Uncover hidden risks

Watch how the Wiz platform can expose unseen risks in your cloud environment without drowning your team in alerts.

Threat Detection and Response (TDR) Explained

Threat detection and response (TDR) is a set of continuous processes that proactively search for cyberattacks and respond to them in real time.

6 minutes read

What is threat detection and response?

Threat detection and response (TDR) is a set of continuous processes that proactively search for cyberattacks and respond to them in real time. It differs from traditional security solutions that react only once known threats have been identified.

Security teams today are battling a vast number of threats: 

  • Malware like viruses, spyware, ransomware, and phishing attempts

  • DDoS attacks that overwhelm your systems

  • Botnets used for spam, data theft, and cryptojacking

  • Data theft, unknown vulnerabilities (zero-day threats), and attacks that misuse legitimate tools like file transfer tools

Traditional security platforms may not catch today’s increasingly sophisticated attacks if they use static methods that rely on signatures or lists. And cloud service provider tools don’t cover your cloud infrastructure in multi-cloud environments.

In today’s threat landscape, you need a dynamic approach that adapts to your environment and learns from your use patterns so that it can recognize what “unusual” looks like for your organization.

Threat detection and response (TDR) offers this dynamic approach, working hand in hand with traditional methods for a more comprehensive, proactive solution.

As the name suggests, TDR involves two core elements: detection and response.

What is threat detection? 

Threat detection uses proactive techniques to look for threats. First, it analyzes network and device activity to determine baseline behavior. Once it has learned your usage patterns, it can flag anomalous patterns and behaviors.

TDR uses behavioral analysis to detect any questionable activity across your systems and networks. This could include unauthorized access attempts or unusual file transfers, sudden network traffic spikes, failed login attempts, or unexpected locations, such as an employee who’s normally in California suddenly accessing sensitive internal data from an IP address in Kazakhstan.

TDR can additionally leverage machine learning to detect noveln malware, using safe sandbox environments to assess suspicious files. It can also incorporate threat intelligence feeds from security researchers about new attack methods, IOC’s and IOBs.

What is threat response? 

Recognizing threats isn’t enough, of course. You also need to respond. TDR’s threat response will vary based on the given threat and may entail:

  • Stopping attacks in progress by blocking IP addresses and disabling compromised accounts 

  • Minimizing damage by isolating infected devices and shutting down affected services 

  • Aiding in faster system and data recovery after a security incident by facilitating restore procedures

  • Preventing future attacks through proactive posture management 

Example of real-time response actions triggered to reduce and contain the an incident blast radius

Thanks to TDR’s access to threat intelligence, plus its integration with your other security tools, you’ll be able to respond more effectively to any threat.

Why do you need threat detection and response?

Without TDR, you may experience a variety of issues:

  • Threats spread quickly if you can’t detect a problem, investigate, and respond as needed.

  • More complex attacks, such as zero-day exploits, advanced persistent threats (APTs), and multi-vector attacks.

  • Without TDR tools, defenders lack the real-time data and insights needed to identify and understand the scope of an ongoing attack. Quicker responses minimize business impact

When security tools are not integrated, you may lack visibility into your entire environment, leaving you inevitably more at risk for undetected vulnerabilities. Plus, in the cloud, you are at a higher risk of suffering a breach due to:

  • Zero-day attacks caused by previously unknown vulnerabilities

  • Fileless malware that is difficult to detect through traditional means

  • Lateral movement, with attackers moving undetected through your environment

  • Supply chain attacks caused by unknown vulnerabilities in a component or library

  • Container escape, allowing attackers to access other containers or the host

  • Misconfiguration, leaving data and systems exposed

  • Cryptojacking, which steals your own resources to make money for others

Once attackers enter your environment, they can compromise user credentials, change systems’ and apps’ behavior, and encrypt or steal valuable data. TDR stops attackers in their tracks, often before they can do any damage.

How does threat detection and response work?

Here’s how a TDR solution works for you every step of the way:

  1. Establish baselines: The TDR tool examines normal and typical usage patterns within your environment so it can later recognize and react to any anomalous situation.

  2. Ingest threat intelligence: It then collates intelligence from industry sources to understand the latest attack methods, vulnerabilities, indicators of compromise (IOCs), and signs of persistence to ensure the most up-to-date protection.

  3. Monitor 24/7: A TDR platform aggregates information from logged events across your environment: network traffic, endpoint activity, applications, SIEM solutions, cloud provider, user activity, and vulnerability scanners.

  4. Analyze data: TDR performs real-time analytics to determine if the aggregated data conforms to the established baselines or if an anomalous situation has been detected.

  5. Alert your team: The tool can then initiate automated procedures to contain and mitigate any potential problem and trigger incident response procedures—and recovery procedures, if necessary.

  6. Remediate the issue: Lastly, TDR provides information to help the security team pinpoint the problem and apply the proper mitigation or eradication procedures.

