[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:identity-threat-detection":3},{"control":4,"products":25,"stories":74,"lessons":118,"related":143,"compare":164},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.","Monitoring of identity systems such as Active Directory, Entra ID and Okta for signs of misuse: impossible travel, stolen session tokens, privilege escalation and attack paths to admin rights.","An attacker with valid credentials looks like an employee to most tools. ITDR catches the abuse of identity itself, which is how many intrusions now move from one account to control of the whole domain. It shortens the time an intruder has before encryption or data theft starts.",[11,12,13,14],"Which identity systems does it watch: on-premises Active Directory, Entra ID, Okta, others?","Can it detect stolen session tokens, not just password attacks?","Does it show attack paths to admin rights so we can close them before anyone uses them?","Can it respond automatically, for example by revoking sessions or forcing re-authentication?","Risk: an intruder using valid credentials goes unnoticed until impact. Control: ITDR on all identity providers, alerting to the security operations team. Owner: security operations lead. Measure: time to detect identity misuse in exercises.",[17,18,19,20],"NIS2 Art. 21(2)(b): incident handling","DORA Art. 10: detection of anomalous activities","CIS Control 8: audit log management","ISO\u002FIEC 27001:2022 A.8.16: monitoring activities",{"name":22,"slug":23},"Access Control","access-control","2026-10-16T12:48:02.187069+00:00",[26,34,42,50,58,66],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"total":75,"last_days":76,"recent":77},1358,564,[78,83,88,93,98,103,108,113],{"slug":79,"title":80,"published_at":81,"brief":82},"sckit-abuses-screenconnect-to-deploy-remote-access-and-target-technician-session-36ece2","SCKit abuses ScreenConnect to deploy remote access and target technician sessions","2026-11-13T21:31:44+00:00","SCKit malware abuses ScreenConnect to gain unauthorized remote access and target IT technicians.",{"slug":84,"title":85,"published_at":86,"brief":87},"university-of-texas-at-arlington-warns-personal-information-stolen-during-cybera-ff3fa2","University of Texas at Arlington warns personal information stolen during cyberattack","2026-11-13T17:26:00+00:00","University of Texas at Arlington confirms personal information stolen in cyberattack claimed by Qilin ransomware.",{"slug":89,"title":90,"published_at":91,"brief":92},"hackers-use-2-700-passwords-to-break-into-microsoft-sql-servers-and-deploy-remot-8fab91","Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware","2026-11-13T14:54:56+00:00","Hackers exploit weak passwords to compromise Microsoft SQL Servers, deploying malware for crypto mining and remote",{"slug":94,"title":95,"published_at":96,"brief":97},"apify-confirms-customer-data-accessed-in-cyberattack-854397","Apify Confirms Customer Data Accessed in Cyberattack","2026-11-13T12:41:01+00:00","Apify confirms customer data accessed in cyberattack via compromised credentials.",{"slug":99,"title":100,"published_at":101,"brief":102},"silentair-hackers-intercept-calls-sms-from-inside-mobile-networks-76848e","SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks","2026-11-13T12:20:28+00:00","SilentAir hackers exploit mobile network nodes to intercept calls and SMS, targeting Taiwan.",{"slug":104,"title":105,"published_at":106,"brief":107},"hackers-use-deepseek-and-glm-ai-agents-to-breach-10-organizations-in-autonomous-1e7126","Hackers Use DeepSeek and GLM AI Agents to Breach 10 Organizations in Autonomous Cyberattacks","2026-11-13T11:56:24+00:00","Hackers used AI agents powered by DeepSeek and GLM to breach 10 organizations autonomously.",{"slug":109,"title":110,"published_at":111,"brief":112},"when-an-ai-agent-goes-wrong-can-you-stop-it-ed1f4b","When an AI Agent Goes Wrong, Can You Stop It?","2026-11-13T11:52:31+00:00","OWASP GenAI Security Project warns AI agents can exceed intended scope; proper containment requires pausing workflows,",{"slug":114,"title":115,"published_at":116,"brief":117},"silentair-hijacks-asian-telecom-networks-to-intercept-sms-2fa-codes-and-spy-on-t-7f22b6","SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users","2026-11-13T11:10:40+00:00","SilentAir spies on Taiwanese users by hijacking Asian telecom networks to intercept SMS 2FA codes.",[119,123,127,131,135,139],{"slug":120,"title":121,"published_at":122},"sckit-worm-hijacks-screenconnect-sessions-to-compromise-it-technician-workstations","SCKit Worm Hijacks ScreenConnect Sessions to Compromise IT Technician Workstations","2026-11-13T22:20:58.16+00:00",{"slug":124,"title":125,"published_at":126},"qilin-ransomware-steals-personal-data-from-university-of-texas-at-arlington","Qilin Ransomware Steals Personal Data from University of Texas at Arlington","2026-11-13T18:20:39.241+00:00",{"slug":128,"title":129,"published_at":130},"weak-sql-server-passwords-enable-brute-force-takeover-and-malware-deployment","Weak SQL Server Passwords Enable Brute-Force Takeover and Malware Deployment","2026-11-13T15:20:23.452+00:00",{"slug":132,"title":133,"published_at":134},"state-actors-exploit-telecom-protocols-to-intercept-calls-and-sms-at-network-level","State