Frequently Asked Questions

Everything you need to know about Auth Sentry's Identity Threat Detection & Response platform.

Understanding ITDR

What is ITDR (Identity Threat Detection and Response)?

ITDR detects and stops identity-based attacks that happen after attackers bypass your perimeter defenses like MFA and firewalls. It monitors behavior instead of just checking credentials, catching compromised accounts, privilege escalation, and lateral movement that traditional IAM tools miss because the attacker is using legitimate, stolen access.

What makes Auth Sentry different: While most ITDR solutions focus only on human identities, Auth Sentry monitors all 100+ identity types—including service accounts, API keys, OAuth tokens, and AI agents that now outnumber humans 45:1 in most enterprises. We're purpose-built for hybrid environments with unified visibility across cloud and on-prem systems, detecting cross-platform threats that siloed tools can't see.
Back to top

What's the difference between ITDR and IAM/SIEM?

IAM controls who can access what (authentication and authorization), SIEM collects security logs from everywhere, and ITDR detects when valid credentials are being used maliciously. Think of IAM as the bouncer checking IDs, SIEM as the security cameras recording everything, and ITDR as the detective who notices the "employee" is actually robbing the place despite having valid credentials.

Why you need all three (and why Auth Sentry works with what you have): Your IAM system (Okta, Azure AD, Google Workspace) grants access and enforces policies. Your SIEM (Splunk, Sentinel, Chronicle) aggregates logs and helps with compliance reporting. But neither is designed to detect when legitimate access is being abused. Auth Sentry fills the gap: we analyze identity behavior in real-time to detect when authenticated users (or their stolen credentials) are doing things they shouldn't. We integrate with your existing IAM and SIEM rather than replacing them.
Back to top

How does Auth Sentry detect identity threats that bypass MFA?

Auth Sentry uses behavioral anomaly detection and identity relationship mapping to spot malicious activity even when attackers have valid credentials and passed MFA. We analyze how identities actually behave—access patterns, resource usage, permission changes—and flag anomalies that indicate compromise, regardless of whether authentication was "successful."

Auth Sentry's detection advantage: While other ITDR vendors analyze activity logs in 15-60 minute batches, Auth Sentry processes identity telemetry in real-time with sub-5-second detection latency. This matters because today's attackers move laterally fast after initial compromise—batch processing systems detect threats after the damage is done. We also use identity relationship mapping that competitors don't: Auth Sentry maps how identities relate to each other, detecting multi-hop attack patterns across delegation chains and service account relationships that point-in-time analysis misses.
Back to top

Can Auth Sentry detect compromised service accounts and machine identities?

Yes—Auth Sentry monitors all identity types including service accounts, API keys, OAuth tokens, CI/CD pipeline credentials, and AI agents, not just human users. We detect when machine identities exhibit suspicious behavior like unusual API call patterns, unauthorized resource access, or privilege escalation that indicates compromise or misconfiguration.

Why machine identity detection matters (and why most ITDR ignores it): In the average enterprise, non-human identities outnumber human users 45:1—and that ratio is growing exponentially with AI agents, microservices, and automation. Auth Sentry was designed from the start to handle both. We understand that service accounts don't take lunch breaks, don't work 9-5, and legitimately access APIs thousands of times per hour—so we baseline machine identity behavior differently than human behavior. If your ITDR can't see machine identities, you're blind to 98% of your attack surface.
Back to top

Product & Deployment

Do I need to install anything for Auth Sentry to work?

No installation required—Auth Sentry connects to your existing identity systems through secure API integrations and deploys in just hours with zero infrastructure changes. No agents on endpoints, no network proxies, no hardware appliances, and no reconfiguring your existing authentication flows.

Why Auth Sentry's deployment is actually painless: Many ITDR vendors claim "agentless" but require SIEM integrations, log forwarders, SSO modifications, or network monitoring appliances. Auth Sentry is genuinely plug-and-play—if you can add a Slack integration, you can deploy Auth Sentry. The only technical requirement? API access to the identity systems you want to monitor. That's it.
Back to top

How long does Auth Sentry take to deploy?

Just hours from start to finish—you'll be detecting threats and protecting systems the same day you decide to deploy. Most of that time is Auth Sentry establishing baseline behavioral patterns in the background while you verify integrations and configure alert routing.

