NEWJoin 2M+ software buyers|Get Weekly Insights, Trends & Expert PicksSubscribe free →

Spotsaas logo

List of the Best Identity Threat Detection and Response (ITDR) Software in 2026

Rajat Gupta
Researched and Edited by Rajat Gupta
Rajat Gupta

Researched and Edited by Rajat Gupta

Last updated: · How we review

Editor's Summary · Identity Threat Detection and Response (ITDR) Software

ITDR tools divide by which identity estate they watch. Semperis is the specialist for Active Directory and Entra ID, including recovery for the case where the directory itself is compromised — a scenario most tools here do not address. Silverfort and Oort focus on workforce identity, catching MFA bypass, account takeover and dormant privileged accounts across identity providers. Permiso and AuthMind take the newer angle, treating non-human and AI agent identities as first-class, which matters once agents hold credentials into production systems.

Veza and Saviynt sit adjacent: they are governance-first, mapping who can do what, which prevents excessive access rather than detecting its misuse. Buy them for different reasons.

This category was published recently and most listings do not carry verified reviews yet.

Quick picks for Identity Threat Detection and Response (ITDR) Software

  • Best for Active DirectorySemperis
  • Best for non-human and AI agent identityPermiso
  • Best for access visibilityVeza

Who gets the most from Identity Threat Detection and Response (ITDR) Software

  • 1Security operations teams investigating suspicious authentication activity
  • 2Identity architects reducing standing privilege across cloud and on-premises
  • 3CISOs accountable for AI agents authenticating into production systems
How to choose Identity Threat Detection and Response (ITDR) Software

If your crown jewel is Active Directory, filter for tools that cover AD attack paths and can recover the forest after compromise. If your risk has shifted to service accounts and AI agents holding credentials, prioritise non-human identity coverage with runtime attribution. If you mainly need to prove who can access what for audit, governance platforms will serve you better than detection tools.

Why you can trust Spotsaas

Our research is independent and data-backed. We review thousands of tools and use real buyer signals — without the hype.

Filters21 results

Reset

Sort by :

Recommended
Recommended
Score
Rating
Alphabetical

Features

+ Show 2 more

Share this page

Showing 1-20 out of 21

9.8

SpotScore

Okta - Identity and Access Management (IAM) Software

Okta

Securely connect and manage users with ease.

Best for: SMB teams · Mid-market · Enterprise

Start Free Trial

Add to compare

What is Okta?

Okta is a cloud based Identity and Access Management service that allows developers to manage users and connect applications securely. With Okta, developers can easily and securely add user authentication, authorization, SSO or single sign-on to their applications, all backed by a leading ...

Read more about Okta
Free TrialTry Free →·

Starts from $2/User/Month

8.8

SpotScore

One Identity - Identity and Access Management (IAM) Software

One Identity

Secure, streamlined IAM for all systems.

Best for: SMB teams · Mid-market · Enterprise

Start Free Trial

Add to compare

What is One Identity?

The One Identity IAM solution is a software platform for managing identity and access control across systems, from multiple footprints, utilizing a single policy across the enterprise. It includes: automation of user provisioning and de-provisioning, centralized self-service password reset, ...

Read more about One Identity
Free Trial·

One Identity offers custom pricing plan

Spotsaas Buyer Intelligence

See the companies researching Identity Threat Detection and Response (ITDR) software right now — while they're still comparing options.

In-market Identity Threat Detection and Response (ITDR) buyersCompany-level namesNo pixel to install

8.2

SpotScore

SailPoint IdentityIQ

SailPoint IdentityIQ

Secure your organization's identities with modern IAM solutions.

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

What is SailPoint IdentityIQ?

SailPoint IdentityIQ is an enterprise identity governance platform for dedicated IAM teams at mid-to-large organizations managing access across cloud and on-premises applications. It handles the full identity lifecycle — provisioning, access certification, and deprovisioning — with adaptive ...

Read more about SailPoint IdentityIQ

SailPoint IdentityIQ offers custom pricing plan

Spotsaas advisor
Get a free shortlist of the best Identity Threat Detection and Response (ITDR) Software
  • Shortlisted in minutes, not days
  • Matched to your business
  • Trusted by 2M+ software buyers every year

Step 1 of 4

How big is your team?

