Understanding Identity Threat Detection and Response

The report covers a large 2024 credential-driven breach in which attackers used credentials harvested by infostealer malware (and purchased on the dark web) to access and exfiltrate data from at least 165 organizations' Snowflake instances. It frames identity as the new perimeter, explains common identity-based threats and the MITRE ATT&CK relevance of valid-account use, and advocates for identity threat detection and response (ITDR) — describing core ITDR capabilities and Arctic Wolf’s related offerings to detect, investigate, and respond to identity compromise.