Identity Threat Detection and Response. Because attackers sign in more often than they break in.

A stolen session token does not trip your firewall, does not land on an endpoint, and does not ask for a second factor. It just logs in as someone you trust. We watch the sign-ins, the tokens, the mailbox rules and the app permissions across Microsoft 365 and Google Workspace, and we shut the account down before it becomes an incident.

Identity & access · live -
Verified sign-in Anomaly contained
Every sign-in, token and app grant is read as it happens, so a replayed session or a rogue consent is contained before it becomes an incident.
The definition

What is identity threat detection and response?

Identity threat detection and response, or ITDR, is the continuous monitoring of your identity provider for signs that an account has been taken over: stolen session tokens, multi-factor bypass, malicious mailbox rules, unauthorised application consents and privilege changes. It watches how accounts are being used, and contains the ones being abused.

Cyberwall delivers ITDR as a managed service across Microsoft 365 and Google Workspace, monitored by the same 24/7 Security Operations Centre that runs your detection and response.

What we watch for

How accounts actually get taken over, and what ITDR does about each.

Your identity provider records everything that happens to an account. Almost nobody reads those logs until after something has gone wrong. We read them continuously, and we act on what they show.

01

Session and token theft

An attacker who steals a valid session cookie is already past MFA. The token carries proof that the second factor was satisfied, so nothing prompts again. We watch for the signature of a replayed session: the same account appearing from a new device fingerprint, a new network, or two locations that cannot both be true, mid-session rather than at sign-in.

Response: revoke every active session and token for that account, not just the password.

02

MFA bypass, fatigue and quiet downgrades

Repeated push prompts until someone taps approve to make it stop. A new authenticator registered at 3 a.m. with no help desk ticket behind it. A user quietly moved from an app-based factor back to SMS. Legacy protocols that never supported MFA still accepting logins. Each is visible in the audit log the day it happens, and each is an account takeover in progress.

03

Mailbox rules and business email compromise

The first thing an intruder does in a mailbox is make sure you do not notice. A rule that forwards everything to an outside address. A rule that deletes replies containing the word invoice, so the finance thread only has one participant. A delegate or send-as permission granted to an account nobody recognises. We flag new and modified rules, external forwarding, and delegation changes as they are created, on Exchange Online and on Gmail.

04

Malicious app consent

This is the one that survives a password reset. A user approves an OAuth consent prompt, often a free PDF tool or a fake document viewer, and grants a third-party application standing permission to read mail and files. The attacker never needs the password again, and resetting it changes nothing. We watch new app registrations and consent grants, flag the ones requesting more than their function requires, and revoke the grant rather than just the credential.

05

Privilege escalation and policy drift

A new global or super administrator. A conditional access or context-aware access policy loosened during a project and never restored. A break-glass account used outside an emergency. A dormant admin account active again after months of nothing. These are the changes that turn one compromised mailbox into tenant-wide access, and they rarely come with a ticket.

06

The accounts nobody owns

Offboarded staff still licensed and still able to sign in. Shared mailboxes with a password on them. Service accounts and integrations with no second factor and no expiry. We inventory them, tell you which ones are reachable from the internet today, and keep the list current instead of producing it once at onboarding.

Every one of these is a sign-in, not a break-in. Your firewall, your endpoint agent and your email filter are all looking somewhere else when it happens.

Choosing the right layer

ITDR vs MDR vs SIEM: which one do you actually need?

These three get confused constantly, usually by vendors who sell only one of them. They answer different questions and most organisations end up running all three.

ITDRMDRSIEM
What it watchesYour identity provider: sign-ins, tokens, app consents, mailbox rules, privilege changesYour endpoints and network: processes, files, lateral movementEverything that produces a log, collected and correlated
The attack it catchesAn attacker signing in with a valid credential or a stolen tokenAn attacker running something on a device you managePatterns that only appear when sources are compared
When you need itYour people work in Microsoft 365 or Google WorkspaceYou manage laptops and serversAn auditor asks for retention, or an investigation needs history
What it producesA locked account and a revoked sessionA contained deviceAn evidence trail

At Cyberwall all three run through the same Security Operations Centre, so a compromised account and the device it reaches land in one investigation rather than three tickets.

