ShadowPlex Identity Protection
Decoy accounts and credentials that expose identity attacks and credential misuse early.
Access Control
Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
Addresses 553 stories in our coverage in the last 90 days 6 products that provide it
What it is
Monitoring of identity systems such as Active Directory, Entra ID and Okta for signs of misuse: impossible travel, stolen session tokens, privilege escalation and attack paths to admin rights.
How to value it
An attacker with valid credentials looks like an employee to most tools. ITDR catches the abuse of identity itself, which is how many intrusions now move from one account to control of the whole domain. It shortens the time an intruder has before encryption or data theft starts.
Questions to ask a vendor
- 1Which identity systems does it watch: on-premises Active Directory, Entra ID, Okta, others?
- 2Can it detect stolen session tokens, not just password attacks?
- 3Does it show attack paths to admin rights so we can close them before anyone uses them?
- 4Can it respond automatically, for example by revoking sessions or forcing re-authentication?
For your risk register
- Risk
- An intruder using valid credentials goes unnoticed until impact.
- Control
- ITDR on all identity providers, alerting to the security operations team.
- Owner
- Security operations lead.
- Measure
- Time to detect identity misuse in exercises.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Falcon Identity Protection
Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.
Huntress Managed ITDR
Managed detection of suspicious activity in Microsoft 365 and Entra ID.
Microsoft Defender for Identity
Detects attacks against on-premises Active Directory and hybrid identities.
Okta Identity Threat Protection
Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.
Vectra AI Platform
Detection of attacker behaviour across network, identity and cloud.
Recent stories it addresses
1347 stories in total- 13 Nov 2026ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen
ArcticRAT Android malware uses hidden VNC to remotely control phones while displaying a black screen to victims.
- 13 Nov 2026FBI Says US Seized $1.2 Billion Worth of Cryptocurrency Stolen From Binance
US Seizes $1.2B in Crypto Stolen from Binance; North Korea Blamed for Separate $400M Theft
- 12 Nov 2026New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
New SCKit malware targets MSPs via ScreenConnect attacks, exploiting a vulnerability to spread.
- 12 Nov 2026The School Bomb Threats Came From Accounts Already in Stolen Data
Bomb threats sent to European schools originated from accounts found in stolen data.
- 12 Nov 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials
Hackers used 4,800 compromised GitHub accounts in the 'wfx-loot' campaign to steal cloud credentials.
- 12 Nov 2026Hackers Abuse Microsoft SQL Servers to Deploy Monero Miner and Gh0st RAT
Hackers exploit weak SQL server passwords to deploy Monero miners and Gh0st RAT.
- 12 Nov 2026ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
ConnectWise investigates ScreenConnect breaches linked to RMM+ extension exploitation.
- 12 Nov 2026Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors
Chinese-speaking attackers weaponized Cairn AI framework to autonomously breach semiconductor, defense, and civil
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.