# ITDR vs ISPM vs IGA: How the Three Fit Together > IGA decides who should hold access. ISPM finds the weak accounts and settings an attacker could use. ITDR catches someone using an account right now. They answer three questions about the same identities, and each one works better when it can see what the other two know. By Harvey Singh. Published Oct 12, 2026. Updated Oct 12, 2026. Source: https://www.enscurex.com/blog/itdr-vs-ispm-vs-iga ## Key points - IGA (identity governance and administration) answers who should have access, and proves it to an auditor. - ISPM (identity security posture management) answers which identities and settings an attacker could use today. - ITDR (identity threat detection and response) answers whether someone is using an account against you right now. - Attackers prefer valid accounts. A gap one tool leaves open becomes an incident the next tool has to catch. - Start with the question you cannot answer today: an audit points to IGA, an incident to ITDR, a pen test to ISPM. ## What is the difference between IGA, ISPM and ITDR? IGA, ISPM and ITDR look at the same identities: your people, contractors, service accounts and app registrations. They differ in the question they ask about them, and in how fresh the answer has to be. | | IGA | ISPM | ITDR | |---|---|---|---| | The question | Who should have this access? | What could an attacker use? | Is someone using it now? | | How often it answers | At each review, and at each join, move or leave | On every scan of your configuration | As sign-in and audit events arrive | | Who usually owns it | GRC and IT | Security engineering | The security operations team | | A typical finding | A leaver still holds three app roles | An admin account with no MFA | A sign-in from a new country, then a new mail rule | | What it produces | Review decisions and audit evidence | Ranked risk findings | Alerts and investigations | ## What does IGA do? Identity governance and administration controls who holds what, and records why. It covers the life of an account. Access arrives when someone joins, changes when they move, and ends when they leave. IGA also runs access reviews. A manager or an app owner looks at each person's access on a schedule and keeps it or removes it. The output is evidence. An auditor asks who reviewed privileged access last quarter. IGA answers with the campaign, the reviewer and each decision. IGA has a blind spot. It knows what access a person was given. It knows much less about how that access gets used, or whether the settings around it are safe. ## What does ISPM do? Identity security posture management looks for the openings before anyone walks through them. Typical findings include admins with no MFA, and accounts that have not signed in for months but still hold roles. App registrations with broad permissions and no owner show up too. A good posture tool ranks each finding by what the account can reach. An unused guest account that can read one site is a chore. An unused account with a directory role is an open door. ISPM does not tell you whether an attacker is already inside. It tells you where one would most likely start. For the full picture, read [what ISPM checks and how to start](/blog/what-is-ispm). ## What does ITDR do? Identity threat detection and response watches what accounts do. It reads sign-in logs and audit events, and looks for the patterns of known attacks. Examples are impossible travel, MFA fatigue, and a new inbox forwarding rule after a risky sign-in. The hard part is correlation. One odd sign-in is common. A sign-in, a password change, an OAuth grant and a new mail rule, all on the same account inside an hour, is an attack. ITDR tools map those steps to MITRE ATT&CK techniques such as T1078 (Valid Accounts). They then group the steps into one investigation, in the order they happened. Our [guide to ITDR](/blog/what-is-itdr) covers the attacks it catches. ![](/images/blog/itdr-vs-ispm-vs-iga/chain.jpg "Four events on one account inside an hour, read as one attack.") ## Why do the three work better together? Attackers prefer valid accounts. In the Verizon 2025 Data Breach Investigations Report, credential abuse was the most common way in, at 22% of breaches. An attacker with a working password needs no exploit. Every tool that trusts the login trusts them too. Follow one leaver to see the gap. - IGA disables the directory account on their last day. Their OAuth grant to a file-sharing app stays, because nobody connected that app to the review. - ISPM would flag the grant as an app with broad scopes and no owner, if it could see the grant at all. - ITDR sees the token used from a new location a week later. Without the leaver context, the alert looks like an ordinary user at work. ![](/images/blog/itdr-vs-ispm-vs-iga/leaver-gap.jpg "One leaver across three tools. Each one holds a piece, and none of them holds the whole story.") Each tool saw part of the story. Joined up, the story is plain: a former employee's token is still reading company files. That is the case for one shared picture of your identities. Governance tells detection who left. Detection tells governance which access was abused. Posture tells both where the next problem will likely start. ## Which one should you start with? Start with the question you cannot answer today. - **An audit is coming.** Start with IGA. You need access reviews with evidence, and a leaver process you can prove. - **You had an incident with a valid account.** Start with ITDR. Correlation turns the next attack into one investigation instead of five alerts. - **A pen test found MFA gaps and stale admins.** Start with ISPM. It ranks those findings by what each account can reach. - **You do not know which apps your people use.** Start with discovery. The other three can only govern, scan or watch what they know exists. ![](/images/blog/itdr-vs-ispm-vs-iga/where-to-start.jpg "The question you cannot answer today decides where to start.") ## What should you ask a vendor? - Which identity providers and applications does it connect to today? - Does a leaver in governance change how detection treats that account? - Can a posture finding open a review of the access behind it? - When it detects a chain, does it show what the account can reach? - What does the AI in the product read, and what may it change on its own? ## Frequently asked questions ### Is ITDR part of IAM? ITDR sits beside IAM. Your identity provider handles sign-in and MFA. ITDR watches what accounts do after they sign in, and flags the patterns that match attacks. ### Do I need ISPM if I already run access reviews? A review asks whether a person should hold some access. ISPM asks whether the account and its settings are safe, such as an admin with no MFA. You need an answer to both. ### Is ISPM the same as SSPM? No. SSPM (SaaS security posture management) checks the settings inside each SaaS application. ISPM checks identities across all of them: who holds privilege, who lacks MFA, and which accounts nobody owns. ### Can one platform cover IGA, ISPM and ITDR? Some platforms cover all three on one data layer. EnscureX sells four products, Govern, Detect, Discover and Posture, on one identity graph. Each works on its own, and each one you add makes the graph richer. ## Sources - [Verizon 2025 Data Breach Investigations Report](https://www.verizon.com/about/news/2025-data-breach-investigations-report) - [MITRE ATT&CK, T1078 (Valid Accounts)](https://attack.mitre.org/techniques/T1078/)