PDF TD_ITDR_eBook-v6 - threatdown.com
threatdown.com · first seen by us October 26, 2026
About this document
This guide walks through a realistic identity-led intrusion against a fictional organization, COMPANY, tracing how a threat actor moves from an initial credential attack to attempted data exfiltration across Microsoft Entra ID and Okta. At each stage, ThreatDown ITDR surfaces what's happening, who's doing it, and why it matters. All before the damage is done.