We tailor recommendations to companies your size.

Trusted by teams at

8.0

SpotScore

Silverfort - Identity and Access Management (IAM) Software

Silverfort

Secure your identity, simplify your access.

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

4.8

Add to compare

What is Silverfort?

SilverFort identity and access management (IAM) software is the result of years of research and development by top application security experts. By combining SilverFort's browser-based log in system, application authentication, and private user and groups management, organizations are able to ...

Read more about Silverfort

Silverfort offers custom pricing plan

8.0

SpotScore

CyberArk Conjur

CyberArk Conjur

Secure your critical applications with Conjur's unified IAM.

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

What is CyberArk Conjur?

Conjur is identity and access management (IAM) software that unifies policy management, privileged session management and privileged activity monitoring for the most critical applications – and all cloud-based applications. Conjur’s out-of-the-box integration with leading data center platforms ...

Read more about CyberArk Conjur

CyberArk Conjur offers custom pricing plan

8.0

SpotScore

SailPoint IdentityNow - Identity and Access Management (IAM) Software

SailPoint IdentityNow

Empowering secure and seamless access.

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

What is SailPoint IdentityNow?

IdentityNow provides IAM software to solve critical access and identity challenges. Information security has never been more complex, regulation has never been higher, and threats have never been greater. Security standards are requiring organizations to evaluate new tactics on how they manage ...

Read more about SailPoint IdentityNow

SailPoint IdentityNow offers custom pricing plan

What buyers evaluate in Identity Threat Detection and Response (ITDR) Software
Whether it covers on-premises Active Directory, cloud identity providers, or both
Whether non-human and AI agent identities are treated as first-class or an afterthought
Whether it detects misuse in real time or only reports posture and entitlements

7.2

SpotScore

Lumos - Identity and Access Management (IAM) Software

Lumos

Streamlining app access and enhancing security.

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

What is Lumos?

Lumos specializes in managing apps and identities for IT and security teams. The platform helps businesses streamline their access management process and become Compliant, Secure & Productive. This software offers a self-service platform to automate access requests, reviews, and license ...

Read more about Lumos

Lumos offers custom pricing plan

Permiso Security - Logo

Permiso Security

Identity threat detection across human, non-human and AI agent identities

Best for: Mid-market · Enterprise

Get Pricing Details

Add to compare

What is Permiso Security?

Permiso discovers and defends human, non-human and AI agent identities across cloud, SaaS and on-premises environments using a universal identity graph that links identities to their credentials and the actions taken with them. Discovery builds a full inventory, posture management surfaces ...

Read more about Permiso Security

Permiso Security offers custom pricing plan

AuthMind - Logo

AuthMind

Identity observability for AI agents, non-human and human identities

Best for: Mid-market · Enterprise

Get Pricing Details

Add to compare

What is AuthMind?

AuthMind observes what AI agents, non-human identities and human users actually do at runtime rather than what policy intends. It detects unknown and rogue AI agents including shadow agents the organisation did not deploy, maps each agent back to a human owner, and identifies unauthorised ...

Read more about AuthMind

AuthMind offers custom pricing plan

Semperis - Logo

Semperis

Active Directory and Entra ID threat detection and forest recovery

Best for: Mid-market · Enterprise

Get Pricing Details

Add to compare

What is Semperis?

Semperis protects identity infrastructure — Active Directory, Entra ID and Okta — against attack and restores it afterwards. Directory Services Protector handles threat prevention, detection and response for AD and Entra ID, while Active Directory Forest Recovery provides cyber-focused disaster ...

Read more about Semperis

Semperis offers custom pricing plan

Veza - Logo

Veza

Access graph showing who can take what action on what data

Best for: Mid-market · Enterprise

Get Pricing Details

Add to compare

What is Veza?

Veza maps identities, entitlements, permissions and resources into an access graph that answers who can access what data and what they can actually do with it — across people, machines, third parties, on-premises systems, cloud and SaaS. It automates access reviews and identity lifecycle ...

Read more about Veza

Veza offers custom pricing plan

Saviynt - Logo

Saviynt

Identity governance, privileged access and AI agent identity security

Best for: Mid-market · Enterprise

Get Pricing Details

Add to compare

What is Saviynt?

