01 ·
ITDR ≠ IAM, it is complementary
IAM defines access rules; ITDR detects when access is compromised or abused and responds operationally. The missing link that closes identity defence.
ITDR: identity threat detection and response for AD, Entra ID and Okta. Identities are the new perimeter.
80% of incidents involve compromised identities. Fortgale governs identity security at 360°: from on-premise Active Directory to hybrid cloud environments such as Microsoft 365 and Google Workspace, with detection, response and continuous governance.
Fortgale · Identity Monitor
Live
Identities · monitor
14k
Alerts · 24h
23
Token theft
0
Privileged
2
TimeSevDetectionSrc
10:42P1DCSync attempt · domain adminL3
10:18P2AAD impossible travel · adminL2
09:55P3OAuth illicit consent grantL2
09:21P4Kerberoasting · low confidenceL1
Compliance · identity
NIS2 · Art. 21
DORA
ISO 27001 · A.9
GDPR
Native integrations
Defender for Identity
Sentinel
Entra ID
Okta
CrowdStrike
Why ITDR
IAM governs the rules. The ITDR service detects when they are violated.
Identity is today the number-one attack vector. IAM rules are not enough: real-time detection & response is required.
02 ·
Hybrid 360° coverage
On-premise AD + Microsoft Entra ID + Google Workspace + multi-cloud environments. Full visibility on synchronised hybrid identities. No blind spots between on-prem and cloud.
03 ·
UEBA + certified analysts
AI correlates millions of identity events with proprietary threat intelligence; European L2/L3 analysts validate every alert and act operationally. Drastic false-positive reduction.
Proof · the identity numbers
Four data points · why ITDR coverage is no longer optional.
80 %
Incidents
via compromised credentials
via compromised credentials
2h
Average time
phishing → domain controller
phishing → domain controller
74 %
Hybrid environments
AD + cloud
AD + cloud
+340 %
Cloud identity attacks
in the last 3 years
in the last 3 years
What ITDR · Fortgale is
Four coverage areas, one unified console.
From the Domain Controller to Entra ID, from cloud to post-compromise. One European outpost. The same techniques apply to the identities of AI agents and their OAuth tokens: we cover them in AI Security.
AD on-premise
Active Directory Security
Detection of Kerberoasting, Pass-the-Hash, DCSync, Golden Ticket, AS-REP Roasting, lateral movement, critical GPO changes and creation of unapproved admin accounts.
Cloud identity
Microsoft Entra ID · Azure AD
AiTM phishing, Token Theft, Service Principal abuse, Hybrid Identity attacks. Conditional Access monitoring, OAuth consent grant abuse, malicious app registrations.
UEBA
Behavioural analytics
Behavioural baseline on privileged users, insider threat detection, anomaly detection on access, impossible geo-velocity, off-hours logins, suspicious privilege escalation.
Identity IR
Identity Incident Response
Account isolation, token revocation, blast radius assessment, guided remediation. Forensics on anomalous logons, SecOps support for the identity-driven kill-chain.
Six technical capabilities
The pillars of identity detection.
01
Privilege Escalation Detection
Detection of unauthorised escalation: addition to Domain Admins, changes to sensitive groups, AD-CS abuse, ESC1-ESC8 patterns.
02
Credential Attack Coverage
Full detection: Kerberoasting, AS-REP, PtH, PtT, NTLM relay, OverPass-the-Hash, Mimikatz traces, LSASS dumping.
03
Cloud Identity Monitoring
Post-AiTM token theft, OAuth abuse, conditional access bypass, service principal abuse, illicit consent grant. M365, Azure AD, Google Workspace.
04
Lateral Movement Tracking
Identity-driven lateral movement tracking: Impacket usage, anomalous Kerberos tickets, anomalous logon patterns, NTLM hash usage.
05
Insider Threat Detection
UEBA for insider threat: data exfiltration patterns, access to resources outside the role, off-hours activity, dormant accounts reactivated.
06
Guided Remediation & Recovery
MITRE-mapped runbooks, account isolation, credential reset, token revocation, blast radius mapping, post-incident hardening.
Identity sources
Where we watch: AD, Entra ID, Okta, OAuth tokens.
Four identity planes, one incident. The detections below are the ones the SOC in Milan runs every day on these sources.
On-premise
Active Directory
Domain controllers, Kerberos and LDAP: Kerberoasting, AS-REP Roasting, pass-the-hash, pass-the-ticket, DCSync, Golden Ticket, AD CS abuse (ESC1 to ESC8), critical GPO changes, unapproved admin accounts, LDAP reconnaissance.
Cloud identity
Microsoft Entra ID
Sign-in and audit logs, Conditional Access, service principals: token theft after AiTM phishing, impossible travel, MFA fatigue, Conditional Access bypass, malicious app registrations, hybrid identity attacks on the synchronisation path.
Workforce IdP
Okta
System log and admin events: session hijacking, anomalous MFA enrolment, policy changes, privileged role assignment, impossible travel and sign-ins from infrastructure already attributed by our CTI.
Sessions
OAuth tokens and consent
Access and refresh tokens, OAuth applications: illicit consent grant, token replay from a new device, dormant app reactivation, excessive permissions granted to third party apps. Response: token revocation and app disablement.
By sector
By sector: the identities that matter most.
Same service, different priorities. Three cases we meet most often in European companies.
