Guardz Identity Threat Detection & Response

Attackers are not breaking in any more. They are logging in. The Salesloft and Drift OAuth compromise chains of 2024-2025 proved the point — credentials and tokens are the new perimeter, and most endpoint-focused tools simply miss the identity-tier signal entirely.

Guardz ITDR is the purpose-built module for detecting these attacks on Microsoft Entra ID, Microsoft 365 and Google Workspace identity. Detection content covers misconfigured directory posture, anomalous app-registration creation, suspicious admin role grants, over-permissioned service principals, OAuth phishing chains and the kind of token-replay activity that signature-based tools never catch in time. The product engineering team also runs the EntraReaper research project — an autonomous red-teaming programme that maps the Microsoft 365 attack surface and feeds new detections back into the platform.

For Australian MSPs whose SMB tenants live in Microsoft 365 or Google Workspace, this is the module that matters most. Endpoint AV plus EDR does not catch an OAuth grant gone wrong, an attacker creating a persistent app registration in Entra ID, or a service principal slowly acquiring scopes it should never have. Guardz ITDR does, and it correlates the identity signal with the endpoint and email surface so the response runs across all three in one workflow.