Improving Account Security with ITDR

The speaker, who works on identity products, argues that generic detection creates noise. Simple rules, such as flagging impossible travel from IP geolocation alone, can fire on VPN users or relay addresses, which leads to alert fatigue and missed signals. The talk makes the case for account-centric detection that builds context around each identity and accounts for the business setting, since staff, students and truck drivers each behave differently.

Identity threat detection and response (ITDR) platforms ingest application logs, enrich events with signals such as hosting provider, VPN status, breached email, obsolete user agents and phone number type, and combine them into risk scores. Real examples include impossible travel, a credential stuffing campaign with millions of attempts over two days that led to some account takeovers, and session tokens shared to reach the same application from other places. Complementary methods include browser device fingerprinting, honeypots and canary keys. Observations from millions of daily events, such as rising IPv6 traffic, bot-like user agents that turned out to come from iOS message previews, and homoglyph lookalike domains, show how easily rules can mislead.

The closing advice is to measure how quickly a tool detects each attack type, since a week of delay gives attackers ample room, and to confirm that it can scale. Tuning should reduce friction for legitimate users, with step-up authentication used sparingly and automated responses added once rules mature. Analysts should feed exceptions back into the system so they are not overwhelmed by individual events.