings and posture, catering to both technical and executive audiences. It also provides information on identity risk and posture over time through trend reporting. Reports can be customized to meet security, audit, and compliance requirements. Additionally, Netwrix Access Analyzer integrates with Power BI for creating customized dashboards and external reports.

Opportunities

Netwrix has room for improvement in a few decision criteria, including:

• Extended IAM integration: Netwrix concentrates heavily on Microsoft Active Directory and Entra ID as primary identity control points. It provides extensive insights into these platforms but offers no prebuilt IdP integrations beyond AD and Entra ID. To increase its platform's appeal, it aims to build integrations with other directories and expand its support for cloud-based IAMs.

• Incident response analysis: Netwrix provides investigation visibility into identity activity for detected threats; it offers detailed timelines for each threat, showing the sequence of related identity events. It supports RBAC, which allows investigation access for internal teams or external auditors. This provides a solid incident response analysis option. There is an opportunity for the vendor to extend this further in areas such as root cause analysis, attack chain visualization, and cross-platform telemetry correlation.

• AI-enhanced SecOps: Netwrix offers AI-assisted guidance that helps educate analysts about identified risks, provides remediation advice, and delivers step-by-step instructions. This is helpful for teams with limited domain expertise. However, there is significant potential to improve this further by adding an AI assistant or copilot for natural language queries, developing threat summaries, and supporting automated playbook creation. All these enhancements will help boost operational efficiency and make the solution more appealing.

Purchase Considerations

The Netwrix ITDR Suite is licensed on a per-user subscription basis with at least a one-year commitment. Pricing options are available directly through Netwrix or via its authorized partner network.

Deployment requirements are modest (a supported SQL Server database and access to Active Directory domain controllers) and a skilled IT or security team should be able to set up the solution without much difficulty. For more complex setups such as multidomain or multiforest environments, or when faster time to value matters, Netwrix recommends professional services, available directly from the vendor or through its partner ecosystem.

The solution suits SMBs, large enterprises, and MSPs.

Use Cases

Netwrix is ideal for organizations aiming to reduce Active Directory risks before incidents happen. Security and identity teams use the suite to identify structural vulnerabilities, excessive privileges, stale accounts, and insecure configurations, creating a clear view of the AD attack surface. Its Netwrix Threat Prevention can block high-risk directory changes at the domain controller level (including LSASS protection and AD CS abuse), which helps those building strong AD and Entra ID controls. Additionally, Netwrix supports rapid post-incident recovery, enabling rollback of malicious changes and full forest-level restoration to reduce downtime after ransomware or destructive attacks.

Permiso: Permiso Defend

Solution Overview

Permiso offers comprehensive protection and real-time detection of all identity risks and threats across every environment. This includes identifying credential compromise, account takeover, and insider threats across all identities and platforms.

The Permiso Platform combines Identity Threat Detection, Response, and ISPM into a single, cloud-native identity security platform. It leverages existing logs such as CloudTrail and Azure Activity Logs to pinpoint and alert on identity risks. Built on the Universal Identity Graph, it maps relationships among identities and credentials while consolidating information on sessions, activity, and risk across various platforms, enabling security teams to monitor activity across providers, cloud services, and SaaS applications. It can also link separate identities to user identities in the primary directory, simplifying risk detection.

Permiso is provided as a SaaS platform that integrates with customer environments via API connections without requiring endpoint agents, network appliances, or data collectors. The platform manages human, nonhuman, and AI identities across connected platforms like Okta, Azure AD, AWS IAM, GCP IAM, and numerous SaaS apps. Permiso has also added on-prem support, integrating with Microsoft’s Active Directory. More than 1,500 detection signals (developed by Permiso’s P0 Labs threat research team) enhance the platform’s detection capabilities. Continuous updates include adding support for AI identities such as AI Users, AI Builders, and AI Agents as distinct identity classes, addressing emerging security gaps as organizations adopt AI technologies at scale.

Permiso is positioned as a Challenger and Outperformer in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

Permiso scored well on a number of decision criteria, including:

• Extended IAM Integration: The solutions support more than 100 platform integrations involving identity, cloud services, and SaaS. This includes major IdPs such as Entra ID, Okta, Google Workspace, and Microsoft 365. It also tracks control plane activity, identifying suspicious admin behaviors, MFA manipulation, and policy change issues.

• AI-enhanced SecOPS: Permiso includes an AI assistant that enables natural language interaction, threat summarization, prioritization guidance, and step-by-step response instructions. It also offers ML-based behavioral analysis and anomaly detection. Additionally, its P0 Labs intelligence provides contextual analysis and recommendations. The dashboard emphasizes priorities with attribution and suggested actions.

• Incident response analysis: The solution offers a comprehensive investigation with detailed alert context. Its Universal Identity Graph helps visualize the scope of compromise, lateral movement, and impacted identities. Its P0 Labs provides adversary technique context and helps understand objectives. The platform also reconstructs attack timelines, visualizes identity relationships, and maps incidents to MITRE ATT&CK techniques to accelerate analyst investigations.

Permiso was classified as an Outperformer due to its consistent rapid growth and ambitious roadmap. Permiso is also making strong progress in emerging features such as AI agent security and predictive threat prevention.

Opportunities

Permiso has room for improvement in a few decision criteria, including:

• Proactive protection: The solution connects with the breach database and dark web monitoring via P0 Labs and offers threat-informed risk assessments based on actual adversary techniques. It could be improved by deploying native deception technology and automating attack simulations to help customers gain better proactive insights.

• Compliance management: Permiso maps identity security posture and detects threats to 14 compliance frameworks and regulatory standards. The platform provides visibility into how identity risks align with compliance requirements. This offers customers a solid baseline, but there is potential for further development with the ability to build custom frameworks and expand the number of supported prebuilt framework templates.

• Automated incident response: Permiso naturally generates real-time alerts, creates tickets in integrated systems, and can trigger SOAR playbooks (Palo Alto Cortex XSOAR, Splunk SOAR, Tines). However, it lacks built-in remediation features and relies on these external integrations. Adding native remediation capabilities would appeal to customers with less mature security stacks.

Purchase Considerations

Permiso licenses are based on the number of protected human identities on an annual subscription basis, with multiyear enterprise license agreements available at discounted rates. Pricing is available directly from the vendor upon request.

As a fully managed SaaS platform with agentless deployment, implementation is simple. Most customers complete the initial deployment independently. Professional services are recommended for customers who want to develop custom SOAR playbooks; however, these services are included as part of the solution.

Permiso’s primary customers are large or cloud-native enterprises with the security maturity to act on the platform’s output.

Use Cases

Permiso is designed for organizations with a certain level of cybersecurity maturity that already collect valuable threat telemetry. It helps these organizations detect and respond to advanced account takeover campaigns. It also supports those aiming to proactively identify risks through its ISPM capabilities, which reveal stale access, overprivileged identities, and dangerous permission combinations before they are exploited. Additionally, it enables organizations to gain human-level visibility into nonhuman and AI identity activities by monitoring service accounts, API keys, and autonomous AI agents that traditional tools often overlook.

Quest Software: Identity Defense

Solution Overview

Quest Software specializes in migrating, managing, and securing Active Directory and Entra ID. Its unified Quest Security Management Platform supports customer initiatives in migration, modernization, ITDR, and identity recovery.

Identity Defense is Quest’s ITDR solution, focused exclusively on protecting hybrid Microsoft Active Directory and Entra ID environments. As part of the Quest Security Management Platform, it combines continuous security assessment (identifying misconfigurations and hygiene gaps against industry best practices) with real-time identity threat detection and response, all within a single management interface.

