By the Seceon Identity Security Team · Published November 4, 2026 · Last updated November 4, 2026 · Reading time: 11 minutes
Quick answer: An identity threat detection platform finds attacks that abuse credentials and permissions rather than malware. The best ones, such as Seceon aiUIDGuard with aiITDR, first correlate every account a person or machine holds across Active Directory, Microsoft Entra ID (formerly Azure AD), Okta and AWS into one identity profile, then watch that unified profile for attacks. Without that correlation, an attacker moving between platforms under different usernames looks like several unrelated, legitimate users.
Attackers increasingly log in instead of breaking in. In its advisory on Volt Typhoon, CISA reported that the actors stole the Active Directory database (NTDS.dit) and tested access to OT systems using default vendor credentials (CISA AA24-038A). Machine accounts make the problem larger: ServiceNow says machine identities now outnumber human identities by more than 80 to one (SecurityBrief).
This guide explains how identity threat detection works, why identity correlation across platforms is the part most tools miss, and how Seceon aiUIDGuard delivers it for enterprise security teams.
| 60+ | 98%+ | < 2 min | < 90 sec |
|---|---|---|---|
| Identity platforms correlated | Correlation accuracy | Mean time to detect | Global containment |
Quick answer: Identity threat detection and response (ITDR) is a security discipline that monitors identity systems and authentication activity to detect attacks such as credential theft, privilege escalation and token abuse, then contains them by disabling accounts and revoking sessions. Seceon aiITDR applies this across every platform where an identity exists, not just one directory.
IAM and PAM tools decide who should have access. ITDR watches how that access is actually used and spots when it is being abused. That makes an identity security platform different from the tools around it:
| Tool | Main question it answers | Gap for identity attacks |
|---|---|---|
| IAM (Active Directory, Entra ID, Okta) | Who is allowed to sign in, and to what? | Grants access; does not judge whether a valid login is malicious |
| PAM | How are privileged credentials stored and brokered? | Covers privileged sessions only |
| UEBA | Is this user or device behaving abnormally? | Usually baselines each account separately |
| ITDR | Is an identity being attacked or abused right now? | Effective only if it can see every account the identity holds |
| Seceon aiUIDGuard + aiITDR | Who is this, across every platform, and is that identity under attack? | Correlates all accounts first, then detects and contains |
Quick answer: Identity threat detection must cover both people and machines. User identities include employees, contractors and guests. Non-human identities include service accounts, API keys, cloud roles, managed identities, container workloads, RPA bots and IoT devices. Seceon aiUIDGuard discovers both and links each service account to the human who owns it.
User and non-human identities fail in different ways. People reuse passwords and approve unexpected MFA prompts. Machines hold long-lived keys, rarely rotate secrets and often keep broad permissions nobody reviews.
| Identity type | Examples | Common abuse |
|---|---|---|
| Human | Employees, contractors, guests | Phishing, password spraying, MFA fatigue, session hijacking |
| Service accounts | AD service accounts, database logins | Kerberoasting, interactive logins, password never rotated |
| Cloud identities | AWS IAM roles and access keys, Azure managed identities | Leaked keys, role assumption for privilege escalation |
| Workload identities | Kubernetes service accounts, CI/CD tokens | Token theft from pipelines and containers |
| Automation and devices | RPA bots, IoT and OT device accounts | Default credentials, orphaned accounts |
Seceon aiUIDGuard tracks all of these and flags orphaned accounts within 24 hours.
Quick answer: Identity correlation links every account a person or machine holds into one profile, even when usernames differ. Seceon aiUIDGuard collects accounts from each platform, then matches them on email, employee ID, manager, department and naming patterns, enriched with HR data. The result is one identity graph that detection and response can act on.
Each identity system speaks its own language. Here is what a correlation engine has to read on the four platforms most enterprises run.
Active Directory remains the backbone of on-premises authentication, and the main target for credential attacks. Active Directory security depends on watching Kerberos ticket requests, replication activity, group policy changes and privileged group membership. Seceon aiITDR ingests full AD and LDAP audit logs and detects replication anomalies, such as DCSync from a host that is not a domain controller.
Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023; capabilities stayed the same (Microsoft Learn). Entra ID and Okta handle cloud single sign-on, so Azure AD and Okta security centers on sign-in risk: MFA push abuse, token reuse, unusual locations and new device registrations. Seceon collects these over SAML, OAuth 2.0 and OIDC, and aggregates failed sign-ins across Okta, Entra ID and AWS to expose distributed credential stuffing that each platform alone would miss.
In AWS, identities include IAM users, roles, access keys and managed identities for workloads. AWS identity security is about who assumes which role, from where, and with which key. Seceon aiUIDGuard discovers IAM users, roles and access keys, and links each one back to a human owner, so a role assumed by “smithj” is evaluated against John Smith’s full behavior, not in isolation.
Seceon aiUIDGuard discovers identity fragments from 60+ platforms without agents, typically within 5 minutes of first activity. Its patent-pending AI fuzzy matching correlates username variations such as jsmith, john.smith, smithj and smithj_svc at 98%+ accuracy. Results are stored in an identity graph with temporal tracking and a full audit trail, exportable to Neo4j and GraphQL.Â
| Platform | What aiUIDGuard collects | Typical identity fragment |
|---|---|---|
| Active Directory | Users, groups, service accounts, Kerberos and LDAP activity | jsmith, smithj_svc |
| Microsoft Entra ID | Users, managed identities, sign-ins, roles | john.smith@corp |
| Okta | Users, sessions, MFA events | john.smith |
| AWS IAM | Users, roles, access keys, role assumptions | smithj, AdminRole |
| SaaS and others | Salesforce, ServiceNow, GitHub, Slack, databases, VPNs, PAM | jsmith_sfdc |
| HR systems | Workday, SAP HCM, Oracle HCM: job, manager, employment status | Source of truth for joiners, movers and leavers |
Quick answer: Identity threat detection platforms detect directory attacks such as Kerberoasting, DCSync and Golden Ticket forgery; authentication attacks such as MFA fatigue, password spraying and session hijacking; and cloud identity abuse such as leaked AWS keys and role-based privilege escalation. Seceon aiITDR detects all of these and correlates them across platforms into one incident.