01 ·
Banks and financial institutions
UEBA on privileged accounts: operators of core banking, clearing and payment systems, service accounts of the trading platforms. Session and token evidence kept for DORA incident reporting and TLPT exercises.
02 ·
Pharma and life sciences
GxP identities and vendor access: accounts on validated systems, CRO and CDMO users federated into Entra ID or Okta, OAuth apps connected to the lab and regulatory platforms. Every access by a third party is a monitored identity, not an exception.
03 ·
Manufacturing with OT
Service accounts shared between IT and OT: the same credential used by the MES, the historian and the engineering workstations. ITDR follows those accounts across the two networks and flags their first use from an unexpected host, before lateral movement reaches the plant.
Two different jobs
Monitoring (ITDR) vs assessment (Identity Exposure).
They answer two different questions. One is continuous, the other is a snapshot.
ITDR · monitoring
Continuous monitoring and response, 24·7. ITDR watches Active Directory, Entra ID, Okta and OAuth tokens as events happen, detects the abuse of a valid identity (Kerberoasting, pass-the-hash, token theft, consent grant) and responds: account isolation, session revocation, credential reset. Question answered: is an identity being abused right now?
Identity Exposure · assessment
Assessment of the attack paths in Active Directory. Identity Exposure maps how an attacker could move from a low privilege account to Domain Admin: delegations, ACLs, group membership, stale admin accounts, Kerberos misconfigurations. It is a point in time review with a remediation list, not monitoring. Question answered: which paths exist today, and which to close first?
Integrated defence
Identity is the perimeter. The other services complete the coverage.
Pre-compromise
M365 Phishing Interceptor
Block AiTM phishing before credentials are entered. Free activation for M365 and Google.
Discover Interceptor →Detection & Response
Managed Detection & Response
EDR/XDR governed by the European SOC for endpoint, network and cloud. Triage in <15 min.
Discover MDR →Anticipation
Cyber Threat Intelligence
Proprietary feeds on actors targeting identities: Scattered Spider, APT29, FIN12, identity-based ransomware.
Discover CTI →FAQ
Everything to know before talking to the ITDR team.
What is the Fortgale ITDR service?
ITDR is the Identity Threat Detection & Response outpost: 360° security for identities across Active Directory, Entra ID, Google Workspace and multi-cloud. Includes 24·7 monitoring, UEBA, identity incident response and guided remediation.
Difference between ITDR and IAM?
IAM governs who has access to what (provisioning, roles, permissions). ITDR detects and responds when access is compromised or abused. They are complementary: IAM = rules, ITDR = real-time monitoring of violations.
Which Active Directory attacks do you detect?
Kerberoasting, AS-REP Roasting, Pass-the-Hash, Pass-the-Ticket, DCSync, Golden Ticket, Silver Ticket, privilege escalation, critical GPO changes, creation of unapproved admin accounts, LDAP reconnaissance. Contextual correlation to reduce false positives.
Does it support NIS2 and DORA?
Yes. Structured for NIS2 Art. 21 and DORA requirements on privileged identity management, IAM and incident response. Auditable reporting, event documentation, documented procedures.
How does it integrate with Defender for Identity and Sentinel?
Native integration with Microsoft Defender for Identity, Sentinel, Google Workspace Security Center, Okta, CrowdStrike, SentinelOne and the main enterprise SIEMs. Native connectors and APIs with no additional agents.
Does ITDR include AiTM phishing protection?
ITDR focuses on post-compromise detection and response. For preventive AiTM protection Fortgale offers the M365 Phishing Interceptor (complementary free service). The two services are synergistic.
How to select an MDR provider for identity threats in Europe
Check five things. Coverage: Active Directory, Entra ID, Okta and OAuth tokens in the same incident, not only the endpoint. Detections: Kerberoasting, pass-the-hash, DCSync, token theft and illicit consent grant, with a documented catalogue. Response authority: analysts who can disable an account and revoke sessions on your tenant, with measured times (Fortgale: detection <15 min, containment <30 min). Location: a SOC operating in European time zones and under European law, with evidence usable for NIS2 and DORA notifications. Integration: native connectors on the stack you already run, with no additional agents. Fortgale runs ITDR from its SOC in Milan, operating since 2017.
ITDR vs EDR: what is the difference?
EDR watches the endpoint: processes, files, memory. ITDR watches identities: Active Directory, Entra ID, Okta, sessions and tokens. An attacker who logs in with a stolen session or abuses Kerberos never runs malware on a device, so EDR alone sees a normal user. ITDR detects the abuse of a valid credential (Kerberoasting, pass-the-hash, DCSync, token theft, consent grant) and responds on the identity plane: account isolation, credential reset, session revocation. The two are complementary and, in Fortgale MDR, correlated in the same incident.
Proprietary research · the session is the new credential
The Kali365 PhaaS platform steals the OAuth session token after legitimate authentication (800 domains analysed). Classic MFA is not enough: post-authentication identity protection is required.
Read the analysis →Real case · MDR
An AiTM attack against senior executives during an investment round was intercepted before compromise. No access was gained.
Read the case →Why identity protection (ITDR) →
Start with ITDR
Enterprise identities are already in the crosshairs.
80% of incidents pass through compromised identities. The Fortgale ITDR service monitors, detects and responds 24·7 on every plane, from AD to cloud, before an identity becomes a critical incident.