Response

What happens when a detection fires.

An identity alert is only worth what happens next. Ours goes to the same 24/7 SOC analysts who handle the rest of your environment, and they act rather than forward:

Active sessions and refresh tokens revoked, so the stolen cookie stops working immediately
The account disabled or forced through re-authentication, depending on what we find
Malicious inbox rules and forwarding reversed, and the messages already diverted identified
Suspicious app consents withdrawn at the tenant level
Privilege changes rolled back to the state they were in before
A written record of what happened and what was done, ready for your insurer or your auditor

If what we find is bigger than one account, it escalates into our incident response process, with a triage callback, active engagement inside the hour, and a fully mobilised team within four.

Containment actions that affect a user's access are agreed with you in advance. You decide during onboarding which we take immediately at 3 a.m. and which wait for a phone call.

Where it starts

Start with a Microsoft 365 or Google Workspace identity risk assessment.

Before anything is monitored, we run a configuration and posture assessment of your environment. It is read-only, it has a quick turnaround from the moment access is granted, and it produces a document you can hand to your leadership without translating first.

What comes back:

A posture score benchmarked against CIS and NIST control sets, and against Microsoft's own Secure Score where it applies, with the specific settings behind the number rather than just the number
Every account without multi-factor authentication, including the service accounts and shared mailboxes that usually get missed
Administrator inventory: who holds elevated rights, when they last used them, and which ones nobody can account for
Third-party applications holding permissions in your tenant, and what each one can actually reach
External forwarding rules and delegations currently in place
Conditional access or context-aware access policies, and the gaps between what they claim to enforce and what they do
A prioritised remediation list covering what to fix this week, what to fix this quarter, and what to accept

Most of what turns up is not an attack. It is a policy someone loosened two years ago, an app a departed employee authorised, an admin account belonging to a contractor who finished the project 3 years ago. That is the point: you cannot monitor your way out of a configuration you do not know you have.

The assessment is yours whether or not you go any further with us.

Both platforms

Microsoft 365 and Google Workspace, watched the same way.

The attacks are identical across both. The words are different, so here is the mapping:

Microsoft 365Google Workspace
Sign-in and audit telemetryEntra ID sign-in and audit logsAdmin console audit and login events
Conditional policyConditional AccessContext-Aware Access
Elevated rightsGlobal and privileged role assignmentSuper admin and delegated admin roles
App permissionsEnterprise app registrations and OAuth consentMarketplace apps and API access grants
Mail manipulationExchange Online transport and inbox rules, delegation and send-asGmail filters, forwarding and delegation

If you run both, and organisations your size often do, whether from an acquisition or one department that never migrated, both are covered under the same service and appear in the same monthly report.

Onboarding and cadence

What the first twelve days, and every month after, actually look like.

Days 1 to 2

Read-only connection to your identity provider. No agents, no endpoint installs, nothing for your team to deploy. The posture assessment runs against your live configuration.

Days 3 to 7

Assessment findings reviewed with you. We separate what is an active risk from what is merely untidy, and agree the remediation order. We also agree the containment rules, covering what we do automatically and what needs a call first. The detections begin learning what normal looks like in your organisation, including who travels, who works nights, and which integrations sign in at odd hours.

Days 8 to 12

Tuning. False positives removed, thresholds set against your working patterns, escalation contacts confirmed. Tuning continues through the first weeks of service as the behavioural picture fills in, so expect us to check a few things with you after go-live.

Monthly

A report showing what was detected, what was contained, how your posture score moved, and what is still outstanding. Written to be forwarded, not decoded.

An identity alert nobody tuned is a pager that goes off until someone turns it off. The tuning period is why ours does not.

Why it matters

Why identity is the perimeter now.

Ten years ago an attacker had to get through something: a firewall, a VPN, an unpatched server. Today the fastest route into an organisation your size is a valid credential and a session token, bought or phished, used from a laptop that looks unremarkable. Nothing is exploited. Nothing is installed. There is no malware for an endpoint agent to find, because no malware was used.