Actors Exploit Telecom Protocols to Intercept Calls and SMS at Network Level","2026-11-13T13:22:35.957+00:00",{"slug":136,"title":137,"published_at":138},"stolen-credential-exposes-apify-customer-data-highlighting-mfa-and-secrets-management-gaps","Stolen Credential Exposes Apify Customer Data, Highlighting MFA and Secrets Management Gaps","2026-11-13T13:20:22.45+00:00",{"slug":140,"title":141,"published_at":142},"ai-agent-containment-requires-more-than-pulling-the-plug","AI Agent Containment Requires More Than Pulling the Plug","2026-11-13T12:20:44.927+00:00",[144,148,152,156,160],{"slug":145,"name":146,"problem":147},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":149,"name":150,"problem":151},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":153,"name":154,"problem":155},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":157,"name":158,"problem":159},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",{"slug":161,"name":162,"problem":163},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"microsoft\u002Fdefender-for-identity":165,"okta\u002Fidentity-threat-protection":183,"crowdstrike\u002Ffalcon-identity-protection":200,"huntress\u002Fmanaged-itdr":217,"vectra-ai\u002Fvectra-ai-platform":231,"acalvio\u002Fshadowplex-identity-protection":243},{"hq_country":166,"also_provides":167,"reviews":168,"affected":181,"reported":182},"US",[],[169,172,175,178],{"label":170,"url":171},"AV-TEST: business results for Microsoft Defender","https:\u002F\u002Fwww.av-test.org\u002Fen\u002Fantivirus\u002Fbusiness-windows-client\u002Fmanufacturer\u002Fmicrosoft\u002F",{"label":173,"url":174},"ITPro: Microsoft Defender for Business review (2024)","https:\u002F\u002Fwww.itpro.com\u002Fcloud\u002Fcloud-security\u002Fmicrosoft-defender-for-business-review-feature-filled-enterprise-security-for-small-businesses",{"label":176,"url":177},"PeerSpot: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fmicrosoft-defender-for-endpoint-reviews",{"label":179,"url":180},"Gartner Peer Insights: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fmicrosoft-defender-for-endpoint",311,128,{"hq_country":166,"also_provides":184,"reviews":185,"affected":198,"reported":199},[],[186,189,192,195],{"label":187,"url":188},"TechRadar: Okta review (2023)","https:\u002F\u002Fwww.techradar.com\u002Freviews\u002Fokta-review",{"label":190,"url":191},"PeerSpot: Okta Platform user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fokta-platform-reviews",{"label":193,"url":194},"Gartner Peer Insights: Okta Workforce Identity user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fokta-workforce-identity",{"label":196,"url":197},"CSO Online: Okta bets on identity to control AI agents, but is identity enough? (2026)","https:\u002F\u002Fwww.csoonline.com\u002Farticle\u002F4225230\u002Fokta-bets-on-identity-to-control-ai-agents-but-is-identity-alone-enough.html",5,2,{"hq_country":166,"also_provides":201,"reviews":202,"affected":215,"reported":216},[],[203,206,209,212],{"label":204,"url":205},"SE Labs enterprise endpoint test Apr-Jun 2026: CrowdStrike Falcon","https:\u002F\u002Fselabs.uk\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fsecurity-evaluation-test-report-enterprise-crowdstrike-falcon-2026-07-factsheet.pdf",{"label":207,"url":208},"AV-Comparatives EPR test 2025: CrowdStrike Falcon Enterprise","https:\u002F\u002Fwww.av-comparatives.org\u002Fwp-content\u002Fuploads\u002F2025\u002F09\u002FEPR_CrowdStrike_2025.pdf",{"label":210,"url":211},"Gartner Peer Insights: CrowdStrike Falcon user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcrowdstrike-falcon",{"label":213,"url":214},"PeerSpot: CrowdStrike Falcon user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fcrowdstrike-falcon-reviews",4,23,{"hq_country":166,"also_provides":218,"reviews":219,"affected":229,"reported":230},[],[220,223,226],{"label":221,"url":222},"Gartner Peer Insights: Huntress Managed EDR user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fhuntress-managed-edr",{"label":224,"url":225},"PeerSpot: Huntress Managed EDR user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fhuntress-managed-edr-reviews",{"label":227,"url":228},"The Register: Huntress's attacker surveillance splits infosec community (2025)","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2025\u002F09\u002F12\u002Fhuntresss-attacker-surveillance-splits-infosec-community\u002F865218",0,72,{"hq_country":166,"also_provides":232,"reviews":236,"affected":229,"reported":229},[233],{"slug":234,"name":235},"network-detection-response","Network detection and response (NDR)",[237,240],{"label":238,"url":239},"Gartner Peer Insights: Vectra AI Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fvectra-ai-platform",{"label":241,"url":242},"PeerSpot: Vectra AI user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fvectra-ai-reviews",{"hq_country":166,"also_provides":244,"reviews":248,"affected":229,"reported":229},[245],{"slug":246,"name":247},"deception","Deception and honeypots",[249],{"label":250,"url":251},"Gartner Peer Insights: ShadowPlex Advanced Threat Defense user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fshadowplex-advanced-threat-defense"]