Isn't detecting new or unknown identities already ITDR's job?

ITDR detects anomalous behavior on identities it has a baseline for. An IVIP is what continuously discovers identities in the first place — including the ones that were never provisioned through a standard workflow — so ITDR has something to build that baseline against.

Will an IVIP replace our ITDR platform?

No. An IVIP feeds ITDR a complete, continuously current identity graph so its detection and response logic runs against the full estate instead of only the identities it already had visibility into.

How does incomplete identity discovery create detection blind spots?

Anomaly detection requires a baseline of normal behavior. An identity that was never discovered has no baseline, which means an attacker operating through it generates no anomaly signal at all — the account is invisible to the detection layer, not just under-monitored.

IVIP Comparison

IVIP vs. ITDR

Q: Can ITDR alone monitor AI agent identities effectively?

Only for agent sessions it has continuous, current context on. AI agent sessions can begin, access resources across multiple systems, and complete before a batch-driven identity refresh registers them — an IVIP's continuous discovery is what keeps that context current enough for ITDR to act on.

ITDR detects and responds to identity-based attacks in progress. An IVIP is what gives it something accurate to detect against. Here's why detection speed and detection blind spots both trace back to the same upstream data problem.

Detection Is Only as Fast as the Data Underneath It

Identity Threat Detection and Response (ITDR) tools watch for identity-based attacks in progress — credential theft, privilege escalation, anomalous access patterns — and trigger automated or analyst-driven response. That detection logic depends on knowing what normal looks like for a given identity, which depends on having accurate, current data about that identity in the first place.

The blind spot shows up exactly where identity data is thinnest: accounts an ITDR tool never had a baseline for, because they were never discovered as part of its monitored inventory. A local admin account, an orphaned service account, or an AI agent session that begins, touches multiple systems, and completes before the next data refresh — none of these generate the historical signal ITDR needs to recognize when something's wrong.

An IVIP closes that gap by continuously discovering and correlating identities as they change, so ITDR has a complete, current picture to detect anomalies against — instead of a fast response built on an incomplete view.

IVIP vs. ITDR, Side by Side

ITDR answers 'is this identity behaving normally, right now.' An IVIP answers 'what identities exist, and what does normal even mean for each of them.' Detection needs both.

Dimension	IVIP	ITDR
Primary job	Continuously discover, normalize, and correlate every identity across the estate.	Detect identity-based attacks in progress and trigger automated or analyst-driven response.
Time horizon	Continuous — maintains an always-current inventory and graph.	Real-time — watches for anomalous behavior as it happens.
What it depends on	Nothing upstream — this is the discovery layer itself.	Accurate, current identity context to establish a baseline of 'normal' per identity.
Known failure mode	None inherent — the category exists specifically to close this gap.	Blind spots on identities it never had baseline data for, and false positives on identities it doesn't have enough context on.
Relationship to Hydden	What Hydden is — the authoritative identity data layer, with a write path.	What Hydden feeds — giving detection logic a complete, current identity graph to run against.

The Trap: You Can't Detect an Attack on an Identity You Never Discovered

ITDR tools are genuinely fast at catching anomalies once an identity is in scope. The trap is assuming that scope is complete. An attacker who moves through an account your monitoring never had a baseline for — a shared local admin credential, a decommissioned-but-still-active service account — generates no anomaly at all, because there was never a 'normal' recorded to deviate from.

AI agents make this worse, not better: an agent session can begin, access resources across multiple systems, and complete before a batch-driven identity refresh even registers it happened. Detection that's fast against known identities and blind to unknown ones isn't fast — it's incomplete.

The Trap

A detection tool that's never seen an identity before can't flag it as abnormal. Discovery gaps are detection gaps wearing a different name.

Do You Need an IVIP If You Already Have ITDR?

Short answer: yes — ITDR is only as complete as the identity data it watches.

You need an IVIP if...

An incident review found the attacker used a service account or local admin credential your ITDR tool had no baseline for.
AI agent sessions begin, touch multiple systems, and complete faster than your identity data refreshes, leaving nothing for ITDR to compare against.
Your ITDR tool generates false positives on accounts it doesn't have enough historical context to evaluate confidently.

Your ITDR is still doing its job if...

You need real-time detection and automated response for anomalous behavior on identities already in its monitored scope.
Correlating detected threats with known attacker TTPs and orchestrating remediation across your security stack is the deliverable.

An IVIP doesn't replace ITDR's detection logic — it gives that logic a complete, continuously current identity graph to detect against, including the identities that would otherwise never generate a baseline at all.

Frequently Asked Questions

See the Identity System of Record in Action

Hydden discovers, reconciles, and continuously governs every identity — human, machine, and agentic — across your enterprise.

IVIP vs. ITDR

Detection Is Only as Fast as the Data Underneath It

IVIP vs. ITDR, Side by Side

The Trap: You Can't Detect an Attack on an Identity You Never Discovered

Do You Need an IVIP If You Already Have ITDR?

You need an IVIP if...

Your ITDR is still doing its job if...

Frequently Asked Questions

Related Reading

What Is an IVIP?

Identity Threat Detection & Response

IVIP vs. IGA

IVIP vs. ISPM

See the Identity System of Record in Action