Detect identity threats
ITDR focuses on suspicious account activity that may indicate an identity has been compromised.
Identity threat detection and response
Help protect your business
Help protect your business
from account takeover.
If someone gets into a staff account, your business email and files may be at risk even while the laptop looks fine. Identity Threat Detection and Response (ITDR) helps detect and respond to threats targeting business accounts. Included in Maintain and Manage.
What is ITDR?
Account protection beyond the device.
A business account can be misused even when the computer itself is working normally. ITDR focuses on signs of identity misuse and the response needed when an account may be compromised. It complements device protection, email security and multi-factor authentication.
An example you can recognise
The email comes from a real staff account.
A customer receives an email from someone on your team asking them to use new bank details. The sender's name and address look right. But someone else has gained access to the account and is using that trusted identity.
The staff member's computer may still work normally. That is why device protection is only one part of the picture: account activity matters too.
Illustrative scenario, not a customer incident or a promise that every example is covered by every platform.
Is this relevant to your business?
Think about what someone could do with one staff login.
ITDR is worth discussing if your team relies on cloud email, shares client documents or handles instructions and approvals through business accounts. The question is what access an account gives someone, as well as how many people you employ.
- Could a compromised mailbox be used to send convincing payment requests?
- Could one login expose customer files or confidential conversations?
- Would your team know who to contact if an account started behaving unexpectedly?
You do not need to diagnose the technical problem before talking to us. Bring your concerns and tell us which systems your team uses.
What ITDR focuses on.
Understand the approach, then agree the coverage appropriate to your business.
Investigate the concern
Understanding the account activity helps establish what needs attention and informs the response.
Respond to account misuse
Detection and response work together to address identity threats. We confirm the coverage and controls appropriate to your environment during onboarding.
How the protection fits together
Different controls answer different questions.
Your devices, accounts and access settings all need attention. Each layer has a different job.
| Protection | The question it helps answer | Included in |
|---|---|---|
| Multi-factor authentication (MFA) | How do we make signing in harder for someone with a stolen password? | Protect, Maintain and Manage |
| Endpoint Detection and Response (EDR) | Is there a threat on a managed computer? | Protect, Maintain and Manage |
| Identity Threat Detection and Response (ITDR) | Is a business account showing signs of misuse that need a response? | Maintain and Manage |
| Identity Security Posture Management (ISPM) | Are identity settings or permissions creating weaknesses we should address? | Protect, Maintain and Manage |
These controls work together. Appropriate identity coverage is confirmed for your environment; some ISPM capabilities are specific to Microsoft 365.
Working with Stack2
Know what is covered and who to turn to.
Discuss the accounts your business relies on
Tell us about your email, file sharing and other business systems. We confirm the identity coverage and controls appropriate to your setup during onboarding.
Understand the monitoring and response arrangements
ITDR is included in Maintain and Manage. Our security monitoring runs 24/7 and acts on threats around the clock. General helpdesk support is Monday–Friday, 9am–5pm. During onboarding, discuss the response actions available for your accounts and how incident communications will be handled.
Have everyday IT help alongside security
Maintain and Manage include unlimited remote support during business hours, including new starters and leavers. Manage adds security posture reviews, improvement planning and a written incident response plan kept current.
Your managed IT plan
Included in Maintain and Manage.
Maintain is $149 per user per month, including GST, and adds ITDR to the Protect security foundation alongside unlimited remote support during business hours. Manage is $199 per user per month, including GST, and includes everything in Maintain plus security governance and planning.
ITDR works alongside your security foundation: endpoint detection and response, email security, MFA, managed admin access, a password manager, security awareness training and ISPM. Protect includes that foundation; ITDR starts with Maintain.
One computer per person. Month to month, no fixed term and no minimum team size — we ask for 90 days' notice to cancel. Additional projects and implementation work outside the plan are scoped and quoted before starting.
See plan inclusions and pricingBuild a broader security plan.
Understand ISPM
ISPM looks at identity settings and access to help identify weaknesses and plan improvements. ISPM is included in every plan; Maintain and Manage include both ITDR and ISPM.
Explore ISPMYour security foundation
Device protection, email security, MFA and backup monitoring form part of every managed IT plan.
Explore managed cyber securityPriorities guided by SMB1001
We recommend and follow SMB1001 to guide security improvements across people, processes and technology. Reviews and assessments do not provide certification.
Understand our SMB1001 approachYour ITDR questions, answered.
Is ITDR included in Protect?
No. ITDR is included in Maintain and Manage. Protect includes the managed security foundation, including endpoint detection and response, email security and MFA.
How does ITDR differ from endpoint protection?
Endpoint detection and response focuses on managed devices. ITDR focuses on threats targeting identities and business accounts. They work alongside each other.
Does ITDR replace MFA or staff training?
No. MFA, email security and staff awareness remain part of the security foundation. ITDR adds detection and response for identity threats.
Does this mean the helpdesk is open 24/7?
No. Security monitoring runs 24/7. General support is available Monday to Friday, 9am–5pm. Maintain and Manage include unlimited remote support during those business hours.
We already use MFA. Why would we need ITDR?
MFA makes unauthorised sign-ins harder. ITDR adds a different layer: detecting and responding to signs of identity misuse. MFA, device protection, email security and staff awareness remain part of the security foundation.
Does ITDR guarantee our accounts cannot be hacked?
No. ITDR helps detect and respond to identity threats; it does not guarantee every attack will be prevented or detected. Coverage depends on your environment and the controls available for your accounts.
Can you cover our Microsoft 365 or Google Workspace accounts?
Tell us which services and accounts your team uses. We confirm appropriate identity coverage and controls during onboarding. Do not assume every platform or account has the same detection and response capabilities.
What will you do if an account is compromised?
ITDR includes identity threat detection and response in Maintain and Manage. The response actions available depend on the connected systems and agreed controls. Discuss those actions and incident communication arrangements during onboarding. Work outside the plan is scoped and charges agreed before it starts.
Do we need additional licences or project work?
That depends on your existing setup and the controls required. We confirm requirements and any additional charges before paid work starts. A Microsoft 365 licence purchase by itself does not include ongoing Stack2 security management.