The solution continues to evolve, with features such as Shields Up, which temporarily freezes all changes to Tier 0 AD objects to disrupt active attacks involving lateral movement and persistence. Identity Defense Intelligence, a GenAI enhancement to the platform, provides plain language threat summaries, MITRE ATT&CK mapping, and step-by-step remediation guidance. Its AI-powered executive summary generation produces a one-page security assessment summary, making it easier to communicate findings and prioritize remediation efforts. NHI coverage has expanded with Workload Identity Audit and Detection for Entra ID service principals and workload identities. Quest Software has also added an Identity Defense Agent for Microsoft Security Copilot that enhances the ability to address hybrid Active Directory challenges.

Quest Software is positioned as a Challenger and Fast Mover in the Innovation/Feature Play quadrant of the ITDR Radar chart.

Strengths

Quest Software scored well on a number of decision criteria, including:

• Incident response analysis: Directory changes are streamed into the Identity Defense platform, where they become independent of the environment where the incident occurred. This enables analysts to develop a broader understanding of the incident's context. It has also invested in its new GenAI capabilities to support security operations teams in analyzing complex incidents.

• Nonhuman identity (NHI) security: Identity Defense’s workload identity audit and detection offers visibility into service principals and other nonhuman accounts in AD and Entra ID. It detects overprivileged or exposed accounts and delivers actionable remediation guidance to prevent compromise before threats escalate. It currently supports Entra ID, with AD workload identity support coming soon. It provides effective NHI discovery within the Microsoft ecosystem, including contextual details such as owner, purpose, and permissions, along with remediation guidance.

• Proactive protection: Quest’s Shields Up feature immediately blocks all configuration changes to Tier 0 accounts. It uses Azure AI and ML to detect abnormal behaviors in Active Directory and Entra ID, such as unusual increases in account lockouts, failed sign-ins, permission modifications, and file access renames. Its ongoing security assessments compare AD and Entra ID configurations against best practices, proactively identifying exposures and misconfigurations with GenAI-driven analysis and providing actionable insights for proactive threat management.

Opportunities

Quest Software has room for improvement in a few decision criteria, including:

• Extended IAM integration: Identity Defense only integrates with AD and Entra ID. However, the limited scope of integrations is intentional, as the solution is designed to target specific risks related to Microsoft’s directory platforms.

• Compliance management: All Identity Defense findings are only mapped to the MITRE ATT&CK matrix. This is a strategic limitation imposed by the vendor, which does not acknowledge current customer demand for broader coverage. However, the solution could benefit from expanded compliance coverage, as customers increasingly seek to meet stricter requirements.

• Enterprise security reporting: Identity Defense provides a straightforward, user-friendly interface for accessing threat and posture information. Its Identity Defense Audit also offers cloud-native audit and compliance reporting with long-term data retention. There are still opportunities to enhance this further; for example, by adding features such as BI tool integration (Power BI, Grafana) and offering prebuilt executive dashboard templates.

Purchase Considerations

Identity Defense is a subscription-based solution licensed per managed person. Pricing options are available directly from Quest Software or through its established partner network.

Quest Software finds Identity Defense easy to deploy, with most setups taking only one to two hours. Professional services and onboarding support are available but are usually not necessary.

Quest Software aims to serve both SMBs and large enterprises.

Use Cases

Identity Defense addresses multiple use cases. It allows customers to evaluate the security posture of AD and Entra ID by continuously analyzing hybrid Active Directory and Entra ID configurations against best practices. It detects misconfigurations and overprivileged accounts before they can be exploited, with AI-generated summaries speeding up communication and prioritization of findings. It provides strong real-time protection through Shields Up’s ability to freeze Tier 0 AD object changes when an active attack is detected. Additionally, it tackles the challenges of protecting nonhuman and workload identities by identifying overprivileged or exposed Entra ID service principals and workload identities, broadening ITDR coverage beyond human accounts to include service and application identities that are increasingly targeted by attackers.

Segura: Segura 360 Privilege Platform

Solution Overview

Segura (formerly senhasegura) is a global identity security vendor specializing in PAM. Its goal is to eliminate privilege abuse, protect identities, maintain productivity, and ensure compliance across hybrid and cloud environments.

Segura’s 360 Privilege Platform integrates multiple modules (PAM Core, Certificate Manager, DevOps Secrets Manager, and Endpoint Privilege Manager) into a single platform that supports various deployment options, including SaaS, hardware appliances, and software. Its ITDR capabilities are based on its PAM features and delivered through privilege management and session control, leveraging user and entity behavior analytics (UEBA), cloud entitlement management, and a proprietary keystroke dynamics identification (KDI) feature that detects unusual or mimicked behavior during privileged sessions. The solution works with numerous identity providers, offering real-time behavioral analytics and continuous session monitoring with recording functions. Segura uses AI algorithms (originating from Quickium technology) to detect anomalous behavior and support predictive analytics. This also enhances its ability to detect zero-day attacks and advanced threats, supporting effective identity security.

Segura continues to expand its capabilities. This includes Cloud Entitlements, a CIEM feature that provides visibility and governance across major cloud providers. It has also introduced Segura Intelligence, a GenAI-powered tool that creates remediation scripts for cloud environments. Additionally, support for OCI environments has been added, further enhancing its cloud identity support for GCP, Azure, and AWS.

Segura is positioned as a Challenger and Fast Mover in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

Segura scored well on a number of decision criteria, including:

• Nonhuman identity (NHI) security: Segura can identify and inventory NHI across the organization's infrastructure. This includes Comprehensive Discovery, where it identifies all machine identities such as service accounts, bots, APIs, certificates, keys, and secrets. Segura locates NHIs in various sources, including on-prem systems, cloud environments (AWS, Azure, GCP, Oracle Cloud), containers, and orchestration platforms. It monitors activities and access patterns of NHIs to establish baseline behavior and detects deviations, such as unusual access times, frequency, or access to unexpected resources.

• Incident response analysis: The solution logs all activities within the platform, including user actions, access attempts, command executions, and system events. It records timestamps, user IDs, source IPs, and other vital details. Additionally, complete video recordings of user sessions, capturing keystrokes and on-screen actions, are stored. This extensive data enables investigators to conduct in-depth incident analysis. Segura Intelligence, an AI feature employing GenAI, further enhances incident response. It also maps detected activities and incidents to the MITRE ATT&CK matrix and other reporting standards such as NIST, ISO 27001, and more. This assists investigators in understanding the tactics and techniques used by adversaries.

• AI-enhanced SecOps: Segura Intelligence employs GenAI to help security operations teams manage tools more efficiently and effectively, detect threats, and prevent attacks. It translates complex security data into natural language, and its AI produces clear, actionable insights and recommendations by summarizing incidents, possible causes, and suggested remediation steps. It also develops dynamic incident response playbooks tailored to specific incidents, providing step-by-step procedures for addressing different types of security threats.

Opportunities

Segura has room for improvement in a few decision criteria, including:

• Proactive protection: The solution continuously monitors the IT environment for security threats and vulnerabilities, notifying administrators of anomalies in processes, integrations, connectivity, or access attempts. However, customers are increasingly seeking deception technologies for added protection, which this solution currently lacks.

• Extended IAM integration: The vendor offers a solid selection of out-of-the-box integrations, including with AD, Entra ID, Okta, AuthID, and ForgeRock among other IDPs. It also provides cloud identity management with integrations across Google, Azure, AWS, and Oracle clouds. There is still room to expand these options and improve integration with broader enterprise infrastructure elements. This could include third-party PAM solutions and other telemetry sources, such as XDR tools, to deliver a more context-rich view of identity and behaviors.

