ETS
Home
Identity Threat Intelligence Framework (ITIF)
The first public, enterprise grade framework dedicated entirely to identity-centric cyber threats. Built by practitioners, for practitioners.
Created by Claudiu Tabac - © 2026
This material is open for educational and research use. Commercial use without explicit permission from the author is not allowed
Why ITIF Exists
The Identity Problem
Modern intrusions are identity-driven, not endpoint-driven. Attackers exploit token replay, weak federation, cloud privilege escalation, OAuth manipulation, machine identity compromise, and SaaS-to-cloud lateral movement. Yet the industry treats identity with fragmented documentation, incomplete detection guidance, and minimal attack modeling.
The ITIF Solution
ITIF unifies identity attack behaviors into one coherent, structured system. No existing framework offers an identity-only taxonomy with this level of completeness and depth. This framework reflects how attackers actually use identity not how vendors describe it.
150+
IAM Misconfigurations
Largest cross-cloud taxonomy publicly available
49
Breach Patterns
Real attacker behaviors mapped end-to-end
9
Attack Chain Stages
Complete identity intrusion lifecycle
ITIF Website Library
Explore the Framework Modules
ITIF is structured as eight interconnected modules, each addressing a critical dimension of identity-centric threat intelligence. Start with the Identity Attack Chain to understand the intrusion lifecycle, then explore breach patterns, misconfigurations, and detection logic.
Identity Attack Chain
(IAC)
The 9-stage identity intrusion lifecycle from reconnaissance to long-term persistence.
Identity Breach Patterns (IBP)
Real attacker behaviors across cloud and SaaS environments, mapped end-to-end.
Identity Misconfiguration Universe (IMU)
150+ cross-cloud IAM misconfigurations enabling identity compromise.
Identity Attack Graphs (IAG)
Python-generated visualizations of identity pivot paths and escalation flows.
Identity Threat Detection Logic (ITDLL)
Simplified behavioral detection model focused on identity anomalies that matter.
Identity Failure Modes (IFM)
Architectural, governance, and human failures behind identity-driven breaches.
Identity-Centric Threat Actor Models (ICTAM)
APT and ransomware actors analyzed through identity weaponization techniques.
Executive Threat Storylines
(ETS)
Board-level narratives translating identity risk into business impact.
Eight Industry-First Capabilities
ITIF introduces capabilities that no public resource commercial, academic, or vendor-backed provides with this level of depth, structure, and interoperability.
9-Stage Identity Attack Chain
Original research modeling complete identity intrusion lifecycle not a MITRE adaptation or cloud-provider documentation.
Identity Misconfiguration Universe
150+ item cross-cloud IAM misconfiguration taxonomy the largest publicly available resource of its kind.
Breach Pattern Library
49 real attacker behaviors mapped from reconnaissance through credential theft to persistence and lateral movement.
Detection Logic Library
Simplified UEBA-inspired model anchored in actual identity signals, focusing on anomalies that matter most for detection.
Identity-Centric Threat Actors
APT, ransomware, hybrid, and cloud-native actors modeled exclusively through identity techniques a unique analytical lens.
Executive Storylines
Identity risks translated into business impact: cloud drift, token compromise, machine identity abuse, supply-chain failures.
Machine Identity Analysis
One of the only public frameworks addressing workload identities as attack surface: service principals, secrets, CI/CD identities.
About
Created by Claudiu Tabac — © 2026
This framework is open for educational and research use. Commercial use without explicit permission from the author is not allowed.