| Attack | MITRE ATT&CK | Where it happens | What Seceon aiITDR watches for |
|---|---|---|---|
| Kerberoasting | T1558.003 | Active Directory | Abnormal service-ticket requests for service accounts |
| AS-REP Roasting | T1558.004 | Active Directory | Requests for accounts without Kerberos pre-authentication |
| Golden and Silver Ticket | T1558.001, T1558.002 | Active Directory | Forged Kerberos TGT and TGS usage |
| DCSync | T1003.006 | Active Directory | Credential replication requests from systems that are not domain controllers |
| NTDS.dit theft | T1003.003 | Active Directory | Exfiltration of the AD credential database |
| Pass-the-Hash / Pass-the-Ticket | T1550.002, T1550.003 | AD and Windows hosts | NTLM hash relay and forged ticket reuse |
| MFA fatigue | T1621 | Entra ID, Okta | Repeated push notifications to the same user |
| Password spraying and credential stuffing | T1110.003, T1110.004 | Okta, Entra ID, AWS, SaaS | Failed logins aggregated across every platform, not one at a time |
| Session and token theft | T1550.001, T1539 | Entra ID, Okta, SaaS | Anomalous token use and session hijacking |
| Cloud account abuse | T1078.004 | AWS IAM, Entra ID | Leaked access keys, out-of-scope role assumption, unusual geography |
The most damaging identity attacks do not stay on one platform. These are the patterns per-platform tools cannot see and Seceon aiITDR detects through its unified profile:
Quick answer: Seceon aiUIDGuard is an AI-powered identity discovery and correlation engine. Together with Seceon aiITDR, it forms Seceon’s Unified Identity Intelligence (UII) platform inside the Open Threat Management (OTM) platform. It unifies human and non-human identities from 60+ platforms, detects identity attacks across all of them in under 2 minutes, and contains them in under 90 seconds.
Most identity tools start with detection on one platform. Seceon starts with correlation, because a detection engine can only judge behavior it can see as a whole.
aiUIDGuard and aiITDR run natively inside the Seceon OTM platform alongside aiSIEM, aiXDR, NDR and aiSOAR, so identity context enriches every security event without a separate SIEM or SOAR. Seceon cites time to value of under 24 hours. MSSPs can run it with multi-tier multi-tenancy, per-tenant correlation rules and white-label reporting.
| Specification | Seceon aiUIDGuard + aiITDR |
|---|---|
| Identity sources | 60+ (directories, cloud IAM, SaaS, PAM, VPN, databases, HR) |
| Correlation accuracy | 98%+ (AI fuzzy matching) |
| New fragment correlation | About 5 minutes |
| Baseline | Within 7 days |
| Mean time to detect | Under 2 minutes |
| Mean time to respond | Under 90 seconds |
| False positive rate | Under 2% |
| Scale | 500,000 profiles per tenant; 50,000 auth events per second |
Identity threat detection is the practice of monitoring identity systems and authentication activity to find attacks that abuse credentials and permissions, such as credential theft, privilege escalation and token abuse. Seceon aiITDR applies it across every platform where an identity exists, not just one directory.
IAM decides who is allowed to access which resources. ITDR watches how that access is actually used and detects when a valid identity is being abused. Seceon aiUIDGuard and aiITDR add correlation on top, linking every account an identity holds so abuse is visible across platforms.
Non-human identities are accounts used by software rather than people, including service accounts, API keys, cloud roles, managed identities, Kubernetes service accounts, RPA bots and IoT devices. Seceon aiUIDGuard discovers them and links each one to the human who owns it.
The same person often has different usernames in Active Directory, Entra ID, Okta, AWS and SaaS apps. Without correlation, an attacker moving between them looks like several unrelated users. Seceon aiUIDGuard correlates these accounts at 98%+ accuracy so attacks spanning platforms become visible.
It monitors Kerberos, LDAP and replication activity to detect attacks such as Kerberoasting, DCSync, Pass-the-Hash and Golden Ticket forgery. Seceon aiITDR ingests full AD audit logs and can block compromised credentials through AD and LDAP APIs in under 90 seconds.
Yes, if the platform correlates identities across them. Seceon aiUIDGuard collects from Microsoft Entra ID (formerly Azure AD), Okta and AWS IAM, among 60+ sources, and detects attacks such as an Active Directory user escalating to an AWS role and then to Entra Global Administrator.
With automated, cross-platform response, containment takes seconds. Seceon aiITDR suspends every fragment of a compromised identity and revokes OAuth, SAML, JWT and Kerberos tokens in under 90 seconds, with approval gates and rollback available.
Quick answer: Identity threat detection only works when it sees the whole identity. Seceon aiUIDGuard correlates every human and non-human account across Active Directory, Microsoft Entra ID, Okta, AWS and 60+ other platforms into one profile, and Seceon aiITDR detects and contains attacks against that profile in under 90 seconds.
Attackers do not respect platform boundaries. They phish an Okta user, reuse the password in Active Directory, assume an AWS role and grant themselves Entra administrator rights. Each step can look routine on its own platform. Correlation is what turns those routine-looking steps into one visible attack.
See aiUIDGuard map your identities across Active Directory, Entra ID, Okta and AWS. Request a demo at seceon.com.