• Compliance management: Segura offers insights into an organization's security posture against common attack frameworks, including the MITRE ATT&CK framework, by mapping detected activities and potential threats to the tactics and techniques outlined in the MITRE ATT&CK matrix. Its compliance module also supports additional frameworks like HIPAA, GDPR, and SOC 2. The vendor has a solid foundation to expand upon and can add support for more compliance standards, as well as enable customers to import custom frameworks.

Purchase Considerations

Segura’s licensing varies by module: PAM Core, Domum, and MySafe are licensed per user; Certificate Manager is licensed based on the number of certificates; DevOps Secrets Manager is licensed per application or secret; and Endpoint Privilege Manager is licensed per device. Customers only needing ITDR require a PAM Core license. Contracts are offered for 1- or 3-year terms, with perpetual, subscription, and SaaS licensing options. Pricing is available through Segura’s partner channel.

Deployment is designed to be simple, with most installations manageable by a skilled IT team. For organizations needing extra support, Segura offers professional services through its PAM Success Green Path program, which guides customers through structured deployment and configuration to follow best practices.

The solution is suitable for SMBs, large enterprises, and MSPs.

Use Cases

Segura’s primary use cases focus on privileged access security. It assists organizations in implementing comprehensive PAM to prevent unauthorized access; ensure compliance with GDPR, HIPAA, PCI DSS, and ISO 27001; and make management easier across hybrid environments. Its Certificate Manager module addresses operational and security risks associated with unmanaged or expired certificates, helping customers resolve a frequently complex identity issue. Its PAM-integrated identity threat detection offers detailed behavioral analytics and session recording, providing visibility into privileged activities that could signal insider threats or compromised credentials.

Semperis: Identity Resilience Platform

Solution Overview

Semperis focuses on identity-first security and cyber resilience for enterprises operating hybrid and multicloud environments. Its Identity Resilience Platform combines ITDR, cyber crisis management, and specialized professional services.

The Semperis Identity Resilience Platform is an ITDR solution that protects identities across on-prem AD and cloud IdPs. It continuously assesses posture, detects and analyzes malicious or risky changes, provides automated and guided response and rollback, and delivers recovery for identity systems themselves. The Identity Resiliency Platform is a mix of on-prem deployed elements (Semperis Directory Service Protector (DSP)) and SaaS-based Lightning Intelligence. Semperis's broader platform also includes Active Directory Forest Recovery (ADFR), Disaster Recovery for Entra Tenant (DRET), Recovery for Okta, and the Ready1 cyber crisis management platform, providing organizations with a comprehensive before-during-after identity resilience capability.

DSP integrates with multiple data sources (including Active Directory replication streams used as monitoring data sources), providing coverage of all directory changes (including those that manipulate or bypass security event logs) and many agent-based detection tools. This tamper-resistant visibility supports the platform's detection library of IOEs and IOCs. Each finding is assigned severity scores and remediation guidance, and the platform features an Auto Undo capability to automatically revert malicious or high-risk directory changes. DSP's Identity Runtime Protection (IRP) detects attack patterns such as password spray and credential stuffing at runtime. Lightning Intelligence provides continuous monitoring and attack path management for multiforest and multitenant hybrid identity environments. Lightning Intelligence scans for hundreds of IOEs, including agent identity IOEs, and presents security scores across the multiforest, multitenant environment. Attack path analysis provides a visual map of risky access paths leading to Tier 0 assets, helping organizations identify previously undisclosed domain-persistence techniques. These tools, combined with Active Directory Forest Recovery (ADFR) and DRET or Recovery for Okta, offer an identity resilience strategy that includes prevention, detection, response, and recovery.

Semperis is positioned as a Challenger and Fast Mover in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

Semperis scored well on a number of decision criteria, including:

• Automated incident response: Semperis offers a comprehensive set of auto-remediation features. Its Auto Undo (rollback) tool for risky directory changes (such as group memberships, ACL/permission modifications, delegation updates, and Entra ID role, group, and user changes) is highly valuable for security teams. It also provides near-real-time responses from its AD replication stream, minimizing the window of opportunity for attackers. Furthermore, it supports a human-in-the-loop model, which can be customized per rule as either alert-only or auto-execute. Its responses are categorized by severity, enabling faster prioritization. The ability to reverse false positives also helps reassure users about automatic remediations.

• Incident response analysis: Change history and incident views show who, what, when, and where for AD and Entra ID changes. The platform provides IOC dashboards and incident correlation tools to help operators quickly identify attack paths. It also includes MITRE ATT&CK mapping of security indicators to ensure a consistent understanding of attacks. Additionally, it offers attack path analysis to help understand the blast radius, ensuring the extent of an attack is clear. Lightning Intelligence generates visual maps of attack paths leading to Tier 0 assets, enabling users to establish secure zones to protect assets from unwanted access and identify previously undisclosed domain-persistence techniques.

• Enterprise security reporting: The solution offers built-in reports covering security posture, operational AD and Entra health, and compliance, including GDPR, HIPAA, PCI, and SOX. It also has a Report Authoring Tool that enables customers to create custom report templates. Additionally, it provides executive dashboards, such as Security Overview and Assessment views, to promote broader threat sharing within an organization. For those using other reporting tools, it supports integration with Power BI and Tableau.

Opportunities

Semperis has room for improvement in a few decision criteria, including:

• AI-enhanced SecOps: While the vendor uses AI and ML to enhance threat detection, native AI-assisted operational tooling for security teams remains on the 2026 roadmap. Semperis has delivered a field-ready integration between Lightning Intelligence and Microsoft Sentinel, with Security Copilot agents able to surface Lightning-derived identity context within the Microsoft security ecosystem. This is useful for Microsoft-centric customers, but it is reliant on Microsoft's AI layer rather than native Semperis capability. Delivering these planned capabilities natively to its platform would be a valuable addition.

• Extended IAM Integration: The offering has historically been focused on Microsoft Directory environments. Its recent MightyID acquisition adds native Okta support, while broader IAM integrations are part of its roadmap. Customers want their security investments to be part of their overall security ecosystem. Expanding its ability to connect more widely with IAM and other tools would boost its appeal, especially to larger organizations using different identity platforms.

• Proactive protection: Semperis provides a solid foundation through the Lightning Identity Graph and the complementary Forest Druid tool, delivering attack path visualization, Tier 0 exposure assessment, and prioritized remediation guidance, complemented by Identity Runtime Protection (IRP) for runtime detection of attack patterns. There are opportunities to enhance this further by adding breach and dark web monitoring, integrating deception technology, and introducing automated proactive remediation, such as forced MFA re-enrollment for at-risk accounts.

Purchase Considerations

Licensing is subscription based per identity, based on the number of users logging into Active Directory or primary identity systems, with pricing available through the Semperis sales team and its channel and technology partners. Additional platform components (including Lightning, Disaster Recovery for Entra Tenant [DRET], Recovery for Okta, and Ready1) are delivered as SaaS, giving organizations a hybrid deployment model across the broader Identity Resilience Platform. All Semperis solutions are also available through the Microsoft Azure marketplace.

The solution’s DSP component is self-hosted and requires a DSP Management Server (Windows Server), a SQL Server database, and, optionally, an Identity Analytics Server (IAS) appliance for large-scale analytics. Guided deployment is provided at no extra cost by Semperis's technical team. Deployment instructions are also available for AD administrators and IT staff. Professional services are recommended for multiforest or multidomain setups, deployments involving ADFR or DRET, and organizations seeking a turnkey solution that includes SIEM and SOAR integration.

Semperis is suitable for SMBs, large enterprises, and MSPs.

