Catch Compromised Accounts
Detect attackers using stolen credentials before they can read sensitive emails, redirect payments, or steal data.
Technology Explained
Identity Threat Detection & Response (ITDR)
Your employees' Microsoft 365 accounts are now the most valuable target for attackers. If someone steals a password, they get access to email, files, Teams, and everything connected. ITDR watches for the telltale signs of compromised accounts - and stops attackers before they can do real damage.
What is it?
Identity Threat Detection and Response (ITDR) monitors your Microsoft 365 environment for signs that accounts have been compromised or are being attacked.
Modern attackers don't break in - they log in. Phishing emails steal passwords. Data breaches expose credentials. Social engineering tricks employees into giving access. Once inside, attackers sit quietly, reading emails, learning your business, then strike - redirecting payments, stealing sensitive data, or launching ransomware.
ITDR catches them by spotting behaviour that doesn't match the real user. Logging in from an unusual country? Accessing SharePoint for the first time in months? Creating email forwarding rules at 3am? These anomalies trigger investigation before attackers achieve their goals.
Our ITDR solution monitors Microsoft 365 (Exchange, SharePoint, Teams, OneDrive) for Business Email Compromise (BEC) - the attacks that cost businesses millions in fraudulent payments and data theft.
Business Benefits
Stop Invoice Fraud
Spot attackers setting up email rules to intercept payment conversations and redirect money to fraudulent accounts.
Protect Cloud Data
Monitor SharePoint and OneDrive for mass downloads and unusual access patterns that indicate data theft.
24/7 Expert Response
Security analysts investigate suspicious logins around the clock - not just alerts, but actual analysis and action.
Risks Without It
Business Email Compromise
BEC attacks cost UK businesses £166 million in 2023 alone. Attackers intercept invoices, change bank details, and vanish with payments.
Silent Account Takeover
Attackers sit in compromised inboxes for weeks, reading emails, learning your business, and waiting for the perfect moment to strike.
Data Exfiltration
Stolen credentials give access to SharePoint and OneDrive. Attackers download years of client data before you notice.
Reputational Damage
When attackers send phishing emails from your real accounts, your contacts get compromised - and blame you.
How Fresh Tech Implements This
Our ITDR solution connects directly to your Microsoft 365 tenant, monitoring sign-ins, email rules, file access, and administrative changes 24/7.
Suspicious Login Detection: Unusual locations, impossible travel (logging in from London then Moscow within an hour), and known-bad IP addresses trigger immediate investigation.
Inbox Rule Monitoring: Attackers create rules to forward emails or hide their tracks. Our platform spots these changes and alerts security analysts for investigation.
SharePoint/OneDrive Monitoring: Mass downloads, unusual file access patterns, and first-time access to sensitive folders are flagged and reviewed.
Automated Response: For clear-cut compromises, the system can automatically disable accounts and revoke sessions - stopping attackers in their tracks while you sleep.
This integrates with our broader Cyber Security services and works alongside Microsoft Business Premium security features.
Frequently Asked Questions
Common questions about identity threat detection & response (itdr)
We have two-factor authentication, aren't we protected?+
Two-factor auth reduces risk significantly, but attackers have adapted. Session hijacking, repeated login requests until you approve, and social engineering can all bypass it. Identity protection catches attackers who've gotten through your defences - it's your safety net when two-factor auth isn't enough.
What's the difference between ITDR and Microsoft's built-in security?+
Microsoft 365 generates alerts, but someone needs to investigate them. ITDR adds 24/7 human analysis - security analysts review every suspicious event and take action. You get expert response, not just raw alerts.
How quickly can you respond to a compromised account?+
The system can automatically disable compromised accounts within minutes of detection. For less clear-cut situations, analysts investigate and provide recommendations - typically within an hour, 24/7.
Will this affect our email performance?+
No. Identity protection reads activity logs in the background - it doesn't sit in the email flow. Your email delivery is completely unaffected.
Do we need this if we already have EDR on our computers?+
Yes - they protect different things. EDR watches your computers for malware and intruders. ITDR watches your cloud accounts for credential theft and account takeover. Both are important attack vectors.
More Technology Explained
Explore our other jargon-free technology guides
Ready to protect your business?
Let's talk about how we can implement these technologies for your organisation.
Signal for Help
Ready to banish tech headaches? Fill out the form or book a chat directly. We respond faster than a speeding bullet (usually under 15 minutes).
Trusted by local businesses for over 10 years
Thinking of switching providers? See how easy it is
- Call The Batphone01584 517 234
- Email HQhello@fresh-tech.uk
- Face-to-FaceBook an Intro Call with Sam
Send a message
Tell us what you need help with
Share the basics and we can start with the right context. Please do not include passwords or other sensitive information.
Thanks. Your message has been submitted.
If the matter is urgent during business hours, call 01584 517 234.