Best Identity Threat Detection and Response (ITDR) Software - Page 3

Push Security

Push Security is on a mission to defend organizations where work and attacks actually happen: in the browser. Built by red and blue team experts, Push gives defenders visibility, control, and response power in a layer that’s historically been overlooked, but increasingly targeted. Push is the most advanced security tool in the browser. It brings real-time detection and response to the layer where users work — and where attackers operate. By deploying a powerful agent inside the browser, Push gives defenders full visibility into user activity, attacker behavior, and browser-level risk. It detects threats like phishing kits and session hijacking, enforces protective controls like MFA and SSO, and provides the telemetry security teams need to investigate fast. Push works in any modern browser, deploys in minutes, and integrates easily with the rest of your stack — making it accessible to teams of any size.

Average Rating: 4.8/5.0

Total Reviews: 9

SentinelOne Singularity Identity Detection & Response

Singularity Identity is an identity threat detection and response (ITDR) solution that protects on-premises and cloud-hosted Active Directory domain controllers and domain-joined endpoints in real time. A component of the Singularity Platform, Singularity Identity detects active attacks against all device types and OSes, and safeguards against unauthorized privilege escalation and lateral movement.

Average Rating: 5.0/5.0

Total Reviews: 2

Silverfort

Silverfort’s Unified Identity Protection Platform is the first to consolidate security controls across corporate networks and cloud environments to block identity-based attacks. Using innovative agentless and proxyless technology, Silverfort seamlessly integrates with all existing IAM solutions (e.g., AD, RADIUS, Azure AD, Okta, Ping, AWS IAM), extending coverage to assets that could not previously have been protected, such as legacy applications, IT infrastructure, file systems, command-line tools, and machine-to-machine access. Our platform continuously monitors all access of users and service accounts across both cloud and on-premise environments, analyzes risk in real time, and enforces adaptive authentication and access policies.

Average Rating: 4.8/5.0

Total Reviews: 18

Tracebit Community Edition

Tracebit Community Edition makes canary credentials available to everyone, free forever. Deploy decoy credentials on your devices and in your development workflows. When attackers use them, Tracebit alerts you with the context you need to investigate. Canary types include AWS credentials, SSH keys, browser session cookies, website passwords, and emails. Deploy your first canary in under 60 seconds using the Tracebit Community CLI or issue canaries programmatically through the Tracebit API. A GitHub Action also lets you place canary credentials in CI/CD workflows to detect supply-chain attacks. The Community CLI supports Windows, macOS, and Linux and keeps deployed credentials up to date. View and monitor your canaries in the Community Edition dashboard and receive email alerts when they are triggered. Get started at https://community.tracebit.com/join.

Average Rating: 5.0/5.0

Total Reviews: 2

Forestall ISPM

Forestall is an agentless Identity Security Posture Management (ISPM) and Identity Visibility and Intelligence Platform (IVIP). It helps security, IAM, and IT teams discover identity exposures, map privilege escalation and attack paths, and reduce identity risk across on-prem and cloud: Active Directory, Microsoft Entra ID, Microsoft 365, AWS, Azure, and Google Cloud. Coverage spans human identities, service accounts, non-human identities (NHI), and AI agent identities. Deployment is read-only and takes about an hour, with no admin privileges and no endpoint agents. Teams get prioritized, fix-first remediation guidance and audit-ready compliance reporting aligned to ISO 27001, NIST, CIS, STIG, PCI DSS, SAMA, NCA ECC, and UAE IAR.

Average Rating: 5.0/5.0

Total Reviews: 1

Gurucul

Gurucul is the only cost-optimized security analytics company founded in data science that delivers radical clarity about cyber risk. Our REVEAL security analytics platform analyzes enterprise data at scale using machine learning and artificial intelligence. Instead of useless alerts, you get real-time, actionable information about true threats and their associated risk. The platform is open, flexible and cloud native. It conforms to your business requirements so you don't have to compromise. Our technology has earned us recognition from leading industry analysts as the most Visionary platform and an Overall leader in product, market and innovation. Our solutions are used by Global 1000 enterprises and government agencies to minimize their cybersecurity risk. To learn more, visit Gurucul.com

Average Rating: 3.0/5.0

Total Reviews: 2

Resmo

All in one platform for SaaS app and access management for modern IT teams. Streamline app discovery, user offboarding, access reviews, and cost tracking.

Average Rating: 5.0/5.0

Total Reviews: 9

The Illusive Platform

lllusive continuously discovers and automatically remediates privileged identity risks that are exploited in all ransomware and other cyberattacks. Despite best-practice investments to protect identities, including deployment of PAM and MFA, 1 in 6 enterprise endpoints holds exploitable identity risks. Illusive makes it easy for security teams to get visibility into the vulnerable identities sprawled across an organization’s endpoints and servers, then eliminate them or deploy deception-based detection techniques as a compensating control to stop attackers. Illusive has participated in over 140 red team exercises and has never lost one! Founded by nation state attackers, Illusive’s technology is trusted by large global financials, retailers, services organizations, and pharmaceuticals.