Use Cases

Semperis has many use cases. Its strong Microsoft heritage means it provides strong capabilities via its notable Active Directory and Entra ID integrations. Its Auto Undo feature provides a powerful option for organizations that need resilient near-real-time recovery within their Microsoft environments. Organizations looking to build identity resilience programs can combine DSP with ADFR, DRET, and Recovery for Okta to accelerate post-attack forensic analysis and achieve rapid recovery of Active Directory, Entra ID, and Okta infrastructure following ransomware or destructive attacks.

SentinelOne: Singularity Identity*

Solution Overview

SentinelOne specializes in endpoint, cloud, and identity security, offering its customers threat prevention, detection, response, remediation, and forensics.

Singularity Identity is SentinelOne’s ITDR component, a SaaS solution that includes two modules: Identity Posture Management and Threat Detection and Response. It mainly protects Microsoft Active Directory and also integrates with Okta. It provides real-time identity protection and full visibility across hybrid environments, defending on-prem and cloud-hosted Active Directory domain controllers and domain-joined endpoints from attackers. The solution detects credential abuse, privilege escalation, and lateral movement and uses deception techniques (such as displaying fake data to lure attackers to decoys) as an additional detection and disruption layer.

SentinelOne has continued expanding its capabilities with a new identity security portfolio designed to counter attacks involving both human accounts and NHIs, including AI agents and automated workloads. Singularity Identity, along with Prompt Security (which manages browser and AI tool usage) and Singularity Endpoint, share a common framework for visibility and response across human and nonhuman activities. This expansion emphasizes continuous session validation and real-time behavioral signals instead of relying only on authentication points. SentinelOne has also improved its NHI capabilities to include AI agents and automated workloads, distinguishing between human identity verification and nonhuman identity validation based on behavioral intent. Purple AI, SentinelOne’s security analyst tool, is integrated across the platform and helps improve security operations through case summaries, language translation, and natural language queries.

SentinelOne is positioned as a Leader and Fast Mover in the Maturity/Platform Play quadrant of the ITDR Radar chart.

Strengths

SentinelOne scored well on a number of decision criteria, including:

• Proactive protection: SentinelOne can implement strong proactive measures, providing valuable risk insights and some automated risk reduction while using deception technology to improve these capabilities. Its ability to proactively scan AD and Entra ID for potential risks and give clear mitigation steps is also beneficial.

• Automated incident response: Automation is a key part of SentinelOne’s product. It offers an automation platform that enables customers to create complex workflows with a no-code workflow builder. Purple AI also helps with agentic system investigations that can resolve alerts and learn over time to automatically remediate. Its automated responses include disabling compromised accounts, requiring password changes, preventing lateral movement, and quarantining devices through XDR integration. It also features extensive Marketplace integrations for SOAR, SIEM, and ITSM workflows.

• AI-enhanced SecOps: The vendor has heavily invested in using AI to enhance operational efficiencies. Its Purple AI feature continues to evolve by adding new agentic functions, such as deep security reasoning, auto-triage, auto-investigations, and full-loop remediation with Hyperautomation. Purple AI integrates with native and third-party data sources (including Okta, Zscaler, Palo Alto, Proofpoint, Fortinet, and Microsoft 365) to provide SecOPS teams with a comprehensive, context-rich view of identity threats.

Opportunities

SentinelOne has room for improvement in a few decision criteria, including:

• Compliance management: SentinelOne aligns threat guidance with threat frameworks such as the MITRE framework. It has also expanded compliance management with the addition of Singularity Cloud Security, which offers custom compliance capabilities that enable organizations to define, enforce, and monitor their own security and regulatory requirements across cloud environments. There are opportunities to enhance capabilities here; for example, by incorporating a more comprehensive compliance risk reporting mechanism, as many organizations need to adhere to a growing set of demanding compliance standards. While compliance assessment has extended into the cloud, supporting this capability in on-prem environments would provide additional value for customers.

• Enterprise security reporting: The current solution utilizes Purple AI to improve reporting through natural language queries, automated investigation summaries, and shared investigation notebooks. It also offers dashboards and trend views. However, SentinelOne could expand this further by integrating with enterprise BI tools like PowerBI, making SentinelOne a key part of business reporting.

• Nonhuman identity (NHI) security: SentinelOne continues to advance in this field. It offers insights into AD service and machine accounts and can provide posture management across AD and cloud IdPs such as Entra ID, Okta, Ping, SecureAuth, and Duo. The endpoint agent grants visibility into local credentials and service accounts. Expanding workload identity coverage through assessments of cloud identity providers is a beneficial step. The solution can also evolve in areas like NHI behavioral baselining and secrets scanning for issues such as leaking NHI API keys. Recent releases in Singularity Identity related to AI agents may help address some of these concerns and further improve its current features.

Purchase Considerations

Singularity Identity is available as an add-on within SentinelOne’s Singularity platform licensing structure. ITDR is included in the Commercial and Enterprise plans and is also available as a standalone add-on to the base subscription. Singularity platform licenses are per endpoint and subscription based.

As a SaaS product with a wide range of platform integrations, Singularity Identity is not expected to create a significant deployment burden for customers already using SentinelOne endpoint protection. Its effective use of AI may also help lower operational overhead.

SentinelOne is suitable for SMBs, large enterprises, and MSP customers.

Use Cases

SentinelOne Singularity Identity addresses several use cases. For customers already utilizing its Endpoint security solution, adding Identity will be an easy transition and will enhance overall security posture. For those who are not yet adopters but want to see a clear link between identity and endpoints (so they can target identity misuse and endpoint-based reconnaissance of domain controllers, service accounts, and local credentials), this will be a compelling option. The solution's deception features mislead attackers attempting to move through the environment, while behavioral analytics identify escalation efforts and abnormal access patterns in real time; this is a valuable feature for those seeking a more proactive approach to their identity security program.

Sharelock: Sharelock Identity Security Platform (ISP)

Solution Overview

Sharelock emphasizes identity security through AI-powered solutions. It develops advanced technologies for protecting identities, providing scalable options tailored to complex identity systems.

Its Identity Security Platform (ISP) supports complex hybrid and multicloud identities, offering ITDR and ISPM. Available as SaaS, on-prem, cloud, and private SaaS, it connects to identity providers like Active Directory, Entra ID, and Okta, integrating with more than 30 systems across SIEM, SOAR, ITSM, EDR, XDR, and cloud platforms. It employs agentless methods via APIs, syslog, or SIEM forwarders, with an optional collector for real-time Active Directory event streaming.

At its core are three out-of-the-box autonomous multi-agent processes: SIA for Tier-1 investigation, SIR for automated remediation, and a Compliance Agent for real-time access control verification. The platform also includes an extensible Agent Builder for custom agent development. Sharelock includes a dedicated HITL microservice for structured AI-human collaboration across all agents, routing scoped approval tasks to SOC, Finance, or Legal teams through role-based dashboards, then resuming automated workflow orchestration. The platform applies ML-based behavioral baselines to both human and nonhuman identities (including service accounts, API keys, machine identities, and AI agents), treating NHI coverage equally with human users. Behavioral deception works at scale and offers proactive protection by turning dormant accounts and inactive baselines into tripwires throughout the identity infrastructure rather than relying on a few honeypots. It also provides predictive insights by analyzing historical behavioral patterns, identifying accounts likely to become future attack points (for example, accounts with privilege creep, outdated MFA, or unusual peer group movement), and triggering proactive hygiene workflows before threats arise.