What are some challenges to threat detection and response?

Like any IT change process, rolling out TDR requires careful planning and collaboration. Otherwise, the following challenges could undermine the success of the transition.


Every major IT change comes with costs, so it’s essential to demonstrate a clear ROI to ensure buy-in across your entire organization. Some stakeholders may resist buying a new solution when existing security measures and vendor solutions are already in place.

Talent Shortage

Security teams may be apprehensive about additional alerts and extra work that TDR may generate. Additionally, they’ll need to be trained on the new system's functionalities and best practices, creating a learning curve.


Integrating a TDR tool with existing infrastructure can represent a significant hurdle. Security teams may be concerned about compatibility issues or disruptions during the transition, which will require careful cooperation between IT and security teams.

Types of detection and response solutions

TDR is actually a general category that includes a variety of detection and response tools:

EDREndpoint detection and response, for faster threat isolation and response on desktops, laptops, and mobile devices; especially important in today’s bring-your-own-device (BYOD) and work-from-home climate.
CDRCloud detection and response, typically using APIs from cloud service providers and workload, configuration, and user activity data via run-time events from container hosts and workloads.
NDRNetwork detection and response, specifically for analyzing network traffic to identify malicious activity and prevent breaches for on-premises environments.
XDRExtended detection and response, which aims to consolidate events from on prem and cloud based security tools.

In essence, while EDR, CDR, NDR, and XDR each focus on different segments of the IT infrastructure, their shared goal is to enhance the detection of threats and the speed and effectiveness of the response to those threats.

What do you need in a threat detection and response platform?

When selecting a TDR platform, these essential features will help you cut work for your security team while also cutting your odds of a security incident:

  • End-to-end visibility: Continually assesses real-time data, cloud activity monitoring, and audit logs, exposing attacker movement in the cloud and allowing for rapid detection and response

  • Real-time monitoring: Extends security capabilities to all cloud components (applications, servers, networking, VMs, containers, Kubernetes, and APIs) to eliminate blind spots and stop threats in their tracks

  • Forensic analysis: Dissects past attacks to help prioritize real threats, minimizing alert fatigue and enabling faster response

  • Automated response: Enforces least privilege, verifies identities, and runs pre-defined threat playbooks without manual intervention

  • Threat Intelligence: The platform should leverage global threat intelligence to stay updated on the latest threats and to provide context for the alerts it generates. This helps in understanding the severity and potential impact of detected threats.

  • Integration: Ensures no threats fall through the cracks often left by “patchwork” security made up of multiple tools joined together (like when you rely on cloud provider solutions across multiple clouds)

Real-time threat detection and response in the cloud

As part of our unified cloud security platform, Wiz offers detection and response across any cloud environment, regardless of technology. Wiz cloud detection and response collects runtime events for more granularity for container hosts and Linux VMs, providing runtime protection that empowers your teams to take action against threats and limit their business impact. And because Wiz is agentless, it’s simpler to roll out and won’t increase your attack surface.

Wiz's Cloud Detection and Response (CDR) capabilities are designed to provide comprehensive visibility and real-time threat detection in your cloud environment. Here are the key features:

  1. Integration with Cloud Logs: Wiz connects directly with your cloud logs to provide additional context and detections related to events occurring in your environment. This integration helps in correlating actions performed on resources with the principals that performed them.

  2. Real-time Threat Detection: Wiz can detect various threats in real-time, including brute force attacks, anomalous behavior, malware execution, and threats originating from malicious IPs or domains.

  3. Correlation of Events: Wiz correlates runtime workload events with cloud control-plane events, providing a unified view of potential threats and their impact on your environment.

  4. Attack Simulations: Wiz offers safe attack simulations to demonstrate its detection capabilities. These simulations mimic the actions of an attacker, such as reconnaissance, lateral movement, and data exfiltration, without interacting with existing cloud resources.

  5. Integration with Native Cloud Security Tools: Wiz integrates with native cloud security tools like AWS GuardDuty, Google Security Command Center, and Azure Defender for Cloud to enhance threat detection and provide additional context.

By unifying CSPM, CWPP, and CDR within its CNAPP, Wiz enables a defense-in-depth strategy - proactively reducing risk with preventive controls while providing real-time threat monitoring and response capabilities for comprehensive cloud security. Sign up for a personalized demo to see Wiz in action today.

Trip up threat actors before they can move laterally

See for yourself why CISOs at the fastest growing companies choose Wiz to harden their cloud environment's internal defenses to stop lateral movement.

Get a demo

Continue reading

Kubernetes Security Context: Best practices

In Kubernetes, a security context defines privilege and access control settings for a Pod or Container. It allows you to specify security configurations such as user and group IDs, filesystem permissions, and capabilities.

Azure Security Risks & Mitigation Steps

Wiz Experts Team

This article offers an extensive examination of Azure environments’ most pressing security risks along with suggested approaches for effectively mitigating these challenges.