The Auth Sentry speed advantage: Traditional ITDR deployment takes 6-12 months because competitors require infrastructure changes, agent rollouts, extensive tuning, and pilot programs. Auth Sentry eliminates all of that through pure API integration. Hour 1: Grant API access. Hour 2: Auth Sentry starts learning behavioral baselines. Hours 3-4: Configure policies while detection goes live. You're protected the same day.
Back to top

What identity systems does Auth Sentry integrate with?

Auth Sentry integrates with a broad range of identity platforms including Google Workspace, Microsoft 365, Okta, and many more. We connect through secure read-only APIs to monitor authentication logs, permission changes, access patterns, and policy violations across your entire identity infrastructure. Don't see an integration you need? Just ask—our streamlined development process means we can build and ship new integrations rapidly.

Auth Sentry's integration advantage: Unlike ITDR vendors that specialize in only cloud or only on-prem, Auth Sentry provides unified visibility across hybrid environments. We also integrate with collaboration tools (Slack, Teams), code repositories (GitHub, GitLab), cloud platforms (AWS, GCP, Azure), and custom applications through our REST API and webhook support. During integration, we maintain read-only access—Auth Sentry observes your identity systems but never modifies authentication flows, user permissions, or access policies.
Back to top

Can I see a demo if I'm just researching ITDR solutions?

Yes, absolutely—our demos are designed for security leaders in the research phase who want to understand modern ITDR capabilities before evaluating specific vendors. Our free 30 day trial will show you how Auth Sentry's Identity Threat Detection differs from traditional IAM and what post-perimeter threats look like, with no sales pressure.

Why early-stage demos matter (and why we encourage them): Most vendors push you through qualification calls and discovery meetings before they'll show you the actual product. We take the opposite approach: we want you to see Auth Sentry even if you're six months away from a purchasing decision, because educated buyers make better decisions and we're confident in the value our product provides.
Back to top

Security & Compliance

Is Auth Sentry SOC 2 compliant? What security certifications do you have?

Founded by industry professionals, Auth Sentry puts your privacy and security first. We are building our platform from the ground up to be SOC 2 Type II certified and ISO 27001 compliant, as well as to maintain GDPR data privacy compliance. We are currently working on obtaining these certifications. We follow secure development lifecycle practices, including code review, vulnerability scanning, and responsible disclosure protocols.

Why our security posture matters: Security vendors get scrutinized harder than anyone else—you're trusting us to monitor your most sensitive systems. We implement defense-in-depth: data encrypted in transit (TLS 1.3) and at rest (AES-256), zero-trust network architecture, principle of least privilege for all Auth Sentry systems, multi-factor authentication required for all employee access, and complete audit logging of every action in our platform.
Back to top

How does Auth Sentry protect my data and ensure privacy?

Auth Sentry accesses only authentication logs and identity metadata—we never have access to your users' passwords, email content, or file contents. All data is encrypted in transit and at rest, processed in isolated tenant environments, and retained according to your configurable policies with automatic deletion after your specified timeframe.

Our data privacy approach: We specifically do NOT access: your users' passwords or authentication credentials, email message contents, file contents from drives or storage, chat message contents, or personal information beyond what's needed for identity correlation. All data flows are encrypted using TLS 1.3 with perfect forward secrecy. Each customer's data lives in logically isolated tenant environments—your data never mingles with other customers' data.
Back to top

Pricing & Support

How does Auth Sentry pricing work?

Auth Sentry offers flexible pricing tiers designed for organizations of all sizes, from startups to enterprises. We believe in transparent, straightforward pricing that lets you scale your identity security without worrying about surprise fees or punitive overages.

Our pricing philosophy: Auth Sentry pricing scales predictably with your environment, deployment assistance is included, and we offer flexible contract terms including monthly options for startups and growing teams. Our goal is to be a partner in your security journey—not a vendor looking to maximize extraction at every renewal. Contact us for a transparent conversation—no games, no pressure, just honest numbers.
Back to top

What kind of support does Auth Sentry provide?

Every Auth Sentry customer gets access to our security engineering team—the people who actually built the platform. No ticket queues, no offshore call centers reading scripts, no endless escalation chains. When you need help, you talk to experts who understand identity security inside and out.

Support that matches security reality: Our average first-response time is under 2 hours during business hours, and we provide priority support throughout your free trial. For customers who need enhanced coverage, we offer premium support tiers with 24/7 availability, dedicated account management, and guaranteed response times for critical incidents.
Back to top

Didn't find your answer?

Our team is here to help you understand how Auth Sentry can protect your organization.

Book a Demo Contact Us