ITDR and IGA: Building Self-Healing Identity Security

Name: ITDR and IGA: Building Self-Healing Identity Security
Uploaded: 2026-10-20T18:08:04-04:00
Duration: 2 min 14 s
Description: Curious what an identity threat detection and response (ITDR) system does and why it matters? Rob Kraczek, global strategist at One Identity, breaks down its ability to catch anomalous activity and explains how ITDR and a strong identity governance and...

One Identity

10/20/2026

0 (0%)

Report Like Favorite

Transcript

I'm an Identity Security Specialist with One Identity. Today I'm going to talk to you about ITDR. ITDR is Identity Threat Detection and Response. What does that do? Think of it as a sniffer for your network for identities. It's a system from numerous vendors, and essentially it's a practice, that will allow you to detect the behavior of an identity in your environment. So what does that mean? So that means that as someone logs in, uses MFA, accesses systems, the ITDR system is actually looking at that risk posture and tracking what that identity is doing. Most major breaches that have occurred in the past decade have not occurred from a hack. They've occurred from an already logged in credential or a compromise credential. Well, how do people get those? It occurs through either social engineering, it occurs from step up authorization that's gone haywire, it's stepped up from stolen session tokens, or a privileged account that's already been compromised where they can come in through a backdoor. ITDR detects those things and they can report that behavior so you can take action on it. But here's the key. In order to take action on it, you need a strong identity security foundation. That's where products like IGA tools come in. IGA tools have been designed from the ground up to have static policies and entitlements defined for your identities. What does that mean? That means that you establish your best case business practices for those identities, you reduce the risk posture of those identities through least privileged models or zero trust, and then as that identity logs into your environment, they only get access to what they need. Here's the rub. There's always a back way to get into some system or another, and that's where ITDR comes into play. So what if you could combine those two? What if you could take your ITDR detection systems and have that information reported into your IGA tooling? That's the key to a strong self-healing identity security environment. So for more information, please go to the OneIdentity website or reach out to your local representative so you can see what we can offer in the ITDR space.

TL;DR

ITDR monitors identity behavior in real time — tracking logins, MFA events, and system access — to detect anomalous or compromised credential activity before damage occurs.
Most major breaches in the past decade stem from compromised credentials, not direct hacks, making identity-layer detection a critical security priority for any organization.
IGA tools establish least-privilege and zero trust policies that limit what authenticated identities can access, forming the enforcement layer that makes ITDR actionable and effective.

Summary

In this short explainer, Rob Krawczyk, Identity Security Specialist at One Identity, walks through the fundamentals of Identity Threat Detection and Response (ITDR) and explains why it must work in tandem with Identity Governance and Administration (IGA) tools to create what he calls a 'self-healing identity security' environment. ITDR functions as a behavioral sniffer for identities on your network — continuously monitoring login activity, MFA usage, and system access to assess risk posture in real time. Krawczyk highlights a critical and often overlooked reality: most major breaches over the past decade have not resulted from direct hacks, but from compromised or already-authenticated credentials obtained through social engineering, stolen session tokens, or backdoor access via privileged accounts. ITDR detects these anomalous behaviors and surfaces them for action. However, detection alone is insufficient — effective response requires a strong identity security foundation. That foundation is provided by IGA tools, which enforce static policies, least-privilege access models, and zero trust principles to ensure identities only access what they need. The combination of ITDR's real-time behavioral detection with IGA's structured entitlement governance closes both the front and back doors attackers exploit, creating a proactive, self-correcting identity security posture.

Chapters

0:00 - Introduction & Speaker
0:09 - What ITDR Does
0:42 - How Breaches Actually Happen
1:13 - IGA as the Enforcement Foundation
1:51 - Combining ITDR and IGA

Key Quotes

0:42 "Most major breaches that have occurred in the past decade have not occurred from a hack. They've occurred from an already logged in credential or a compromise credential."
1:13 "In order to take action on it, you need a strong identity security foundation."
1:59 "That's the key to a strong self-healing identity security environment."

FAQ

What is ITDR and how does it differ from traditional security monitoring?

ITDR (Identity Threat Detection and Response) focuses specifically on monitoring identity behavior — logins, MFA usage, and system access — to detect compromised or misused credentials. Unlike broader network monitoring tools, ITDR tracks the risk posture of individual identities in real time, catching threats that originate from legitimate-looking but compromised accounts.

Why do ITDR and IGA need to work together?

ITDR detects anomalous identity behavior but requires an enforcement layer to act on those findings. IGA tools provide that layer by defining and enforcing least-privilege access policies and zero trust principles. Together, they cover both the behavioral detection side and the policy enforcement side, closing the front and back doors attackers use to gain access.

Categories:

» Cybersecurity » Zero Trust
» Data Protection

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

10/27/2026

11:00 AM

10/27/2026

Maximize Security, Value, and Profit from Your Microsoft Investment

https://www.truthinit.com/index.php/channel/2178/maximize-security-value-and-profit-from-your-microsoft-investment/
10/27/2026

11:00 AM

10/27/2026

Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action

https://www.truthinit.com/index.php/channel/2182/see-it-stop-it-contain-it-lateral-movement-defense-in-action/
10/27/2026

01:00 PM

10/27/2026

The HUMAN Experience: Real-Time Insights into Page Intelligence

https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
10/28/2026

01:00 AM

10/28/2026

Ensuring AI Security Across the APAC Region

https://www.truthinit.com/index.php/channel/2125/ensuring-ai-security-across-the-apac-region/
10/28/2026

06:00 AM

10/28/2026

EMEA: Ensuring Comprehensive AI Security Across All Platforms

https://www.truthinit.com/index.php/channel/2127/emea-ensuring-comprehensive-ai-security-across-all-platforms/
10/28/2026

01:00 PM

10/28/2026

AMERICAS: Safeguarding AI Across All Fronts

https://www.truthinit.com/index.php/channel/2126/americas-safeguarding-ai-across-all-fronts/
10/28/2026

01:00 PM

10/28/2026

EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
11/04/2026

11:00 AM

11/04/2026

Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions

https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
11/05/2026

02:00 PM

11/05/2026

HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.

https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
11/05/2026

02:00 PM

11/05/2026

Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption

https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
11/10/2026

01:00 PM

11/10/2026

Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service

https://www.truthinit.com/index.php/channel/2191/zendesk-from-ai-readiness-to-results-a-framework-for-transforming-it-service/
11/12/2026

01:00 PM

11/12/2026

Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
11/19/2026

01:00 PM

11/19/2026

Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
11/19/2026

01:00 PM

11/19/2026

Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/