Kaspersky MDR Adds Automatic Correlation with Leaked Credentials via Digital Footprint Intelligence

Kaspersky has enhanced its Kaspersky Managed Detection and Response (MDR) service with new capabilities to detect account takeovers earlier by correlating suspicious activity with leaked credentials.

The update integrates data from Kaspersky Digital Footprint Intelligence, a service that monitors an organization’s digital footprint and external threats. When employee credentials appear in a data breach and the system simultaneously detects anomalous behavior, analysts receive enriched context to investigate and prioritize incidents more effectively.

The feature addresses a growing threat: according to Kaspersky, compromised accounts were the initial vector in one quarter of attacks investigated in 2025. Using stolen credentials is often simpler for attackers than bypassing defenses directly, while distinguishing malicious activity from legitimate user behavior remains challenging.

Additional improvements include new notifications about the protection status of monitored assets. Administrators are alerted when connectivity problems or telemetry collection issues risk degrading monitoring quality. Recommended alert rules can now be customized according to the specific needs of the company or individual departments.

Managed security service providers gain the ability to set expected license usage limits for each client. The service also extends support to Kaspersky Embedded Systems Security for Linux 4.0, enabling protection of embedded Linux systems through the MDR platform.

Kaspersky MDR provides continuous monitoring of corporate infrastructure, threat hunting, incident investigation, and coordinated response to attacks.