Estimated reading time: 8 minutes
MDR vs ITDR isn’t really a fight, but it’s worth understanding the difference. For years, the security industry has measured itself by how fast it can respond to a fire. An alert fires. The SOC jumps in, investigates, contains it, and escalates it to the customer. Do that fast enough and it’s called a win. And it is a win. Cyflare does this today across every Managed Detection and Response customer we have: a 99% month-over-month true positive rate, and a mean time to disposition of 7 minutes over the last 30 days.
But here’s the question that doesn’t get asked enough: why was the attacker able to do something suspect in the first place?
Maybe the administrator never deployed the right MFA controls. Maybe a service account had privileges it never should have. Maybe legacy authentication protocols are still sitting open in the identity environment. Maybe there are standing permissions nobody’s reviewed in two, three, five years. No governance catches any of it before it becomes a problem.
Every SOC is great at putting out fires. Not many check the wiring that keeps starting them. That’s what identity threat detection and response, ITDR, is actually for.
Identity changed the rules
An attacker no longer needs malware. They don’t even need to find an exploit. They’ve stopped breaking in and started logging in.
The numbers back this up, and they’re not close. Roughly 99% of compromised Microsoft enterprise accounts had no MFA configured, a stat Microsoft has stood behind for years and one that hasn’t moved much, per Microsoft Learn. 88% of attacks against basic web applications involved stolen credentials, according to the 2025 Verizon Data Breach Investigations Report. Identity-based attacks rose 32% in just the first half of 2025, per Cisco Duo. And in Huntress’s 2025 Managed ITDR Report, 39% of organizations faced credential theft attacks in the past year, while 68% said they can’t detect identity threats until after an attacker already has persistence in the environment.
You don’t have to do exposure management anymore if you’re an attacker. You can go to the dark web, buy a credential, and log in as if you belong there. If someone has a valid username and a valid password in an identity environment that gives too much freedom, they look exactly like an employee. Traditional detection and response doesn’t see the problem until the identity has already done something suspicious. By then, you’re back to putting out the fire instead of fixing the wiring.
Why most MDR providers miss the mark
If your MDR provider can’t give you true root cause, they’re missing the mark. That’s not a knock on the industry. It’s just math. Detection and response tell you what happened. Root cause tells you why it was possible in the first place. A provider that only ever gives you the first one isn’t getting you ahead of anything. It’s just getting faster at reacting to the same problem, over and over.
That’s the real MDR vs ITDR distinction, and it’s the gap Cyflare built ITDR to close.
See how Cyflare ITDR closes the gap
What we built instead
We didn’t want another identity MDR alerting service. We wanted something that could tell you what’s wrong before there was ever an alert, and tie what we do see back to what we already know is broken.
Our service continually looks at your Microsoft identity environment and asks the same four questions, every day, without you having to ask them yourself:
What are the gaps? Which identities represent the greatest risk? Which security controls aren’t configured the way they should be? What should you actually be doing about it?
And when someone does try to exploit an identity, the SOC is already there. We’re bringing pre-attack posture management and in-attack detection and response together under one identity program, instead of running them as separate teams on separate timelines the way most providers do.
For partners, that changes the conversation you have with your customers. Instead of “here’s what we detected last quarter,” it becomes: here are the identity risks that existed in your environment, here’s what mattered most, here’s what we fixed, here’s what you chose to accept and we’re still watching for, and here’s what we’re focused on next. That’s a fundamentally more useful conversation, one you can actually bring to an executive review.
Walk through a real onboarding
How ITDR actually works
The risk score at the center of ITDR is built on 10 security checks (fewer if your Microsoft licensing doesn’t support all of them), and it’s deliberately binary. There’s no partial credit, no curve, no committee deciding what counts. If 18 of your 165 accounts don’t have MFA configured, you get that percentage back one of two ways: fix it, or formally accept the risk with a documented reason. Fix nine of the eighteen and leave one, and you still haven’t earned the points back. That’s by design. It’s why a score of 100 out of 100 is actually achievable, something that, in over 15 years in this industry, we haven’t seen anywhere else. Every check maps to an established framework: NIST, ISO, CIS. You can adjust the criticality of each one to match your own risk tolerance, because a healthcare environment and a manufacturing environment shouldn’t weigh the same control the same way.
