Here’s the uncomfortable thing about modern cyberattacks: the scariest ones don’t look like attacks at all. No smashed window, no alarm, no guy in a hoodie prying at the back door. Just a normal login, from a normal-looking account, at 2 a.m. on a Tuesday.
That’s the shift we keep trying to explain to folks. According to Verizon’s 2025 Data Breach Investigations Report, stolen credentials were the single most common way attackers got in—the initial access vector in 22% of breaches. Passwords, not malware, are the master key now. Identity is the attack surface.
So how do you defend a front door when the burglar has a valid key? That’s the whole idea behind ITDR—Identity Threat Detection and Response (yes, another acronym; we’ll gloss it once and move on). Think of your antivirus as the lock on the door and your firewall as the fence around the yard. ITDR is the neighbor who actually knows your habits—who notices that “you” just logged in from two countries at once and picks up the phone.
So what does that look like in real life?
We’ll tell you about a client—we’ll call her Dana—who runs a small accounting firm. One afternoon her Microsoft 365 account logged in from a data center halfway across the world, quietly set up a mailbox rule to hide replies, and started reading invoices. Dana never clicked a thing. Her password had simply leaked somewhere else. The attacker didn’t need to hack her—they just borrowed her.
The good news? The whole thing got caught and shut down before a single fake invoice went out. That’s the “response” half of ITDR doing its job: not just spotting the weirdness, but actually kicking the bad actor out.
What is Huntress Managed ITDR watching for?
Newmind partners with Huntress on this, so let us hand the mic over. Their Managed ITDR watches your Microsoft 365 and Google Workspace identities around the clock for the stuff attackers actually do:
- Credential theft—stolen or leaked usernames and passwords being used against you.
- Session hijacking—attackers grabbing your login “session token” (the digital wristband that keeps you logged in) so they can skip your MFA entirely. Yep, they can walk right past two-factor.
- Rogue apps—sketchy OAuth apps that quietly give an attacker a permanent backstage pass.
- Impossible travel & shadow inbox rules—the “you’re in two places at once” logins and the sneaky mail rules that hide an attacker’s tracks.
And here’s the part that matters for a busy SMB leader: it’s managed. A 24/7 SOC (security operations center) of real humans investigates the alerts, so you’re not the one squinting at logs at midnight.
Does it actually work?
Fair question—we’re allergic to hype too. A few numbers Huntress publishes: a 3-minute mean time to respond, a sub-5% false-positive rate, and 13M+ identities protected. In their own user surveys, 98% of customers said it sped up how fast they detect and respond to identity threats.
(One thing we’d love to nail down with a hard citation before publishing: the claim that AI is accelerating these identity attacks specifically. It’s true from what we’re seeing on the ground, but we should link a real datapoint here rather than wave our hands. [NEEDS SUBSTANTIATION—find a linkable stat on AI-driven credential/phishing attacks].)
We don’t mean to sound alarmist. There’s no such thing as a bulletproof computer, and anyone who tells you otherwise is selling something. But identity is where the fight has moved, and it’s very winnable with the right layer watching.
Not sure where your own defenses stand? We’re happy to lend an ear and take a look—get in touch and we’ll walk through it together. Until then, stay safe out there.