Sharelock is positioned as a Leader and Outperformer in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

Sharelock scored well on a number of decision criteria, including:

• Incident response analysis: Sharelock’s use of autonomous agents offers powerful capabilities. SIA enables autonomous investigation with full attack timeline reconstruction, attack chain visualization through ArangoDB graph model, and cross-source telemetry correlation (IdP, IGA, PAM, Cloud, SIEM, EDR, Network). It also includes complete MITRE ATT&CK technique mapping. Additionally, it provides root cause analysis to identify initial compromise vectors. The solution further offers copilot-style assistance with natural language queries, drill-down navigation, and the ability to override severity levels.

• AI-enhanced SecOps: The solution centers on autonomous agents within its SecOPS approach. SIA handles autonomous Tier-1 investigations, including evidence collection, timeline rebuilding, MITRE mapping, and remediation suggestions. It also offers natural language querying through PyCode Generator MCP, along with plain language threat summaries and AI-driven prioritization via its six-stage Threat Modeler. Additionally, the system helps in creating playbooks.

• Automated incident response: Sharelock’s agentic AI offers a flexible automation solution, enabling AI bots to conduct initial incident analysis and automate mitigation steps to block at-risk identities and credentials. The platform includes automated threat responses for quick containment, such as disabling compromised accounts, enforcing MFA, terminating risky sessions, and initiating access recertification campaigns.

Sharelock was classified as an Outperformer for its strong delivery of capabilities over the previous period, as well as a good product roadmap. The vendor also scored high in all of our emerging features categories, demonstrating a commitment to leading-edge platform development.

Opportunities

Sharelock has room for improvement in a few decision criteria, including:

• Compliance management: This feature has improved, especially with the addition of its Compliance Agent. The Compliance Agent maps to six regulatory frameworks (SOX, NIS2, ISO 27001, GDPR, PCI DSS, and HIPAA) and supports real-time enforcement via SOP/SOW import. The vendor has an opportunity to expand this further with additional prebuilt compliance reporting templates and a full compliance reporting engine.

• Proactive protection: Sharelock’s posture management helps identify vulnerabilities like orphan accounts, MFA gaps, and excessive privileges. It also connects with external threat intelligence feeds to spot leaked credentials on the dark web and other sources. While the solution lacks native honeypot deployment, it does provide deception technology by turning dormant accounts and inactive baselines into tripwires throughout the identity infrastructure. Focused on real-time threat detection and prevention, it does not currently support threat simulation and advises customers to use third-party tools instead.

• Enterprise security reporting: The solution provides a reporting framework that offers detailed insights into an organization’s identity threats and security posture. However, it currently does not integrate with external reporting tools such as Power BI or Tableau. Incorporating this feature would allow Sharelock to become a key part of a comprehensive enterprise reporting strategy.

Purchase Considerations

Sharelock is licensed on a per-user, subscription basis. Customers should note that a minimum two-year commitment is required. Pricing is not publicly available and is obtained directly from the Sharelock sales team or through certified partner channels. The full platform, including ITDR, ISPM, agentic AI capabilities, and Content Packs, is covered by a single license rather than tiered separately.

Sharelock is designed for straightforward deployment by proficient IT and security teams. Sharelock claims that initial deployment typically takes one to two weeks. A no-code configuration interface allows customization of behavioral indicators and response workflows without scripting. Professional services from Sharelock's in-house team or certified partners are recommended for deployments with more than 10,000 users, advanced customization, or organizations lacking Kubernetes expertise for on-prem deployments.

Sharelock targets medium-to-large enterprises and strategic institutions (more than 1,000 users) with complex identity infrastructures. It also targets MSPs.

Use Cases

Sharelock addresses various use cases. It is effective for organizations with high ratios of NHIs, using its behavioral parity approach to detect compromised service accounts, API keys, and machine identities with the same level of analysis applied to human users. Security operations teams aiming to reduce analyst workload utilize the autonomous SIA and SIR agents to investigate and contain identity threats without manual Tier-1 triage. Organizations managing complex hybrid identity environments combine the ITDR and ISPM capabilities to detect active threats and address posture risks (such as orphaned accounts, excessive privileges, and MFA gaps) within a single platform rather than relying on separate tools for each function.

Silverfort: Identity Security Platform

Solution Overview

Silverfort is a vendor specializing in identity security, aiming to unify protection across fragmented identity infrastructure without requiring changes to endpoints, applications, or identity providers.

Silverfort’s Identity Security Platform provides unified visibility, policy-based protection, and threat detection for identities across on-prem, cloud, and hybrid environments. The platform enables organizations to monitor authentication activities, identify identity-based threats, and enforce runtime security controls during operations. Its Identity Security Platform utilizes patented Runtime Access Protection (RAP) to seamlessly integrate with existing IAM solutions and enforce security controls (including MFA) directly at the authentication layer. This approach extends MFA and risk-based policy enforcement to authentication flows that usually can't support it, such as local accounts and legacy protocols like NTLM, LDAP, and Kerberos. Its Authentication Firewall acts as an inline control point for authentication and access attempts, assessing risk in real time and capable of allowing, blocking, or challenging access before granting it. Its comprehensive data collection offers detailed analytics, including identity security posture reports, log analytics, and real-time actionable insights dashboards.

Silverfort’s acquisition of Rezonate has broadened its offerings to include cloud identity visibility, cloud NHI security, cloud ITDR, and ISPM, complementing its core on-prem solutions. Its AI Agent security now provides visibility into AI agent identities, associated risks, and runtime enforcement through MCP gateway and native integrations. Additionally, a SaaS deployment option is now available alongside the established self-hosted on-prem and cloud models.

Silverfort is positioned as a Leader and Outperformer in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

Silverfort scored well on a number of decision criteria, including:

• Automated incident response: Silverfort provides automated incident response using its patented RAP technology. It supports a variety of automated actions, including blocking or allowing authentication in real time, triggering step-up MFA, forcing password resets, restricting service accounts via virtual fencing, enforcing JIT access, escalating incidents to SIEM, SOAR, ITSM, and disabling accounts. Automated responses can be carried out instantly during detection with sub-second enforcement at the authentication layer. Approval workflows are available for high-impact actions, giving customers human oversight over complex automations. Actions can be reversed within the platform, reducing the risk of rogue processes causing significant issues. Additionally, it offers AI-assisted risk scoring to assist in response decisions.

• AI-enhanced SecOps: Silverfort offers AI-powered investigation features, including AI-assisted filtering of authentication logs, LLM-based natural language query options, and AI-driven anomaly detection. Analysts can perform free-form log searches without needing expertise in query languages. It also provides an MCP server, enabling integration with third-party copilot-like tools.

• Nonhuman identity (NHI) security: Silverfort delivers comprehensive NHI security, including continuous discovery, behavioral analysis, risk prioritization, and threat detection for application identities, workload identities, and other machine identities across both on-prem and cloud environments. Silverfort provides runtime access enforcement for service accounts using RAP, which allows for “virtual fencing” of AD service accounts by restricting their activity to established intent based on observed behavioral profiles and source-to-destination access mapping, without modifying applications or credentials.

Silverfort was classified as an Outperformer for its rapid feature development and an ambitious product roadmap. The vendor also scored high in all of our emerging features categories, demonstrating a commitment to leading-edge platform development.

Opportunities

Silverfort has room for improvement in a few decision criteria, including:

• Compliance management: Silverfort maps identity security findings to MITRE ATT&CK, ISO 27001, NIST, OWASP, and SOC 2 in cloud environments. It also provides zero trust alignment insights. However, while Silverfort can analyze identity security against best practices and security standards, it currently cannot assess it within the context of compliance and governance frameworks, a feature that customers would value.

• Proactive protection: The solution provides proactive protection by enforcing MFA and blocking access. It also supports proactive security assessment through its ISPM module. However, this could be improved further by including support for methods like deception technology, which many organizations see as a valuable tool in combating identity attacks.

