Sophos ITDR expands identity protection for the AI era

Identity has become one of the most targeted attack surfaces in cybersecurity, with attackers increasingly relying on stolen credentials, compromised sessions, excessive privileges, and identity misconfigurations to gain access. At the same time, organizations are managing more cloud services, remote users, non-human identities, and a rapidly growing number of AI agents that can access systems and data.

According to the Sophos State of Identity Security Report 2026, 71% of organizations experienced an identity-related breach in the past year, with weak non-human identity management linked to 41% of these breaches.

The challenge is clear: it’s not just about managing identities, it’s understanding which identities introduce risk, how those risks evolve over time, and how to respond before attackers can take advantage.

Identity security is evolving. So is Sophos ITDR.

Sophos Identity Threat Detection and Response (ITDR) was introduced in 2025 as a powerful identity security add-on for Sophos XDR and Sophos MDR. Today, as organizations navigate this expanding identity attack surface, Sophos ITDR has evolved into a standalone solution and one of the fastest ways to experience Sophos Fusion, the Sophos AI-Native Cybersecurity Defense System.

What’s new in Sophos ITDR:

Together, these enhancements help organizations move beyond identity management. Sophos ITDR supports full identity security, from visibility and prioritization to investigation and response.

Secure identity from risk to response

With a complete view of human and non-human identities and more than 160 continuous posture assessments, organizations can clearly see their users, devices, applications, groups, service accounts, and Microsoft AI agent access, owners, and permissions, at a glance.

Sophos ITDR then prioritizes what matters most through new dynamic, AI-driven identity risk scores that continuously evaluate and explain the risk of every human and non-human identity using behavioral analytics, authentication history, geolocation data, and other signals. Security teams can quickly understand who presents the greatest risk and why.

When credentials are exposed, Sophos ITDR continuously monitors dark web and breach intelligence sources and finds affected identities (with advanced monitoring of VIP accounts) and enables immediate action. High-risk findings are automatically grouped into contextualized cases that bring together identities, detections, and other risk factors all in one place. From there, organizations can respond directly from within Sophos ITDR by forcing password resets, revoking active sessions, enforcing MFA, and disabling accounts before attackers can turn exposed identities into active compromises. 

Real results in minutes

With a 30-day free trial and seamless deployment, organizations typically begin uncovering meaningful identity risks within minutes. In recent Sophos ITDR trials, organizations identified hundreds of orphaned Azure accounts, credential exposures, and critical MFA gaps that had previously gone unnoticed.

Immediate real-world customer findings from Sophos ITDR free trials:

Part of Sophos Fusion

Sophos ITDR is the identity layer of Sophos Fusion, the Sophos AI-Native Cybersecurity Defense System. As part of Sophos Fusion, identity intelligence becomes part of a broader cyber defense strategy that connects detection, investigation, and response across endpoints, networks, cloud environments, email, and identity systems. Learn more at www.sophos.com/fusion. 

Get started today

Sophos ITDR supports both Microsoft Entra ID and on-premises Active Directory environments. To learn more, visit www.Sophos.com/ITDR or start a free 30-day trial to discover identity risks in minutes.