Sophos has introduced Identity Threat Detection and Response [ITDR], a new addition to its Sophos XDR and MDR platforms, aimed at tackling the surge in identity-based cyberattacks. Sophos ITDR continuously monitors customer environments for misconfigurations and compromised credentials both within networks and across the dark web helping organizations detect and respond swiftly to potential breaches.
The launch marks Sophos’ first fully integrated solution since its acquisition of Secureworks, broadening its security operations capabilities for more than 600,000 global customers. It comes as identity attacks escalate sharply: Sophos X-Ops reports a 106% rise in stolen credentials listed on the dark web between June 2024 and June 2025, while compromised accounts remained the top cause of incidents for the second consecutive year.
“Cloud adoption and remote work have expanded the identity attack surface,” said Rob Harrison, Sophos SVP for Product Management. “Complex access systems create gaps that attackers exploit. Sophos ITDR helps close those gaps through continuous monitoring, credential intelligence, and fast, analyst-led response.”
The system uses AI-driven detections to identify tactics such as privilege escalation, brute force, and lateral movement. It performs over 80 cloud identity checks and integrates with Sophos XDR and MDR to trigger automated remediation locking accounts, resetting passwords, or revoking sessions when threats arise.
Sophos ITDR’s key capabilities include identity visibility dashboards, dark web intelligence, user behavior analytics, and automated response playbooks. Early adopters in the financial services sector report greater visibility and faster remediation of identity risks.
As identity becomes the new frontline of cyber defense, Sophos’ latest solution underscores a growing industry focus on securing digital identities against the evolving tactics of credential-driven cybercrime.
Estimated reading time: 2 minutes