• Enterprise security reporting: Silverfort provides a strong level of technical reporting. It has continued to improve this area by adding reports for its ITDR and ID posture management. It also offers executive dashboards that include identity risk posture, security trends, and ROI metrics. However, it could be further improved by integrating with enterprise reporting tools such as Power BI or Tableau. This would help it become a more central part of enterprise reporting.

Purchase Considerations

Silverfort licensing is subscription based and mainly structured around company size and deployment scope instead of a strict per-user or per-device count. The platform is licensed through four plans, with module-level purchasing available à la carte. Subscriptions are typically offered for one or multiple years, often three years for multiyear agreements. Pricing is not publicly listed; it is determined based on the customer's environment, scale, and selected modules and is available directly from Silverfort's sales team or authorized partners.

A deployment assistant tool performs a 24-hour assessment of authentication volume, protocols, and usage patterns prior to deployment, providing sizing and architecture recommendations. SaaS deployments are intended to be managed by the customer's IT team. Self-hosted and private cloud deployments in large or complex environments are usually supported by Silverfort sales engineering.

The solution suits SMBs, large enterprises, and MSPs.

Use Cases

Silverfort addresses challenges faced by organizations with large on-prem or hybrid environments by allowing them to extend MFA and risk-based access controls to local accounts and legacy protocols and infrastructure that cannot natively support modern authentication. This helps close security gaps left by agent-based and cloud-native IAM tools. Security operations teams incorporate Silverfort's identity telemetry and risk signals into SIEM workflows to treat identity as a primary detection signal alongside endpoint and network data. This enables quicker identification of credential misuse, lateral movement, and privilege escalation. Organizations aiming to enforce runtime containment use the Authentication Firewall to block or challenge access for at-risk identities during an attack instead of responding after access has already been granted.

Varonis: Unified Data Security Platform

Solution Overview

Varonis is a data security company with a Unified Data Security Platform that safeguards complex data ecosystems across SaaS, IaaS, and hybrid cloud environments. It is an established vendor with a large global customer base spanning all industries.

Varonis’s SaaS-based platform offers extensive integrations across SaaS, on-prem, IaaS and PaaS, and databases, using APIs or a local collector. Agents are only necessary where native APIs lack sufficient visibility and control. Varonis Identity Protection enhances the platform’s security with dedicated features for detecting and responding to identity threats. The solution emphasizes blast radius rather than separating identity and data risks, addressing both by connecting who a user is with what they can access and what they are doing.

Identity Protection features include ML-based identity classification for both human and nonhuman entities, along with peer and behavioral analytics to detect deviations from normal behavior. It also monitors ITDR of identity providers like Entra ID, Okta, and Active Directory, looking for suspicious logins, password resets, MFA changes, and policy updates. The solution supports proactive prevention with automated identity posture management that flags and remediates stale accounts, excessive permissions, and missing MFA without manual action.

Varonis has further strengthened its AI capabilities within its managed data detection and response (MDDR) service, enabling AI agents to correlate log data, link IP addresses to known threat actors, and reduce noise for analysts. Its Athena assistant provides various optimizations to assist operations staff.

Varonis is positioned as a Leader and Fast Mover in the Maturity/Platform Play quadrant of the ITDR Radar chart.

Strengths

Varonis scored well on a number of decision criteria, including:

• Nonhuman identity (NHI) security: Varonis Identity Protection clearly differentiates between human and nonhuman identities through ML-based identity classification. The platform monitors service principals, workload identities, and multicloud identities across various cloud services, including Salesforce, Google Workspace, GitHub, Jira, and ServiceNow. Its coverage also includes AI agents, with Varonis AI Identity Protection for Salesforce, as well as Agentforce monitoring AI agent activity and permissions. When a risk is identified, automated remediation revokes excessive NHI permissions to quickly secure the environment.

• Compliance management: Varonis provides built-in support for compliance frameworks like Sarbanes-Oxley, PCI DSS, GLBA, HIPAA, CCPA (CPRA), GDPR, UK Data Protection Act, New Zealand Privacy Act, NY SHIELD, Colorado Privacy Act, Virginia CDPA, CJIS, and more. Customers can also customize rules and visual dashboards to track key parameters.

• Incident response analysis: Varonis provides a complete audit trail of all actions related to data and identities (including both human and NHI) across cloud and on-prem environments. It features MITRE ATT&CK mapping for all alerts. Athena AI offers AI-powered investigation features such as natural language queries, root cause analysis, custom playbook creation, and executive summaries. It also enables context-aware investigations across identity and data telemetry. Analysts can access a searchable history of data events, enriched with context like sensitivity, account type, device name, and geolocation.

Opportunities

Varonis has room for improvement in a couple of decision criteria, including:

• Automated incident response: Identity Protection provides automated remediation, such as revoking access, removing entitlements, and eliminating ghost accounts automatically. Meanwhile, its Agentic AI for MDDR offers autonomous containment. However, some advanced automated responses are still connected to its MDDR service. Offering these services to all customers will expand automation capabilities to a wider user base, enabling them to respond more swiftly to risks.

• Proactive protection: The solution does offer a range of proactive protections. This includes continuous identity posture management with automated remediation. It also provides access graphs (AWS, Azure) to visualize permissions and exposure. There are opportunities to expand this in areas such as streaming threat intelligence related to large-scale credential leaks and breaches. This would be a valuable addition, as would support for deception technology, which is becoming an increasingly important tool in fighting identity-based attacks.

Purchase Considerations

Varonis is a modular system licensed on a per-user, per-module basis, with IaaS services licensed based on capacity. Annual subscriptions are standard.

As a SaaS platform, deployment should be straightforward. Varonis collaborates with its customers during onboarding to optimize policies and identity threat alerts. For clients needing extra operational expertise, the MDDR service improves detection capabilities and decreases the number of actionable tickets, now further supported by AI-driven features. Varonis’s professional services team helps with implementation and provides ongoing advice based on best practices.

Varonis is designed for larger organizations and MSPs and may not be suitable for smaller companies.

Use Cases

Varonis addresses multiple use cases, helping customers identify data-related identity threats by correlating identity behavior with data access patterns. It detects threats such as a compromised account accessing sensitive files outside normal patterns, enabling security teams to prioritize responses based on actual data exposure risk rather than generic severity scores. Its automated identity posture management continuously identifies and automatically resolves identity hygiene issues, including stale accounts, overly-permissioned identities, and missing MFA configurations across SaaS, cloud, and on-prem environments. This reduces the attack surface without manual security operations. For customers with extensive and complex infrastructure, Varonis provides consistent identity threat detection across a broad data estate spanning Microsoft 365, Salesforce, Google Workspace, AWS, Azure, and Snowflake, helping prevent fragmentation in identity coverage and detection blind spots. For those needing extra support, its vendor-delivered managed detection and response (MDR) service will be appealing.

Vectra AI: Vectra AI Platform

Solution Overview

Vectra AI offers a hybrid solution for attack detection, investigation, and response. It combines threat data from networks, identities, the public cloud, SaaS, and GenAI, using its patented Attack Signal Intelligence to help organizations identify, prioritize, investigate, and stop identity cyberattacks.

The Vectra AI Platform enhances identity security by detecting misconfigurations, vulnerabilities, and unusual behaviors in both human and nonhuman identities. It employs behavioral AI to monitor activities and generate attack graphs. The AI Analyst, available to MDR customers, consolidates signals for faster threat detection, reduces unnecessary investigations, and eases analysts' workload. The Vectra AI Assistant enables analysts to investigate using natural language queries across more than 25 data streams for incident response and hunting. Its AI Agent Security monitors AI agents' authentication, resource access, and interactions to identify anomalies, providing early alerts for potential misuse or compromise. High-priority threats are displayed on clear dashboards, allowing users to quickly understand and address ongoing risks. Integration with Active Directory and Entra ID facilitates account disabling and enforces MFA prompts for high-risk identities. With proper EDR integration, the platform can isolate high-risk machines.