The reports go deeper than the dashboard. They flag leaked credentials by checking your users against public breach data on an ongoing basis, not a stale one-time scan, so you’re only ever looking at new exposures instead of information you may have already acted on. They surface privileged access and app registration owners, because a single person holding API access for ten different applications is a single point of failure most environments never notice. They track license utilization, so you can see what you’re paying for and not using, or where you’re about to run out of seats. A new report tying misconfigured identities directly to real detections is coming by the end of this month: see the specific configuration gap, the actual escalations it caused in the last 30 days, and exactly what should drop once it’s fixed.
Onboarding takes minutes, not days or weeks. Submit the form, fill in the Microsoft Graph API details with the instructions built right into the integration, and Cyflare starts pulling telemetry immediately, checking posture twice a day from day one.
It’s already working
We launched ITDR to partners on September 1st. During the beta, some of our earliest customers connected their environment expecting to see a clean bill of health on the basics. Instead, they found that 50% of their users weren’t using MFA or were still on legacy authentication. Fixing it wasn’t technical or complicated. It was just something nobody had been watching for. That’s the point: catch foundational gaps before they escalate, not after.
Our goal, bluntly, is to put ourselves out of business from an MDR standpoint. If we’re escalating 100 tickets a month for you today because of a fixable identity gap, we want that number down to single digits, because we already know how to prevent it from happening again.
What’s next
The identity-specific detection trend view and the misconfiguration-to-escalation overlay are landing by the end of September. Support for Okta, Google Workspace, and Duo is on the roadmap, and we’ll communicate availability through our service link newsletter, SOC advisories, and your CSM check-ins. A new reporting engine is already in flight, with these ITDR reports available directly in platform before the end of the year. And we’re building a query interface (working name, subject to change) so you can dig into exactly what we’re seeing behind any escalation, without waiting on us to explain it.
Frequently Asked Questions
What is identity threat detection and response (ITDR)?
ITDR is a security discipline that continuously checks the configuration and posture of an identity environment, like Microsoft Entra ID and Microsoft 365, for gaps such as missing MFA, excess privileges, and legacy authentication, and pairs that posture data with real-time detection and response when an identity is actually being attacked. It closes the gap between “we detected something” and “we know why it was possible.”
MDR vs ITDR: what’s the difference?
MDR tells you what happened after an attacker acts. ITDR tells you why the attack was possible in the first place, and fixes the underlying gap, standing permissions, missing MFA, legacy protocols, before it turns into an alert. Cyflare’s ITDR runs both together: posture management and in-attack detection under one identity program instead of two disconnected motions.
Do I need ITDR if I already have MDR or a SIEM?
MDR and a SIEM are built to catch and respond to activity after it happens. Neither one checks whether your identity environment is configured correctly in the first place. ITDR is the layer that catches the fixable gaps, like unmonitored accounts without MFA, before they become the incident your MDR provider has to escalate.
What does an ITDR solution actually check?
A real ITDR program should score identity posture against an established framework (NIST, ISO, CIS), flag leaked credentials against ongoing breach data, surface privileged access and app registration ownership, and tie configuration gaps to the actual detections they caused. If a provider can’t show you root cause, it’s an alerting tool, not ITDR.
How fast can ITDR be deployed?
Cyflare’s ITDR onboards in two stages: Cyflare provisions the tenant, and you (or your MSP partner) complete a single Microsoft Graph API integration in Entra. Posture checks start twice a day from day one, and monitoring begins the moment telemetry is live, no waiting period.
Is ITDR the same as identity and access management (IAM)?
No. IAM governs who gets access to what. ITDR continuously watches whether that access is configured safely and whether it’s being misused, catching drift, misconfiguration, and active identity attacks that IAM policy alone won’t surface.
The bottom line
Your provider can probably tell you when someone walked through the front door. The real question is whether they can tell you the door was left unlocked in the first place. If they can’t, they’re missing the mark. Cyflare built ITDR to close that gap, and it’s live today.