Saviynt is an identity governance and access management platform covering identity governance and administration, privileged access management, and application access governance for both human and non-human identities. It manages credentials, workloads and service accounts, provides ...

Read more about Saviynt

Saviynt offers custom pricing plan

Logo

Netwrix Usercube

Simplifying Identity Governance for Enhanced Security and Compliance

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

watch-demo

Watch Demo

What is Netwrix Usercube?

Netwrix Usercube is an advanced identity governance and administration (IGA) solution designed to address the security, compliance, and productivity challenges that arise during the employee lifecycle—whether it's joining, moving, or leaving an organization. By automating these critical ...

Read more about Netwrix Usercube

Netwrix Usercube offers custom pricing plan

Netwrix Auditor

Netwrix Auditor

Simplifying IT Governance and Compliance

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

watch-demo

Watch Demo

What is Netwrix Auditor?

Netwrix Auditor is a powerful visibility and control platform for hybrid IT environments. It empowers organizations to monitor changes, configurations, and access across systems while streamlining compliance efforts. Gain insights into who has access to what, how frequently changes occur, and ...

Read more about Netwrix Auditor

Netwrix Auditor offers custom pricing plan

Oort - Logo

Oort

Identity threat detection and response for workforce identity

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

What is Oort?

Oort is an identity threat detection and response platform that monitors workforce identity providers for attack patterns and weak identity hygiene. It builds an inventory of users and their authentication behaviour, detects account takeover attempts, MFA bypass, suspicious enrolment changes ...

Read more about Oort

Oort offers custom pricing plan

Obsidian Security

Obsidian Security

Empower your security with Obsidian.

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

What is Obsidian Security?

Obsidian Security is a SaaS security platform that connects to business applications via API—without deploying agents—to monitor for account compromise, insider threats, and misconfiguration. It ships with preloaded detection rulesets so security teams can identify suspicious activity from day ...

Read more about Obsidian Security

Obsidian Security offers custom pricing plan

CrowdStrike Falcon Endpoint Protection

CrowdStrike Falcon Endpoint Protection

Unleash the power of unbeatable endpoint protection.

Best for: SMB teams · Mid-market · Enterprise

Start Free Trial

4.7

Add to compare

watch-demo

Watch Demo

What is CrowdStrike Falcon Endpoint Protection?

CrowdStrike Falcon Endpoint Protection is a cloud-native security platform designed to help IT and security teams protect devices and data from modern cyber threats. Built for organizations of all sizes, including enterprises, government agencies, and regulated industries, Falcon delivers ...

Read more about CrowdStrike Falcon Endpoint Protection
Free TrialTry Free →·

Starts from $60/device when yearly

Vectra Cognito Platform - New SaaS Software

Vectra Cognito Platform

Powerful network security, simplified by AI.

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

What is Vectra Cognito Platform?

Vectra Cognito Platform is the simplest solution to provide comprehensive network security. By leveraging AI, it can automatically detect and respond to cyber-attacks spanning cloud, data center, IoT, and enterprise networks. This powerful software can efficiently collect, analyze, store and ...

Read more about Vectra Cognito Platform

Vectra Cognito Platform offers custom pricing plan

Britive - Privileged Access Management (PAM) Software

Britive

Secure your cloud, simplify your journey.

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

Add to compare

What is Britive?

Experience heightened cloud security with Britive – the ultimate cloud-native solution for modern enterprises. Our software helps manage privileged access to multi-cloud environments by allowing users to temporarily grant and revoke access privileges, ensuring effective protection of cloud ...

Read more about Britive

Britive offers custom pricing plan

BeyondTrust PRA - Privileged Access Management (PAM) Software

BeyondTrust PRA

Secure your privileged access with confidence.

Best for: SMB teams · Mid-market · Enterprise

Get Pricing Details

4.1

Add to compare

What is BeyondTrust PRA?

BeyondTrust Privileged Access Management (PAM) software is the only solution that enables user to automate privileged access management, detect insider threats, and provide visibility into who is using privileged credentials in the environment today. BeyondTrust PAM helps enterprises of all ...