The full solution is available through five modules that cover on-prem, cloud, SASE, and SaaS environments, which can be combined in any way to meet an organization’s coverage needs.

Vectra AI is positioned as a Leader and Fast Mover in the Innovation/Platform Play quadrant of the ITDR Radar chart.

Strengths

Vectra AI scored well on a number of decision criteria, including:

• Incident response analysis: The solution offers AI-driven attack narrative stitching that links identity, network, and cloud activity to provide a comprehensive view of an incident's attack path. Attack Graphs deliver blast radius visualization and AI-assisted search to support investigations. The solution also offers automated timeline reconstruction, with detailed MITRE mapping, event-specific detection details, and one-page summaries for each alert. Along with its AI assistant tools, this provides a complete incident analysis platform for customers.

• AI-enhanced SecOps: Vectra AI offers extensive AI assistant features, including AI-supported search with natural language queries, AI-driven triage, stitching, and prioritization agents, along with guided investigation workflows. It also supports response playbooks through SOAR integrations. Customers can keep human-in-the-loop controls with explainable AI. Its AI stitching is notable for aggregating threat telemetry from many sources and linking various identities to a single identity to improve risk analysis.

• Automated incident response: Vectra AI provides extensive native response actions, including account lockdown, session revocation, password resets for Entra ID, and traffic lockdown through firewall integrations (Palo Alto, Fortinet). It works with a number of EDR tools to enforce device lockdown, including Microsoft Defender, SentinelOne, and CrowdStrike. It supports automated workflows via SIEM, SOAR, and ITSM. Its vendor-delivered MDR offers 24/7 response capabilities.

Opportunities

Vectra AI has room for improvement in a few decision criteria, including:

• Compliance management: Vectra AI offers an Identity Posture Dashboard that clearly highlights potential risks. These are mostly assessed against security controls like MITRE and NIST rather than business compliance frameworks. As organizations face increasing compliance demands, with identity as a key component, providing better insight into how security risks can impact compliance would be a helpful addition.

• Extended IAM integration: Vectra AI's solution integrates with AD and Entra ID, providing visibility and threat detection for organizations using Okta by monitoring attacker interactions within Entra ID and M365. It tracks identities from AWS IAM and Azure RBAC. It also offers APIs for customers wanting to build custom integrations. However, the vendor's out-of-the-box integrations are somewhat limited. Adding more integrations with other popular IAM systems would be helpful.

• Enterprise security reporting: The Vectra AI platform offers a fully customizable view of threats and emerging risks in the environment, helping teams proactively monitor and respond to evolving threats. However, it appears limited in its ability to integrate this reporting with other enterprise tools like Power BI. While providing APIs enables customers to create custom integrations, offering ready-made, out-of-the-box integration options would simplify adoption for users.

Purchase Considerations

Vectra AI Platform licensing varies based on coverage. Active Directory and local network identity licensing depends on the number of active IPs, while Entra ID and M365 SaaS licensing are based on monitored identities. Azure and AWS cloud coverage is determined by resource and log volume metrics. Licensing operates on a subscription basis, usually for one to three years. Prices are not publicly available and must be obtained through Vectra AI or its partner network.

Deployment is entirely SaaS based and agentless, requiring only API and log-based access to identity, cloud, and network telemetry. A security or IT team can typically complete the initial deployment independently within minutes. In-app onboarding and automated tuning are included at no extra charge. Professional services are offered for environments with higher complexity or large-scale cloud deployments, delivered directly by Vectra AI or through its partner and MSSP network.

This solution is suitable for SMBs, MSPs, and large enterprises.

Use Cases

Vectra AI is effective in many scenarios. For customers aiming to combat hybrid human and nonhuman identity attacks, the platform correlates attacker behaviors across Active Directory, Entra ID, M365, AWS, Azure, and Copilot for M365 to detect credential abuse, lateral movement, and privilege escalation in real time. This enables security teams to intervene before attackers can cause damage. It supports customers with proactive protection initiatives to enhance identity hygiene and advance zero trust strategies, such as active posture monitoring, which detects stale accounts, excessive privileges, missing MFA, and legacy authentication that attackers might exploit. For those looking to improve incident analysis, the Vectra AI Assistant and Attack Graphs provide quick, detailed visibility into attack scope and impact without requiring complex manual queries. For additional support, its vendor-delivered MDR service will be appealing.

Zscaler: Identity Protection*

Solution Overview

Zscaler offers security solutions for both SMBs and enterprises. Its cloud-native Zero Trust Exchange platform is designed to securely connect users, devices, and applications, no matter where they are.

Zscaler’s ITDR feature, Zscaler Identity Protection, is part of this platform and focuses on visibility into identity attack surfaces, detecting identity changes, and identifying identity threats. As a SaaS-only service, Zscaler Identity Protection is integrated into the Zscaler Client Connector and requires no additional agents. It connects to Microsoft Active Directory, Entra ID, and Okta, scanning directory infrastructure and highlighting risks such as identity misconfigurations, risky permissions, endpoint credential exposure, and active identity-based attacks. Detection methods include DCSync, DCShadow, Kerberoasting, LDAP enumeration, session enumeration, privileged account access, and MFA bypass techniques.

Zscaler’s identity risk view aggregates threat detections, failed posture checks, Okta metadata, and policy blocks from other platform components into a single risk profile per identity, providing complete context for investigation and response. When an attack is detected, Zscaler Identity Protection can dynamically enforce access controls through the Zero Trust Exchange to restrict or terminate compromised identities in real time. Remediation guidance, including walkthroughs, commands, and scripts, helps security teams address identity hygiene issues. The solution also integrates with leading SIEMs and EDRs to align with SOC workflows and includes its own orchestrator for building custom automated workflows.

Zscaler is positioned as a Challenger and Fast Mover in the Maturity/Platform Play quadrant of the ITDR Radar chart.

Strengths

Zscaler scored well on a number of decision criteria, including:

• Automated incident response: Zscaler offers multiple native remediation options. Its detectors spot threats like DCSync, DCShadow, Kerberoasting, session enumeration, privileged account access, and LDAP enumeration. With these threat insights, security teams can quickly detect and address these risks. The solution also includes a comprehensive native orchestration engine that, through its integration with the client agent, can create workflows to effectively restrict risky activity. Its bidirectional Okta integration also allows risk signals to be sent to Okta for Universal Logout across supported applications and enables dynamic step-up authentication via Adaptive Access.

• Proactive protection: Zscaler provides many options for customers to proactively manage risks, enhanced with videos and walkthroughs that help identify and reduce threats. The platform scans Microsoft directories every 15 minutes for changes that could impact security. It also uses deception technology to lure attackers, allowing assessments without affecting production identities. Additionally, it employs MITRE ATT&CK mapping for better visibility into vulnerabilities and offers various remediation tools, including video tutorials, scripts, and commands.

• Enterprise security reporting: Zscaler offers a comprehensive suite of reporting features. This includes a unified risk scoring dashboard with MITRE ATT&CK mapping visualization. It also provides a trending risk score for identities to help increase visibility into identity security improvements. Additionally, it can display impact assessments for each issue with affected users. AI-generated cyber risk assessments are also available.

