Identity Threat Detection & Response
Detect & Respond to SaaS Threats
The Ultimate SaaS Security Posture Management Checklist: 2024 Edition
GET THE CHECKLISTThe Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities
Learn moreThe SSPM Justification Kit
GET THE KITAdaptive Shield’s SSPM & ITDR Platform Features and Capabilities
DownloadThe Ultimate SaaS Security Posture Management Checklist: 2024 Edition
GET THE CHECKLISTThe Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities
Learn moreThe SSPM Justification Kit
GET THE KITAdaptive Shield’s SSPM & ITDR Platform Features and Capabilities
DownloadDetect & Respond to SaaS Threats
Identity Threat Detection & Response (ITDR) forms an additional layer of protection for SaaS applications. It detects unauthorized access and behavioral anomalies that could lead to account takeover attacks from human and non-human identities.
Adaptive Shield’s threat detection engine cross-references and analyzes suspicious events from multiple sources in context, enabling the accurate detection of sophisticated and subtle threats from across the SaaS stack. It identifies indicators of compromise (IOC) and monitors user behavior (UEBA) to detect forensic signs of a potential breach at the earliest stages of the infiltration.
Adaptive Shield uses a rich set of data from across the entire SaaS stack to detect threats. A user logging into Salesforce and Microsoft 365 at the same time from two distinct geographies might seem innocent when looked at independently. However, when viewed in context it paints a different picture.
This level of data and analysis is impossible to achieve without deep visibility and understanding of SaaS applications and user behavior. As the only SaaS Security company that integrates with 150+ applications to cover all attack surfaces, Adaptive Shield enables the accurate detection of sophisticated and subtle threats.
From insider threats to brash break-ins, Adaptive Shield’s Monitor and Threat Center reviews every event and triggers alerts when SaaS applications are under threat.
Adaptive Shield sets an activity baseline based on each user’s typical behavior. When users act anomalously, such as changing configurations, downloading data to an unusual ASN, or conducting irregular searches for sensitive data, Adaptive Shield flags it as an IOC or threat.
Adaptive Shield monitors the IP address, ASN, VPN, and location where users log in from. When the login comes from a suspicious source, or if a user logs into different applications from multiple locations, the threat center looks for additional IOCs that could indicate the user identity has been compromised.
When users log on with an outdated version of their OS, a different type of computer, or other atypical hardware and software, it indicates a potential account compromise. The presence of multiple IOCs indicates that the user’s account may have been breached.
The Ultimate SaaS Security Checklist 2025 Edition
Identity Threat Detection & Response: Solution Brief
Identity Threat Detection and Response (ITDR) – Rips in Your Identity Fabric