ITDR for SaaS identities: identity threat detection and response
An attacker who signs in with a valid identity can look like a normal user. Cydenti ITDR looks for that abuse across Microsoft 365 / Entra ID, Google Workspace and Salesforce, for people and for non-human identities: service accounts, OAuth apps, API keys and tokens. Discovery is agentless and read-only. Data is hosted in Europe.
ITDR in two lines
ITDR stands for identity threat detection and response. It finds attacks that use identities, such as stolen credentials or abused privileges, and helps your team respond before the damage spreads. Read the full ITDR definition.
ITDR security for your SaaS estate
Cydenti combines behavioural baselines with detections aligned to MITRE ATT&CK. It looks at five areas:
- Behavioural anomalies: activity that breaks an identity's usual pattern.
- Credential misuse: suspicious use of passwords, API keys or OAuth tokens.
- Privilege escalation: role or permission changes that do not fit.
- Machine identity abuse: service accounts and OAuth apps acting outside their purpose.
- Risky authentication flows: unusual sign-ins, locations or consent grants.
Behavioral Anomalies
Detects deviations from normal access patterns across users, service accounts, and applications.
Credential Misuse
Identifies abnormal login activity, suspicious session behavior, and misuse of valid credentials.
Privilege Escalation
Flags attempts to gain higher privileges through role changes, permission abuse, or risky access paths.
Machine Identity Abuse
Monitors non-human identities for excessive access, unusual activity, and unauthorized usage.
Risky Authentication Flows
Detects insecure or abnormal authentication methods across SaaS and cloud environments.
How Cydenti ITDR works
Build identity context.
The Identity Graph maps which identities can reach which resources.
1Set behavioural baselines.
Cydenti learns normal activity for human and non-human identities.
2Detect anomalies.
Deviations from the baseline become findings.
3Prioritise by risk and blast radius.
The AI Risk Engine scores each finding and shows what the identity could reach.
4Recommend action.
Each finding comes with a next step. Where you enable it, fixes for excessive or unused rights run automatically, following the policies you set.
5
Examples of signals ITDR looks for
Coverage depends on the events each connected application exposes. These are examples, not a guaranteed list of detections.
- Microsoft 365 / Entra ID: a new secret or certificate added to a service principal; an admin role assigned outside normal change patterns; risky OAuth consent granted to a third-party app.
- Google Workspace: a third-party app granted broad OAuth scopes; super admin rights given to an unexpected account; a service account used from an unusual location.
- Salesforce: a connected app with new or wider permissions; unusual API activity from an integration user; a privileged permission set assigned to a dormant account.
ITDR vs SIEM, EDR and ISPM
| Tool | Main focus | Question it answers |
|---|---|---|
| SIEM | Collects and correlates logs | What happened across my systems? |
| EDR | Endpoints and devices | Is this machine compromised? |
| ISPM | Identity posture | Which identities are risky before an attack? |
| ITDR | Active identity abuse | Is someone misusing an identity right now? |
ISPM finds posture risk first. ITDR catches active abuse. See ISPM vs ITDR. Cydenti complements your SIEM, EDR, PAM and IGA tools. It does not replace them, and it is not a vault.
How to evaluate ITDR solutions
Use these six questions to compare ITDR security capabilities across identity threat detection and response solutions.
- Non-human identity coverage: does it watch service accounts, OAuth apps and API keys, not only users?
- SaaS depth: does it read identity signals inside the apps you actually use? Ask which objects and events each connector covers.
- Deployment model: is discovery agentless and read-only? Which permissions does it need?
- Context for prioritisation: does it show blast radius, or only a flat alert list?
- Response control: can you choose between recommendations and policy-driven automatic remediation?
- Data residency: where is identity data hosted, and under which provider?
Built in Europe
Cloud-agnostic, hosted in Europe: Hetzner Germany by default, OVHcloud or Scaleway on request. GDPR by design. Cydenti is a selected CYBIAH provider (programme coordinated by Campus Cyber with Hub France IA) and works with 10+ clients. Findings support NIS2, ReCyF, DORA and ISO 27001 reviews; Cydenti does not certify compliance.
Related: non-human identities · Silverfort vs Cydenti · Oasis Security vs Cydenti · Pricing
FAQ
What does ITDR stand for?
ITDR stands for identity threat detection and response. It covers detecting and responding to attacks that use identities, credentials and access. See the ITDR glossary entry.
How is ITDR different from a SIEM or EDR?
A SIEM centralises logs from many systems. An EDR watches endpoints. ITDR focuses on how identities and their permissions are used. Cydenti adds identity context and SaaS-level detections alongside your SIEM; it does not replace it.
Does Cydenti ITDR cover non-human identities?
Yes. Cydenti looks for threats involving service accounts, OAuth apps, API keys and tokens that are visible in Microsoft 365 / Entra ID, Google Workspace and Salesforce, alongside human users.
Which applications does Cydenti ITDR connect to?
Microsoft 365 / Entra ID, Google Workspace and Salesforce, through read-only APIs with no agent to install.
What happens after a detection?
Cydenti scores the finding by risk and blast radius and recommends an action. Where you enable it, fixes for excessive or unused rights run automatically, following the policies you set.
How do I start, and what does it cost?
Start with a free Audit Flash: up to 3 SaaS apps, read-only, no credit card, first inventory usually within a week. The Try & Buy POC, from EUR 490/month, includes ITDR with behavioural baselines, as listed on the pricing page.
See which identities an attacker could use.
Start my free Audit FlashRead-only. No credit card. First inventory usually within a week.
Connect threat detection and posture context
ITDR is stronger when buyers can trace detections back to the posture conditions that made them possible.