Sophos ITDR: Major enhancements and new ways to sell

Identity attacks continue to rise, with 71% of organizations suffering at least one identity breach in the past year¹, but many teams still struggle to understand which identities are at risk, why they're at risk, and where they should focus first.

That's why we're excited to share several significant enhancements to Sophos Identity Threat Detection and Response (ITDR), making it easier than ever to position identity security with customers and introduce them to the power of Sophos Fusion.

An easy conversation starter

Sophos ITDR is now available as a standalone solution, no longer requiring Sophos XDR or Sophos MDR as a pre-requisite, but remaining natively integrated with both to extend identity visibility into broader detection and response workflows. Customers can get started with Sophos ITDR in minutes via a free 30-day trial and easy deployment to uncover security gaps, credential exposure, and identity risks across their Microsoft Entra ID and on-premises Active Directory environments.

This immediate time-to-value not only makes for an easy identity security conversation, but also an ideal first step into Sophos Fusion.

Identity security is evolving. So is Sophos ITDR.

Sophos now ITDR delivers:

• More than 160 continuous identity posture checks that surface risky privileges, authentication weaknesses, and identity attack paths, maintaining 100% coverage of MITRE ATT&CK Credential Access Techniques.
• Full visibility into users, devices, applications, groups, service accounts, and Microsoft AI agent access, owners, and permissions.
• AI-driven, dynamic identity risk scores that continuously evaluate every identity and clearly explain what's risky and why.
• Expanded support for Microsoft on-premises Active Directory, alongside Microsoft Entra ID.
• Direct response capabilities like password resets and session revocations.
• Seamless case management, where high-risk findings are automatically grouped into contextualized cases.
• Native integration with Sophos XDR and Sophos MDR, bringing identity intelligence into broader investigation and response workflows.

Identity results in minutes

These examples highlight real customer outcomes from recent Sophos ITDR trials. Organizations quickly uncovered identity risks, credential exposures, policy gaps, and authentication weaknesses that weren't visible before, helping them take action and reduce risk:

A natural expansion opportunity

Sophos ITDR creates opportunities across acquisition, expansion, and retention motions.

• Open identity security conversations with organizations that are not yet Sophos customers.
• Expand existing Sophos deployments with a high-value identity security capability.
• Create a natural path into Sophos XDR or Sophos MDR over time, all part of Sophos Fusion.

Customers gain immediate value from identity security, while partners gain a differentiated way to introduce broader Sophos security operations solutions.

Getting started

Sophos ITDR is available today as a standalone solution or as a natural expansion of Sophos XDR and Sophos MDR, with quoting based on number of users. Visit the Partner Portal (login required) for updated sales training, solution briefs, competitive materials, and the latest customer-facing assets. Reach out to your Sophos representative for support on demos.

¹Sophos State of Identity Security Report, 2026