Sophos launches Identity Threat Detection for XDR platform

""Cloud and remote work have expanded the identity attack surface and created new opportunities for attackers," said Rob Harrison, SVP of Product Management at Sophos. Complex identity and access management systems with constantly changing settings and policies create gaps that attackers can exploit. The solution performs more than 80 cloud identity posture checks and uses AI-driven detections to identify identity-based attacks. These include kerberoasting, privilege escalation, account takeover, brute force, and lateral movement. Response playbooks within ITDR enable automated remediation actions such as account locks, password resets, and multi-factor authentication refresh."

"The new Sophos ITDR solution is the result of the acquisition of Secureworks and is the first product from that company to be fully integrated into the Sophos Central platform. It is designed to help Sophos users with comprehensive security operations. Sophos ITDR integrates seamlessly with existing XDR and MDR solutions and automatically generates cases when identity-based threats or high-risk findings arise. With MDR, Sophos security analysts then take over investigation and response actions from companies, accelerating remediation and reducing risk."

Sophos introduced Identity Threat Detection and Response (ITDR) integrated into XDR and MDR to address rising identity-based attacks and stolen credentials on the dark web. Between June 2024 and June 2025, Sophos observed a 106 percent increase in stolen login credentials offered for sale. The ITDR, born from the Secureworks acquisition and integrated into Sophos Central, auto-generates cases for identity threats and supports MDR analyst-led response. The solution runs over 80 cloud identity posture checks, applies AI-driven detections for attacks like kerberoasting and account takeover, and offers automated remediation playbooks and identity visibility features.

Read at Techzine Global