baselineRFIWhat identity infrastructure does the platform natively monitor — on-prem Active Directory, Entra ID/Azure AD, Okta, and hybrid environments — and which require separate connectors or licenses?weight 3
Answer key — what a strong answer shows
Look for a coverage matrix across the major identity providers and clarity on native versus add-on connectors.
baselineRFPDescribe detection coverage for credential-based attack techniques specifically (Kerberoasting, DCSync, golden/silver ticket, pass-the-hash, MFA fatigue/push-bombing) and provide a measured detection-rate or customer reference for at least one technique.weight 3
Answer key — what a strong answer shows
Strong answers name specific techniques with real detection evidence, not a generic 'we detect identity attacks' claim.
baselineRFIHow does the platform detect misconfigurations and standing risk in identity infrastructure (excessive privileged group membership, stale/unused privileged accounts, misconfigured trust relationships) proactively, versus only detecting active attacks?weight 3
Answer key — what a strong answer shows
Look for proactive posture assessment as a distinct capability from real-time attack detection.
baselineRFPDetail automated response actions available (disable account, force re-authentication, revoke sessions/tokens, quarantine) and whether these can be triggered automatically or require manual analyst action for every case.weight 3
Answer key — what a strong answer shows
Strong answers describe genuinely automated response options with configurable thresholds for when automation is trusted versus requiring human approval.
baselineRFIHow does the platform handle non-human identities (service accounts, API keys, workload identities) — is detection/monitoring extended to these, or is coverage limited to human user accounts?weight 3
Answer key — what a strong answer shows
Non-human identity coverage is an increasingly important and often-missing capability — look for a specific answer, not silence on this category.
baselineRFPExplain how the platform correlates identity-layer signals with endpoint/network telemetry (e.g., via XDR integration) to distinguish a genuine identity compromise from benign anomalous behavior, and provide a customer-referenced false-positive rate.weight 3
Answer key — what a strong answer shows
Cross-domain correlation materially reduces false positives compared to identity-signal-only detection; look for a real customer-validated false-positive figure.
baselineRFIWhat is the deployment model and blast radius for initial rollout — can the platform run in a fully passive/read-only monitoring mode first before any enforcement actions are enabled?weight 3
Answer key — what a strong answer shows
A passive-first rollout option reduces deployment risk; a product that requires enforcement mode from day one is riskier to adopt.
baselineRFIHow does the platform detect identity threats specific to SaaS application access (OAuth token abuse, third-party app consent grants, session hijacking via stolen cookies) beyond core directory/IdP monitoring?weight 3
Answer key — what a strong answer shows
SaaS-layer identity threats are a distinct and growing category — look for specific coverage rather than an answer that only addresses directory-level attacks.
baselineRFIWhat is the pricing model — per identity/user, per directory object, or a flat enterprise tier — and how does cost scale as the customer's identity estate grows (including a large jump in machine/non-human identities, which are often the larger population)?weight 3
Answer key — what a strong answer shows
Look for transparent, predictable scaling economics that account for non-human identity growth specifically, since that population often dwarfs human user counts and could create unexpected cost jumps.
baselineRFIDoes the platform support proactive, hypothesis-driven threat hunting specific to identity infrastructure (e.g., an analyst actively searching for early signs of a Kerberoasting campaign), or is capability limited to alert-driven detection of already-triggered rules?weight 3
Answer key — what a strong answer shows
Proactive threat-hunting tooling is a materially more advanced capability than pure alert-driven detection — ask for a specific hunting-workflow example, not just a general claim of 'hunting supported.'
baselineRFPDetail integration with the customer's existing PAM and IGA tools so that identity-threat detection, privileged-access data, and governance/entitlement data combine into one risk view, rather than three disconnected tools each with a partial picture.weight 3
Answer key — what a strong answer shows
Look for genuine data-sharing integration across ITDR/PAM/IGA; three separate tools that each only see part of the identity risk picture create real blind spots at the seams.
baselineRFIIs a named incident-response retainer or breach-coach service available specifically for identity-compromise incidents (e.g., a confirmed domain-admin credential theft), and what is the average engagement response time with a customer reference?weight 3
Answer key — what a strong answer shows
Strong answers cite a concrete, named IR capability and response-time figure — an identity compromise (especially privileged-account takeover) is often the highest-severity incident class and deserves specialized, fast response.
baselineRFPWhat compliance-oriented reporting is generated from ITDR activity (e.g., evidence that identity-security controls were monitored and enforced for a SOC 2 or similar audit), and is this a built-in exportable report or something the customer must assemble manually?weight 3
Answer key — what a strong answer shows
Native compliance-evidence generation is materially more valuable than raw alert logs requiring manual compilation for every audit cycle.
baselineRFIHow does identity-threat coverage extend to cloud-infrastructure identity specifically (AWS IAM, Azure RBAC, GCP IAM roles) as distinct from directory/IdP-layer identity (Active Directory, Okta, Entra ID), and is this native or a separate integration/product?weight 3
Answer key — what a strong answer shows
Cloud-infrastructure identity (IAM roles/policies) is a distinct and increasingly critical risk surface from directory-layer identity — a vendor should clarify explicitly whether this is covered, since it's a common scope gap.
baselineRFPProvide a measured detection-latency figure (time from a real credential-theft technique occurring to the platform generating an alert) for at least one specific technique, backed by a customer reference or independent test, not just a general 'real-time' claim.weight 3
Answer key — what a strong answer shows
A concrete, technique-specific latency figure is far more meaningful than an unqualified 'real-time detection' marketing claim — press for the actual number.
baselineRFIWhat is the platform's own false-positive rate on legitimate administrative activity (e.g., a real IT admin performing legitimate privileged actions that resemble attack patterns), and what tuning process exists to reduce alert fatigue without missing real attacks?weight 3
Answer key — what a strong answer shows
Legitimate admin activity frequently resembles early attack-technique signatures — a vendor with no real answer on this tuning challenge likely generates significant alert fatigue in practice.
baselineRFPIf proposing Microsoft Purview Audit (Premium) or Microsoft Defender for Identity, clearly identify associated licensing requirements/costs, justify operational benefits, and state which capabilities would be unavailable or degraded without them.weight 3
baselineRFPContractor shall ensure the ISSM approves user access privileges and that user access is validated periodically (at least quarterly) in coordination with the IAM team, ensure separation of duties is enforced through technical mechanisms, and ensure unused or inactive accounts are reviewed and deactivated monthly.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
