Why Your Business Needs ITDR

For years, the picture most people had of a hacker was someone “breaking in” – exploiting a firewall hole, slipping malware past the antivirus, that sort of thing. That still happens, but more and more the bad guys aren’t breaking in at all… they’re logging in. With your username. And your password. And sometimes even with your MFA.

Think about that for a second. Once an attacker is signed in as you, every security tool that’s looking for “bad stuff” sees… you. Your mailbox, your OneDrive, your Teams chats, your access to the accounting system – all of it is now theirs, and to your other defenses it looks like a normal Tuesday.

A while back I wrote about what happens when defenses fail, and how most security tools don’t tell you when they’ve been bypassed. Identity is where that problem shows up the most today, and it’s why I want to talk about something called ITDR.

So, what is ITDR?

ITDR stands for Identity Threat Detection and Response. In plain English, it’s a service that watches how your users’ accounts are being used – sign-ins, mailbox activity, permission changes, app consents – and raises the alarm (and ideally shuts things down) when something doesn’t look right.

The natural question is “don’t we already have that?” Most businesses have MFA, antivirus or EDR on their computers, and some kind of email filtering. All good things, and you should keep them. But look at what each one actually does. MFA is a lock on the front door. EDR watches the computer. Email security watches the inbox. NONE of them is really watching the account itself once someone is past the front door – and in a Microsoft 365 world, the account is where your business lives.

ITDR fills that gap. It’s the security camera inside the building, not another lock on the door.

Why it matters now

The numbers tell the story. Microsoft’s 2025 Digital Defense Report found that identity-based attacks jumped 32% in the first half of 2025, and more than 97% of those were password attacks – spraying common passwords and replaying ones stolen in earlier breaches. Meanwhile the FBI’s 2025 Internet Crime Report put business email compromise losses at roughly $3 billion for the year. That’s the classic scenario: someone gets into a mailbox, sits quietly, learns who pays whom, and then sends a very convincing “updated wiring instructions” email.

“But we have MFA!” Great – and Microsoft says modern MFA blocks over 99% of unauthorized access attempts. It’s the single best thing you can do. But that last 1% is where the professionals work. Phishing kits now sit in the middle between you and the real Microsoft login page, so you enter your password, approve your MFA prompt, and the attacker walks away with your session token. No password needed after that. Other attackers simply call a help desk, pretend to be you, and ask for a reset. MFA did its job in both cases – the attacker just went around it.

Here’s the scary part. When that happens, the signs are usually there. A sign-in from a country you’ve never visited. A new inbox rule that quietly moves anything with “invoice” in it to the RSS Feeds folder. A strange app granted access to read mail. The problem isn’t that the evidence doesn’t exist – it’s that nobody is looking at it. Attackers count on that, and the longer they go unnoticed, the more damage they do.

What good ITDR looks like

Not every product with “ITDR” on the box is created equal, so here’s what I’d look for.

First, it has to watch the right things. For most small businesses that means Microsoft 365 and Entra ID – sign-in locations and devices, impossible travel, inbox rules, mailbox forwarding, OAuth app consents, MFA method changes and new admin roles. Those are the fingerprints attackers leave behind.

Second – and this is the big one – it has to respond, not just detect. An alert that lands in an inbox at 2:00 AM on a Saturday isn’t protection, it’s a history lesson. Good ITDR can automatically disable the account, kill active sessions and revoke tokens the moment something clearly bad happens, and has real people reviewing the gray-area alerts around the clock.

Third, it should be sized for a small business. You shouldn’t need your own security operations center to get value out of it. The right solution is managed, priced per user, and quiet until it matters.

In summary

If there’s one takeaway here, it’s this: your users’ identities are now the front line, and attackers know it. MFA, endpoint protection and email filtering are still must-haves, but they’re built to keep people out – not to notice when someone has already gotten in. ITDR is how you catch the account takeover in minutes instead of finding out weeks later when a client calls asking why you changed your banking info.

Small businesses are not too small to be targeted. If anything, you’re a more attractive target, because attackers assume nobody is watching. At 1 Point Networks we help our clients put the right monitoring and response around their Microsoft 365 accounts without breaking the budget. If you’d like to talk about whether ITDR makes sense for your business, give us a call – the ounce of prevention is still worth hundreds of pounds of cure.