In short: ThreatDown ITDR (Identity Threat Detection and Response) detects attacks on user and machine identities across Active Directory, Microsoft Entra ID and Okta, including credential abuse, token hijacking, privilege escalation and leaked credentials, and responds by suspending accounts, revoking sessions and tokens or forcing MFA resets. Through Forever Systems it is licensed per user, monthly.
What ThreatDown ITDR is
Many attackers log in rather than break in. A stolen password, a hijacked session token or an over-privileged service account gives them access that looks legitimate to endpoint tools. Identity threat detection and response (ITDR) watches your identity systems for that misuse and acts on it.
ThreatDown ITDR covers Active Directory, Microsoft Entra ID and Okta, and looks at both human users and non-human identities such as service accounts, API tokens and OAuth credentials. It discovers service accounts and tokens through your identity provider connections, learns their normal behaviour and can flag one that is misbehaving even when the credential itself is valid. It also watches dark web sources for leaked credentials tied to your organisation.
What is included
| Capability | What it does |
|---|---|
| Credential abuse detection | Spots sign-ins and activity that suggest a stolen or misused credential |
| Token hijacking detection | Identifies stolen or replayed session and API tokens |
| Privilege escalation and lateral movement | Flags accounts gaining rights or moving across systems in unusual ways |
| Service account monitoring | Detects compromised or misbehaving non-human identities |
| Attack path discovery | Maps high-risk attack and lateral-movement paths, with prioritised hardening steps |
| Identity risk score | One organisation-wide score with trends and the riskiest users, covering alerts, dark web exposure and MFA gaps |
| Leaked credential monitoring | Watches dark web sources for your users' credentials |
| Endpoint correlation | Enriches identity alerts with related endpoint activity from the ThreatDown agent |
| Response actions | Suspend accounts, revoke sessions and API tokens, disable service accounts and force MFA resets, automatically or with one click |
| 24/7 coverage | With ThreatDown MDR, analysts can monitor and respond to identity threats around the clock |
ITDR complements multi-factor authentication rather than replacing it: MFA makes stealing access harder, ITDR catches the cases where it happens anyway.
How it is licensed
| Item | How it works |
|---|---|
| Unit | Each user identity covered; we confirm how service accounts are counted for your directory when we quote |
| Term | Monthly, billed on usage from our OneView console |
| Bought direct | Included in ThreatDown's Ultimate bundle and an add-on to Advanced and Elite |
| Works with | Your ThreatDown endpoint modules and MDR, in the same console |
Prices depend on user numbers and whether you add MDR, so ask us for a quote.
Requirements and deployment
ITDR connects to your identity providers rather than to individual devices, through an agentless integration set up from the ThreatDown console. You need administrator access to grant the connection to Microsoft Entra ID or Okta, and we agree the Active Directory connection with you during scoping.
A typical rollout:
- Connect your identity sources and let ITDR learn normal behaviour.
- Review initial findings, which often include stale accounts, over-privileged service accounts and leaked credentials.
- Agree which responses run automatically, such as session revocation, and which need a person.
- Route alerts to our team, or to ThreatDown MDR for 24/7 response.
Before you start, it is worth checking that MFA is enforced for all users and administrators; see Cisco Duo MFA if you need a stronger MFA layer.
Who it suits
ITDR suits organisations running Microsoft 365 or Okta whose biggest risk is account takeover: finance teams targeted by invoice fraud, firms with many remote users, and anyone with service accounts nobody has reviewed in years. It is especially valuable alongside MDR, because identity attacks often unfold outside office hours.
Compare other identity, MFA and privileged access products, or read about Microsoft 365 security on our Cloud Security site.
How we help
We connect your directories, triage the first findings with you, clean up risky accounts and set response rules. From then on, identity alerts come to our team alongside your endpoint alerts, and everything sits on one Forever Systems invoice. Contact us for a quote or an identity risk review.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does ThreatDown ITDR protect?
User and machine identities in Active Directory, Microsoft Entra ID and Okta, including service accounts, API tokens and OAuth credentials.
What can ThreatDown ITDR do when it detects an attack?
It can suspend accounts, revoke sessions and API tokens, disable service accounts and force MFA resets, automatically or with one click.
Do I still need MFA if I have ITDR?
Yes. MFA makes credential theft harder; ITDR detects and stops misuse when an attacker gets through anyway.
Is ITDR monitored 24/7?
It can be. ThreatDown offers 24/7 expert-led identity protection through its MDR service, so analysts monitor and respond to identity threats around the clock.