Identity threat detection and response explained

What do attackers do with identities?

They guess or spray passwords, replay stolen session tokens and, inside Windows networks, abuse Kerberos and directory replication. Silverfort lists brute force, password spraying, credential stuffing, Pass-the-Hash, Pass-the-Ticket, Kerberoasting and DCSync among the attacks it detects.

Where can detection watch?

1. At authentication: Silverfort describes responding inline, before the authentication completes, with a block, an MFA challenge or a terminated session.
2. During the session: Okta Identity Threat Protection evaluates risk throughout user sessions and can sign a user out of every app with Universal Logout. Microsoft includes ID Protection and risk-based Conditional Access with Entra ID P2.
3. In the directory: Semperis Directory Services Protector watches hundreds of indicators of exposure and compromise in Active Directory and Entra ID and can roll back malicious changes. Microsoft Defender for Identity uses sensors on identity infrastructure and covers on-premises AD, Entra ID and other IAM such as Okta.
4. In the browser: Push Security describes detecting adversary-in-the-middle phishing and session hijacking from a browser extension.

What comes after detection?

Detection without response is a report. Responses range from an MFA challenge to ending every session. Recovery is the step after that: Semperis offers AD Forest Recovery, Disaster Recovery for Entra Tenant and Recovery for Okta.

How do tools share signals?

Tools can tell each other when something changes. The OpenID Foundation's Shared Signals work defines CAEP and RISC events such as Session Revoked and Credential Change; CAEP and RISC were approved as Final on 2 September 2025. Okta lists Shared Signals with CrowdStrike, Zscaler, Palo Alto Networks and Jamf.

Why are tokens the 2026 theme?

NIST IR 8587, on protecting tokens and assertions from forgery, theft and misuse, was published as final on 15 September 2026. A stolen token skips the sign-in, so detection during the session matters more than it did when MFA at sign-in was the main control.

Is there a free first step?

Semperis offers Purple Knight free. It assesses Active Directory, Entra ID and Okta against 218+ indicators and produces a report card with remediation guidance. See the threat detection job page for every vendor that documents this job.