Read more about BeyondTrust PRA

BeyondTrust PRA offers custom pricing plan

Used one of these identity threat detection and response (itdr) software tools? Your review helps the next buyer choose.

Write a Review

Learn More About Identity Threat Detection and Response (ITDR) Software

Compare 21 identity threat detection and response platforms that catch account takeover, MFA bypass and credential misuse across your identity estate.

Identity threat detection and response (ITDR) software watches identity infrastructure for attacks in progress — account takeover, MFA bypass, credential compromise, privilege escalation and rogue service accounts — rather than provisioning access in the first place. It complements identity and access management, which grants and reviews access, and privileged access management, which controls it.

Top picks:SemperisVeza
  • Whether it covers on-premises Active Directory, cloud identity providers, or both?
  • Whether non-human and AI agent identities are treated as first-class or an afterthought?
  • Whether it detects misuse in real time or only reports posture and entitlements?

What is identity threat detection and response software?

Identity threat detection and response (ITDR) software watches identity infrastructure for attacks in progress — account takeover, MFA bypass, credential compromise, privilege escalation and rogue service accounts — rather than provisioning access in the first place. It complements identity and access management, which grants and reviews access, and privileged access management, which controls it.

ITDR assumes credentials will eventually be stolen and focuses on detecting their misuse.

Identity Threat Detection and Response (ITDR) Software compared

Spotsaas lists 21 identity threat detection and response products. The entries below were researched from each vendor's own documentation; where a vendor publishes pricing openly it is shown.

#ProductSpotScoreRatingReviewsStarting price
1
SilverfortTop rated
84.8012
2
3
4
5
6
7
89.84.302,247Free trial
984.40380
108.24.4017

Ratings shown are from verified Spotsaas reviews where available.

What to check before you buy

Whether it covers on-premises Active Directory, cloud identity providers, or both

Essential questions to ask the vendor:

  • Whether it covers on-premises Active Directory, cloud identity providers, or both?

How to overcome it: If your crown jewel is Active Directory, filter for tools that cover AD attack paths and can recover the forest after compromise.

Whether non-human and AI agent identities are treated as first-class or an afterthought

Essential questions to ask the vendor:

  • Whether non-human and AI agent identities are treated as first-class or an afterthought?

How to overcome it: If your risk has shifted to service accounts and AI agents holding credentials, prioritise non-human identity coverage with runtime attribution.

Whether it detects misuse in real time or only reports posture and entitlements

Essential questions to ask the vendor:

  • Whether it detects misuse in real time or only reports posture and entitlements?

How to overcome it: If you mainly need to prove who can access what for audit, governance platforms will serve you better than detection tools.

Who uses Identity Threat Detection and Response (ITDR) Software

Typical roles include Security operations teams investigating suspicious authentication activity, Identity architects reducing standing privilege across cloud and on-premises, and CISOs accountable for AI agents authenticating into production systems.

Frequently asked questions

Basics FAQs

What is identity threat detection and response software?

Identity threat detection and response (ITDR) software watches identity infrastructure for attacks in progress — account takeover, MFA bypass, credential compromise, privilege escalation and rogue service accounts — rather than provisioning access in the first place. It complements identity and access management, which grants and reviews access, and privileged access management, which controls it.

Silverfort · Oort · Semperis

Choosing FAQs

How do I choose identity threat detection and response software?

If your crown jewel is Active Directory, filter for tools that cover AD attack paths and can recover the forest after compromise. If your risk has shifted to service accounts and AI agents holding credentials, prioritise non-human identity coverage with runtime attribution. If you mainly need to prove who can access what for audit, governance platforms will serve you better than detection tools.

Semperis · Veza

Buyers FAQs

Who uses identity threat detection and response software?

Typically security operations teams investigating suspicious authentication activity; identity architects reducing standing privilege across cloud and on-premises; cISOs accountable for AI agents authenticating into production systems.

Coverage FAQs

How many identity threat detection and response products does Spotsaas track?

Spotsaas currently lists 21 products in this category. Listings are researched from vendor documentation and updated as the market changes.

Ranking basis: Verified Spotsaas reviews and vendor-published data

Sources: Vendor product documentation and pricing pages, accessed 2026-07-29

loading...