An analysis of 661 incident response and managed detection cases put an identity-related root cause behind roughly two-thirds of them.* Whatever the exact figure in your environment, the direction is not in dispute. The account is the attack surface now.

Most organisations we assess have done the obvious things. MFA is on. Endpoint protection is deployed. Email filtering works. And nobody is reading the sign-in logs, nobody noticed the forwarding rule created in March, and nobody can say which applications hold permission to read the company's mail.

  • Your firewall never sees it, because the traffic is a normal login to a cloud service
  • Your endpoint agent never sees it, because nothing runs on a device you manage
  • Your email filter never sees it, because the message comes from a real account inside your own domain

That gap is what this service closes.

Glossary

Identity security terms, in plain English.

Session token theft
A stolen browser cookie that already proves the account passed multi-factor authentication. Replaying it grants access with no prompt.
MFA fatigue
Repeated authentication prompts sent deliberately until the user approves one to make them stop.
OAuth consent abuse
A user approves a third-party application, which is then granted standing permission to read mail and files. Changing the password does not revoke it.
Business email compromise
Fraud committed from inside a real mailbox, usually by altering payment or invoice details in a conversation already underway.
Impossible travel
Two sign-ins from locations too far apart for one person to have travelled between them in the time elapsed.
Conditional access
Rules that decide whether a sign-in is allowed, based on the user, device, location and risk. Microsoft calls it Conditional Access. Google calls it Context-Aware Access.
Common questions

Questions IT Directors ask before signing on.

What does ITDR stand for?

ITDR stands for identity threat detection and response. It is the practice of monitoring an identity provider such as Microsoft Entra ID or Google Workspace for signs of account takeover, and containing the account when one is found. It sits alongside endpoint detection rather than replacing it.

We already enforce MFA everywhere. Is that not enough?

MFA stops credential stuffing and most password reuse, and it is the single highest-value control you can turn on. It does not stop a stolen session token, because the token already carries proof that MFA was satisfied. It does not stop a user approving a malicious app. And it does not stop push fatigue. MFA raises the floor. ITDR watches what happens above it.

We are on Microsoft 365 Business Premium. Do we not already have this?

Partly, and it is worth being precise. Business Premium includes Entra ID P1, which covers conditional access and the audit logs everything here depends on. The risk-based detections sit in P2, which is a separate licence. Either way the native tooling generates signals. It does not investigate them, correlate them with your endpoint and email telemetry, or act at 3 a.m. We will tell you exactly what your current licensing already covers as part of the assessment, including where the honest answer is that you do not need us for a particular piece.

What is the difference between ITDR and MDR?

MDR watches your endpoints and network for things being run. ITDR watches your identity provider for things being signed into. They overlap at the point where a compromised account is used to reach a device, which is why the same SOC runs both and both land in one investigation rather than two tickets.

Is ITDR required for SOC 2 and CMMC?

No framework names ITDR as a product. What they require is the underlying control. SOC 2 and CMMC both expect monitoring of access and privileged accounts, logging of authentication events, and a defined response when something anomalous appears. ITDR is how those controls get operated rather than merely documented, and the assessment output maps to them directly.

Does ITDR cover Google Workspace?

Yes. Sign-ins, admin activity, Marketplace app grants, Gmail forwarding and filters, and delegation are all covered, and appear in the same monthly report as any Microsoft tenants you run.

What do cyber insurers ask about identity controls?

Renewal questionnaires now commonly ask about multi-factor coverage including service accounts, administrator inventory, and authentication logging and retention. The assessment output maps to those questions directly. We coordinate with your carrier and provide the documentation they ask for. We are not on carrier panels and we do not place coverage.

What happens when something fires at 2 a.m.?

Our analysts investigate it then, not in the morning. If it is confirmed, we contain it inside the rules you set during onboarding and you get a written account of what happened and what was done. If it is bigger than one account, it becomes an incident response engagement.

Works with

Pairs naturally with these.

Do you know who is signed into your tenant right now?

Most IT teams do not, and finding out takes a read-only connection and a quick turnaround. Start with the assessment, or book a preparedness call and we will walk through what your current licensing already covers.

* Sophos analysis of 661 incident response and managed detection and response cases.