Picture the breach you're probably defending against: someone in a hoodie battering your firewall until something gives. Now picture the breach that actually happens: a login. Correct password, maybe even an MFA approval that a tired employee tapped on autopilot. No alarms, no malware, nothing "hacked" at all — just a stranger quietly reading invoices inside a mailbox for three weeks, learning who pays whom, and waiting for the right Friday afternoon to redirect a payment.
If your security plan is a firewall plus antivirus, you are guarding the doors while someone walks around with a copied key. That, in one sentence, is why identity threat detection and response — ITDR — has become the security conversation for small and mid-sized businesses.
Attackers stopped breaking in. They log in.
The numbers behind this shift are stark. Per CrowdStrike's 2026 Global Threat Report, 82% of the intrusions it detected were malware-free — up from 51% in 2019. Instead of dropping malicious files that security software can catch, attackers use valid accounts and legitimate admin tools, so their activity looks like a normal workday.
How do they get those accounts? Mostly, they buy or steal them. Verizon's 2025 Data Breach Investigations Report found stolen credentials were the most common way into a breached organization, involved in 22% of breaches — ahead of phishing and software exploits. Passwords leak through infostealer malware on home PCs, through reused logins from old breaches, and through convincing fake sign-in pages. The same DBIR found that 54% of ransomware victims had already had credentials exposed in infostealer logs before the attack. The break-in was pre-sold.
And once they're in, they move fast: CrowdStrike clocked the average "breakout time" — from first foothold to spreading laterally — at just 29 minutes — and the fastest it observed was 27 seconds. A quarterly security review doesn't catch that. Neither does a Monday-morning log check.
Why your current tools don't see it
Most SMB security stacks were built for a world with an inside and an outside. That world is gone, and each layer misses the identity attack for its own reason:
- Your firewall guards a perimeter your data no longer lives behind. Email, files, accounting, CRM — they're cloud services now, reachable from any browser on earth. There is no moat around a login page.
- Your endpoint protection (EDR) watches your devices for malicious behavior. An attacker signing into your cloud email from their own laptop never touches a device you monitor. Nothing to detect, because nothing ran.
- Your MFA is essential — and not the finish line. Attackers flood users with push prompts until one gets approved, proxy real login pages to steal live session tokens, and hunt for legacy protocols that skip MFA entirely.
Locks on the doors, cameras in the rooms — and nobody watching who's copying keys.
What ITDR actually is
ITDR is detection and response for the identity layer: your directory, your cloud identity provider, your single sign-on, your SaaS logins. Where EDR asks "is this device doing something malicious?", ITDR asks "is this account being used in a way this person never would?"
In practice, that means continuously watching for the tells of account takeover:
- Sign-ins that are impossible on a map — Newport Beach at 9:02, Eastern Europe at 9:40
- Bursts of MFA prompts, or MFA methods suddenly changed
- New mailbox rules that forward or silently delete messages
- A dormant account waking up, or an ordinary user suddenly gaining admin rights
- Third-party apps granted standing access to mail and files that no one remembers approving
The response half matters just as much: when something trips, someone — or something — must kill the session, revoke the tokens, disable the account, and force a reset in minutes. Detection without response is just a well-documented disaster.
