JOB J5 · THREAT DETECTION
Identity threat detection and response tools: who watches sign-ins and directories
Short answer
Five vendors document this job: Microsoft Entra, Okta, Push Security, Semperis and Silverfort. One more covers part of it. Which fits depends on where your risk sits: in on-premises Active Directory, in cloud sign-in sessions, or both.
What does this job include?
- Detecting credential attacks such as password spraying, credential stuffing, Pass-the-Hash and Kerberoasting.
- Watching session risk and token theft after sign-in.
- Monitoring directory changes and rolling back malicious ones.
- Responding: an MFA challenge, a block, ending a session, or logging a user out of every app.
- Sharing risk signals between tools, for example through the OpenID Shared Signals Framework.
Read the stack as a list
- J5 Identity threat detection and response: 5 documented, 1 partial
- J4 Privileged access: 2 documented, 7 partial
- J3 Application coverage and identity orchestration: 2 documented, 6 partial
- J2 Lifecycle and governance: 7 documented, 4 partial
- J1 Directory and single sign-on: 5 documented, 1 partial
Who documents this job?
Defender for Identity detects identity-based attacks across on-premises Active Directory, Entra ID and other IAM such as Okta; ID Protection and risk-based Conditional Access come with P2.
Source: Microsoft Learn: What is Microsoft Defender for Identity · Read 29 Sep 2026 · Source: Microsoft Entra pricing · Read 27 Sep 2026
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
Identity Threat Protection evaluates risk during sessions, offers Universal Logout and shares signals with CrowdStrike, Zscaler, Palo Alto Networks and Jamf.
Source: Okta Identity Threat Protection · Read 27 Sep 2026
Starter $6, Core Essentials $14, Essentials $17 per user per month, billed annually; Professional and Enterprise priced on request; $1,500 annual minimum; 30-day Starter trial. Identity Threat Protection is an add-on from Essentials up and included in Professional. Okta's pricing table marks Identity Governance (OIG) as included from Essentials ($17 per user per month) upward, and Okta's footnote describes OIG as an add-on.
Detects adversary-in-the-middle phishing and session hijacking in the browser, with MFA guardrails.
Source: Push Security homepage · Read 29 Sep 2026
Standard (up to 500 employees): $5 per user per month on an annual contract, or $6 per employee per month billed monthly, both billed in advance. Enterprise (500+ employees): volume pricing on request. Every licence includes the full platform; a trial is available.
Directory Services Protector watches hundreds of indicators of exposure and compromise across AD and Entra ID and can automatically roll back malicious changes; AD Forest Recovery, Disaster Recovery for Entra Tenant and Recovery for Okta cover recovery.
Source: Semperis: Active Directory security · Read 29 Sep 2026 · Source: Semperis homepage · Read 29 Sep 2026
Purple Knight assessment is free. Directory Services Protector is listed on Microsoft Marketplace with "Price varies" and no list price; no public price on semperis.com.
Detects brute force, password spraying, credential stuffing, Pass-the-Hash, Pass-the-Ticket, Kerberoasting and DCSync, and can block, challenge with MFA or terminate the session inline, before authentication completes.
Source: Silverfort: identity threat detection and response · Read 29 Sep 2026
No list price; Silverfort says pricing is based on the size of the organization. Four packages: Core (ISPM, Universal MFA), Plus (adds NHI Security and AI Agent Security), Advanced (adds Authentication Firewall and ITDR), Enterprise (adds Access Intelligence and Privileged Access Security with just-in-time access). Standard support included; Premier support 10% and Diamond 20% of licence cost.
Who covers part of it?
Lists incident response teams as a use case; it is not described as an identity threat detection product.
Source: Orchid Security homepage · Read 27 Sep 2026
No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer.
How do all 16 vendors read for this job?
| Vendor | J5Threat detection |
|---|---|
| Apono | Not in our sources |
| C1 (formerly ConductorOne) | Not in our sources |
| CyberArk (Idira, Palo Alto Networks) | Not in our sources |
| Google Cloud Identity | Not in our sources |
| JumpCloud | Not in our sources |
| Lumos | Not in our sources |
| Microsoft Entra | Documented |
| Okta | Documented |
| Orchid Security | Partial |
| Ping Identity | Not in our sources |
| Push Security | Documented |
| SailPoint | Not in our sources |
| Saviynt | Not in our sources |
| Semperis | Documented |
| Silverfort | Documented |
| Veza | Not in our sources |
On-premises directory or cloud session?
Semperis and Silverfort describe protection for Active Directory: Semperis watches hundreds of indicators of exposure and compromise in AD and Entra ID and can roll back changes, and Silverfort detects attacks such as Pass-the-Ticket and DCSync and responds before authentication completes. Okta Identity Threat Protection evaluates risk during cloud sessions and offers Universal Logout. Microsoft's Defender for Identity covers on-premises AD, Entra ID and other IAM such as Okta. Push Security watches the browser, detecting adversary-in-the-middle phishing and session hijacking where people sign in to SaaS.
Source: Semperis: Active Directory security · Read 29 Sep 2026 · Source: Silverfort: identity threat detection and response · Read 29 Sep 2026 · Source: Okta Identity Threat Protection · Read 27 Sep 2026 · Source: Microsoft Learn: What is Microsoft Defender for Identity · Read 29 Sep 2026 · Source: Push Security homepage · Read 29 Sep 2026
What changed in 2026?
NIST IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse, was published as final on 15 September 2026. Token theft is a reason sign-in alone is not enough: a stolen session token skips MFA. The OpenID Foundation's CAEP and RISC specifications, approved as Final on 2 September 2025, define events such as Session Revoked and Credential Change that tools can share to end sessions quickly. Okta lists Shared Signals with CrowdStrike, Zscaler, Palo Alto Networks and Jamf.
Source: NIST IR 8587: Protecting Tokens and Assertions · Read 27 Sep 2026 · Source: OpenID Foundation: Shared Signals Working Group · Read 27 Sep 2026 · Source: Okta Identity Threat Protection · Read 27 Sep 2026
Where does Orchid Security fit?
Orchid lists incident response teams as a use case and detects shadow authentication paths and privilege drift inside applications. That informs an investigation, but Orchid's pages do not describe it as a detection and response product, so it shows as Partial.
Source: Orchid Security homepage · Read 27 Sep 2026
Frequently asked questions
Is ITDR part of my identity provider?
Partly, depending on the plan. Okta sells Identity Threat Protection as an add-on from its Essentials suite and includes it in Professional. Microsoft includes ID Protection and risk-based Conditional Access with Entra ID P2, and Defender for Identity comes with Microsoft 365 E5 and the other E5 or F5 security plans or as a standalone licence.
What is the difference between Semperis and Silverfort?
Both cover Active Directory. Semperis focuses on directory changes, rollback and recovery of AD forests, Entra tenants and Okta. Silverfort focuses on authentication: it detects attacks during sign-in, responds inline and adds MFA to systems that cannot take it natively.
Do I need ITDR if I have no Active Directory?
The directory-focused tools matter less, but session and token attacks remain. Look at what your identity provider includes for session risk and logout before adding a separate product.
Read next