Security
Identity Threat Detection & Response (ITDR)
This control asks one thing: What is the dominant operating model for detecting and responding to identity-based attacks across workforce and cloud identity systems?
Low Maturity
What Failure Looks Like
The documented failure mode at level 0 (Absent) on the 0 to 4 maturity scale:
MTTD measured in weeks. Attackers establish persistence and move laterally before detection.
Why this control caps your score
Prevention fails. If you can't detect identity abuse quickly, you are donating time to attackers.
SEC-01 is one of the domino controls in the AXIS model. When the weakest domino control in an assessment sits at a low level, the overall maturity score is capped, regardless of how strong everything else is. The cap lifts as this control matures; the exact schedule is part of the scoring model.
High Maturity
What Good Looks Like
The business value the methodology documents at level 4 (Optimized):
Prevents small identity compromises from becoming enterprise-scale breaches.
Next Step
A Typical Next Move
For programs sitting around level 0 (Absent), the methodology recommends this as the next rational step:
Centralize identity telemetry and deploy baseline detections for common identity attacks.
What reaching level 2 (Developing) unlocks
Containment speed becomes a control, not a hope.
Evidence
Evidence Assessors Ask For
A sample of the artifacts an assessor expects to see around level 2 (Developing):
- Detections mapped to MITRE identity techniques
- Playbooks exist and are used
- Session/token revocation procedures exist
Breach Radar
Seen in Real Breaches
These teardowns of public incidents cite SEC-01 as one of the controls that failed. Each one reconstructs the attack chain from public disclosures.
What Caused the Marks & Spencer Breach?
Read the teardownWhat Caused the Salesloft Drift Breach?
Read the teardownWhat Caused the Change Healthcare Breach?
Read the teardownWhat Caused the Microsoft Midnight Blizzard Breach?
Read the teardownWhat Caused the MGM Resorts Breach?
Read the teardownWhat Caused the Okta Support System Breach?
Read the teardownWhat Caused the Capital One Breach?
Read the teardownCompliance
Compliance Frameworks That Cite This Control
The bank's regulatory mapping for SEC-01 resolves to 6 frameworks with a researched compliance threshold. Weakness here shows up in audits, not only in incidents.
Where Does Your Program Land on SEC-01?
This page is the teaser layer. The full rubric behind SEC-01 defines 5 scored maturity levels, 0 to 4, each with its own operating model, evidence expectations, and regulatory citations. That rubric is the scoring instrument, so it ships inside the assessment rather than on a marketing page. Running the assessment takes about 20 minutes and no signup is required to start.