Average Rating: 4.0/5.0

Total Reviews: 1

AD-Phoenix

AD-Phoenix© redefines enterprise identity resilience by delivering an automated, end-to-end Active Directory (AD) Forest recovery. Designed specifically for IT administrators and infrastructure engineers, this platform streamlines Bare Metal Recovery (BMR) of Domain Controllers. It automates multi-domain Forest recovery and enforces rigorous threat containment across both on-premises hypervisors (Microsoft Hyper-V, VMware ESXi), physical hardware (HPE iLO and DELL iDRAC) and Microsoft Azure. Whether executing an on-premises recovery, a hybrid lift-and-shift, or a cloud restoration into an isolated virtual network, AD-Phoenix© minimizes your Recovery Time Objective (RTO) while ensuring clean database recovery and a fully converged replication topology.

Akamai Account Protector

Akamai Account Protector is a comprehensive security solution designed to safeguard user accounts from abuse throughout their entire lifecycle. By leveraging machine learning and a rich dataset of risk and trust indicators, it accurately assesses the legitimacy of user requests, effectively preventing account takeovers and identity theft. Key Features and Functionality: - Lifecycle Protection: Evaluates user risk at every stage, from account creation to post-login activities such as account updates, password changes, and payments. - Advanced Detection Mechanisms: Utilizes machine learning to detect anomalies in user behavior, identifying potential threats based on profiles and risk signals. - Real-Time Risk Scoring: Assigns risk scores to user requests, enabling immediate and appropriate responses to potential threats. - Adaptive Response Actions: Implements customized actions such as blocking, alerting, or allowing requests based on the assessed risk score. - Continuous Learning: Incorporates legitimate user behavior into its profiling to enhance future assessments and reduce false positives. Primary Value and User Benefits: Akamai Account Protector addresses the critical need for robust account security by: - Preventing Financial Losses: Mitigates the financial impact associated with fraudulent activities and account takeovers. - Maintaining Customer Trust: Ensures a secure user experience, preserving the integrity and reputation of businesses. - Enhancing Operational Efficiency: Reduces the burden on security teams by automating threat detection and response processes. - Adapting to Evolving Threats: Continuously updates its detection capabilities to counter sophisticated adversarial bot attacks and other emerging threats. By integrating Akamai Account Protector, organizations can effectively defend against account abuse, ensuring the safety of user accounts and the overall security of their digital platforms.

Attivo Networks Identity Threat Detection and Response

Attackers are targeting credentials, privileges and the systems that manage them. Identity Threat Detection and Response solutions are designed to detect and derail identity-based attacks.

AuthMind

The AuthMind Agentic AI Identity Observability & Protection Platform secures agentic AI, non-human, and human identities by observing real access paths across every environment. By combining identity and system events with network, cloud, and application/service logs, AuthMind maps all known and unknown AI agents, NHIs, and human identities, exposing blind spots, eliminating shadow access, and unifying identity risk, combining identity posture management (ISPM) with real-time advanced identity threat detection (ITDR).

Authomize

Authomize protects organizations from identity-based cyberattacks with the first Identity Threat Detection and Response (ITDR) Platform. Authomize collects and normalizes data of identities, access privileges, assets, and activities from cloud services, applications, and IAM solutions in order to detect, investigate and respond to identity risks and threats. Customers use Authomize to gain visibility of actual access, achieve least privilege across cloud services and applications, secure their IAM infrastructure, and automate compliance and audit preparations.

Average Rating: 4.5/5.0

Total Reviews: 1

BloodHound Enterprise

The problem of Attack Path Management requires a fundamentally different, unique methodology designed to help organizations understand, empirically quantify impact, and eliminate identity-based Attack Path risks.

Cayosoft Guardian Protector

Guardian Protector is a free, always-on threat detection and change monitoring solution for Active Directory, Entra ID, M365, and Intune. It provides continuous, real-time visibility across hybrid identity environments, instantly alerting teams to risky changes like privilege escalation, dormant account activation, and GPO tampering. Agentless, audit-ready, and deployed in minutes. Real-time threat detection – Catch identity-layer risks as they occur: privilege escalations, dormant account reactivation, GPO tampering, dangerous policy edits, and more. Automatic Alerts – Instantly flags changes detected across hybrid environments. Provides who, what, when, and where context for faster triage. Harden Identity Posture – Identify and remediate existing misconfigurations and attack pathways that can lead to tenant or domain compromise. Hybrid change monitoring – One stream of truth across AD + Entra ID and key Microsoft 365 services for complete context. Continuous visibility—not snapshots – Ditch static point-in-time scans. Guardian Protector watches continuously, so you don’t miss what happens after the report is made. Agentless deployment – Nothing to install on domain controllers or endpoints. Get value fast, keep overhead low. Zero-cost, zero-hassle – Our free forever tier is designed for security-conscious IT pros who need coverage now. Audit-ready – Centralized logs and built-in reporting to satisfy auditors and streamline investigations.