Opportunities

Zscaler has room for improvement in a few decision criteria, including:

• Nonhuman identity (NHI) security: The ITDR module provides several NHI protections, including AD posture assessment that covers service and privileged accounts. It consolidates identity risks by combining threat detections, failed posture checks, and Okta metadata. Its credential exposure scanning also examines credentials stored on endpoints. This could be further improved by adding dedicated NHI discovery, classification, and behavioral baselining to give customers more specific NHI insights.

• Extended IAM integration: While Zscaler offers extensive integration with Microsoft’s user directories and Okta, it lacks other out-of-the-box integrations. Adding these could be beneficial for larger customers with multiple identity platforms and locations.

• AI-enhanced SecOps: Although not specific to ITDR, Breach Predictor is a valuable addition for SecOps improvements and predictive analytics. It uses GenAI and multidimensional predictive models to forecast breach scenarios. AI-driven cyber risk assessments support zero trust strategies. There is still room for growth, such as adding copilot-style support for SecOps to enable natural language queries. Including advanced features like automating investigation summaries and generating playbooks will also help increase operational efficiencies for customers.

Purchase Considerations

Zscaler’s ITDR capabilities are integrated into the broader Zero Trust Exchange platform, available either as a bundle package or as an add-on to the Essentials tier. The license operates on a subscription basis, calculated per user seat.

As a SaaS-only product with no additional agents required beyond the existing Zscaler Client Connector, deployment should be straightforward for organizations already using Zscaler. The solution is activated from the central console and can quickly start scanning the directory infrastructure and presenting risk results after integration. Zscaler also has a large ecosystem of well-established partners along with its professional services team to provide assistance when needed.

Zscaler's solution is suitable for SMBs, MSPs, and large enterprises.

Use Cases

Zscaler Identity Protection covers multiple use cases. For existing Zscaler customers, it’s worth considering as an ITDR platform, needing only enablement with the right licensed options. For organizations aiming to manage identity attack surfaces, the platform offers continuous visibility into misconfigurations and risky permissions in Active Directory and Entra ID, with MITRE ATT&CK mapping that helps security teams identify blind spots, prioritize hardening efforts, and monitor hygiene improvements over time. For those with extensive Microsoft directory environments, it can detect advanced Active Directory attacks such as DCSync, DCShadow, and Kerberoasting in real time and can automatically enforce zero trust access controls to block compromised identities, stopping lateral movement before attackers can escalate privileges.

Identity is a key attack vector for cybercriminals and often causes cybersecurity breaches. Identity risk is broad. It relates to human users and also increasingly targets nonhuman accounts, such as service accounts, machine accounts, and API keys. The problem is worsened by the growing use of AI tools within the enterprise, including agents that have identities with access and, unlike other NHIs, have dynamic behaviors that can change. With these challenges, organizations must proactively identify risks and quickly isolate and stop active incidents as part of their cybersecurity strategy.

The ITDR market continues to grow and develop, with vendors taking one of three main approaches.

Full ITDR platforms: These solutions integrate with popular identity platforms, using their telemetry to assess security risks and respond quickly.

Threat analytics platforms: These solutions offer broader integrations and gather telemetry from various sources. They use analytics to normalize threat data and provide risk guidance through proactive alerting or integration with SIEM, SOAR, or ITSM platforms for automated responses.

Specific solutions: These generally do not offer a complete ITDR approach; instead, they concentrate on a particular area. However, they can help reduce identity attack risks. For instance, vendors specializing in deception technology can add an effective additional layer of protection.

Addressing the identity threats is a complex problem. However, there are some initial steps potential customers can take to better understand their requirements and help narrow down potential vendors.

• Understand current identity platforms: This should include capabilities related to current user directories, third-party locations such as SaaS apps, external identity platforms, and NHIs such as applications, machine accounts, and AI use.

• Evaluate existing investments to determine if they might address your needs: Many vendors offer additional capabilities. For instance, XDR vendors are adding ITDR capabilities along with those providing PAM and identity governance. Consider if any current technology partners or investments can offer a solution.

• Look at response automation: Assess the response types you might need. For simple account locking and risk activity displays, most platforms are sufficient. For comprehensive needs, including device isolation, evaluate both the platform's native features and integration capabilities with existing organizational tools.

• Assess a platform’s proactive approaches: Taking a proactive approach to identity security helps to reduce risk. Deception technologies, predictive analytics, and increasingly identity posture management all provide proactive guidance to addressing identity risk.

• Weigh your security maturity: Identity threats are complex, necessitating quick responses for security. Understanding security maturity is vital when selecting ITDR solutions. Fully automated options are appealing for those with limited experience and resources, while more mature organizations may prefer solutions that integrate widely and leverage existing tools for remediation.

The ITDR market will continue to evolve, especially in the areas of AI and NHIs. Agentic AI workloads are expanding the attack surface beyond human and traditional NHI accounts. The dynamic nature of AI agents means traditional approaches to identities and NHIs will no longer be suitable, and tools will continue to evolve to address this. AI is also reshaping detection and response itself, moving ITDR from reactive investigation toward predictive prevention and autonomous response. The shift to more proactive approaches will also be key as businesses recognize how crucial proactive identity security is, since relying on purely detection and response methods is too high risk. Technology consolidation is likely to persist as the lines between PAM, IGA, and ITDR continue to blur, with vendors and customers seeking identity security, governance, and lifecycle management in a single platform.

Identity poses a significant security risk and is a primary target for cybercriminals. Robust security and proactive protection must therefore be a priority. ITDR solutions can substantially mitigate risk and should be a part of every organization’s security considerations.

To learn about related topics in this space, check out the following GigaOm Radar reports:

• GigaOm Radar for Cloud Access Security Broker v4

• GigaOm Radar for Security Service Edge (SSE) v3

• GigaOm Radar for Data Security Posture Management (DSPM) v3

*Vendors marked with an asterisk did not participate in our research process for the Radar report, and their capsules and scoring were compiled via desk research.

For more information about our research process for Radar reports, please visit our Methodology.

Paul Stringfellow has more than 25 years of experience in the IT industry helping organizations of all kinds and sizes use technology to deliver strong business outcomes. Today, that work focuses mainly on helping enterprises understand how to manage their data to ensure it is protected, secure, compliant, and available. He is still very much a “hands-on” practitioner and continues to be involved in a diverse range of data projects. Paul has been recognized across the industry and has spoken at many industry, vendor, and community events. He writes for a number of industry publications to share his enthusiasm for technology and to help others realize its value.

Paul hosts his own enterprise technology webcast and writes regularly on his blog.

GigaOm provides technical, operational, and business advice for IT’s strategic digital enterprise and business initiatives. Enterprise business leaders, CIOs, and technology organizations partner with GigaOm for practical, actionable, strategic, and visionary advice for modernizing and transforming their business. GigaOm’s advice empowers enterprises to successfully compete in an increasingly complicated business atmosphere that requires a solid understanding of constantly changing customer demands.

GigaOm works directly with enterprises both inside and outside of the IT organization to apply proven research and methodologies designed to avoid pitfalls and roadblocks while balancing risk and innovation. Research methodologies include but are not limited to adoption and benchmarking surveys, use cases, interviews, ROI/TCO, market landscapes, strategic trends, and technical benchmarks. Our analysts possess 20+ years of experience advising a spectrum of clients from early adopters to mainstream enterprises.

GigaOm’s perspective is that of the unbiased enterprise practitioner. Through this perspective, GigaOm connects with engaged and loyal subscribers on a deep and meaningful level.

© Knowingly, Inc. 2026 "GigaOm Radar for Identity Threat Detection and Response (ITDR)" is a trademark of Knowingly, Inc. For permission to reproduce this report, please contact sales@gigaom.com.