Huntress Managed ITDR Reviews

Huntress Managed ITDR was to replace an existing solution, as we were using CrowdStrike previously, and the big one for us is to essentially manage suspicious and risky behavior with our user identities, knowing that most of our past historical incidents and compromises came through user identities, giving us a layer of visibility, a support team, and 24/7 response to weird activity happening in our Microsoft environment.

One thing I appreciate the most about Huntress Managed ITDR is that the dashboard is incredibly clear, allowing me to go in and understand what's happening across our organization and users and know where I need to act, drawing my attention in when there are actions that need to be taken, providing that full, high-level, bird's-eye view of everything happening with identity security in our organization.

Their real-time monitoring, including how they retroactively search through logs, has impressed me in action, especially when they found a threat that had been in our system for months during our proof of concept. I appreciate that their real-time monitoring also goes back in time if they find out about a threat later, and the notifications for that, along with the automatic remediations, are incredibly efficient, with one instance where a VPN account was closed out within minutes after an unexpected login. Additionally, there's a new AI-based timeline view that provides a really great breakdown of what actually happened in that event, plus the option to press the SOC button and talk to a human for additional support.

When discussing the downsides of Huntress Managed ITDR, I think one of the advantages is that they've been adding features, including a feature for retroactive hunting for apps that might be deployed in our organization and might be at risk, a great example of a gap they filled. One challenge has been applying rules to staff only due to the option in the VPN rules where I can either deny all VPNs for the organization or do case-by-case exceptions, with no in-between. As a K to 12 school, I would love to see more granular user group level restrictions and alerts. For instance, having all students flagged if high school students log in with a VPN, which I expect at this point, versus a different security risk level for staff, leading to potential trade-offs in our general use cases.

We have been using Huntress Managed ITDR for two months.

Regarding stability, I experience no issues at all with Huntress Managed ITDR, as it consistently accesses data and the platform has always been available for me to find what I need.

I find scalability with Huntress Managed ITDR very easy; we could add 100 users, and I appreciate that they are flexible on licensing, with discussions about scaling up occurring at renewal time rather than requiring immediate payment.

I appreciate the technical support for Huntress Managed ITDR because I can reach out to support and get an immediate pop-up chat, allowing me to speak with a person right away during my last inquiry with the SOC, where we were able to address something we weren't sure about, resolving the challenges we faced. I give the support for Huntress Managed ITDR a rating of 10 out of 10.

I have used direct alternatives to Huntress Managed ITDR, such as Microsoft E5 and Microsoft Defender for Identity, which we use in parallel as one of the data sources, alongside CrowdStrike identity monitoring, referred to as IDP.

The initial deployment for Huntress Managed ITDR was very easy, as I essentially had to click a button, grant the right permissions, and it took care of the rest needed to ingest data, contrasting with competitors where I had to go through extensive documentation.

If I were to compare Huntress Managed ITDR with the alternatives, I find that if I were a larger organization, CrowdStrike might have had a few more functionalities, particularly in the query filter prior to Huntress adding several new search tools recently, allowing me to get what I need all in one context. I appreciate that Huntress bills for usable, useful data, having stripped out unnecessary storage features that previously caused issues, ensuring I only maintain data necessary for security.

One thing I appreciate the most about Huntress Managed ITDR is that the dashboard is incredibly clear, allowing me to go in and understand what's happening across our organization and users and know where I need to act, drawing my attention in when there are actions that need to be taken, providing that full, high-level, bird's-eye view of everything happening with identity security in our organization.

Their real-time monitoring, including how they retroactively search through logs, has impressed me in action, especially when they found a threat that had been in our system for months during our proof of concept. I appreciate that their real-time monitoring also goes back in time if they find out about a threat later, and the notifications for that, along with the automatic remediations, are incredibly efficient, with one instance where a VPN account was closed out within minutes after an unexpected login. Additionally, there's a new AI-based timeline view that provides a really great breakdown of what actually happened in that event, plus the option to press the SOC button and talk to a human for additional support.

Although we do not have any regulatory requirements in our organization, Huntress Managed ITDR has added smart filter data, and we recently tried to go back and investigate something related to a privacy breach, finding it had all the search information necessary to retrieve what we needed. The new features in the search simplify how to search through the logs for information, giving me confidence in my ability to investigate something retroactively, even in the absence of specific regulatory needs.

I just recently turned on the automated incident response within Huntress Managed ITDR and watched it work, which seems to act quickly by automatically taking essential actions while providing remediation tasks afterward, giving me the assurance that they'll do what's necessary to keep the environment secure, even if it temporarily inconveniences a user.

Regarding customizable alerts in Huntress Managed ITDR, we set up alerts for my team to receive phone calls and emails when there's an incident, ensuring we aren't relying on a single person during critical incidents, which I appreciate.

In terms of pricing for Huntress Managed ITDR, it is very affordable from a K to 12 perspective, and considering the cost of a breach, having this peace of mind to proactively act in our environment is worth its weight in gold.

Regarding maintenance on Huntress Managed ITDR, I am not aware of any required maintenance since the tool seems to maintain an existing relationship with Microsoft Entra and operates self-maintaining, with the advantage of receiving a monthly newsletter about new features.

I give this review an overall rating of 10 out of 10.

My main use case for Huntress Managed ITDR is protecting clients' Microsoft 365 tenants.

A specific example of how I use Huntress Managed ITDR to protect those Microsoft 365 tenants is when I see the alerts come through; it can be anything from a location or logging in from a location abroad that isn't normal for the client. It allows me to jump in to that threat and isolate it and remediate it before anything happens.

The best features Huntress Managed ITDR offers are that the configuration for Microsoft 365 is very simple and easy to set up, and the actual security that it brings. In many cases this year, in particular where the threat landscape has been higher, it has allowed me to protect my clients before anything actually happens.

Huntress Managed ITDR has impacted my organization positively because, as well as securing our clients, it has given us another service that we can offer to our clients, which increases revenue. The main thing is that I have a tool in place because predominantly all of my clients use Microsoft 365, so I have that security tool to give to them, which protects them. Ultimately, it is commercially beneficial too.

I have noticed both measurable outcomes since using Huntress Managed ITDR; there has been a revenue increase because we are doing some volume now with the Microsoft 365 ITDR or MDR, as we call it. I am stopping breaches left, right, and center, so it has definitely had a positive impact on both.

Honestly, I don't have any advice on how to improve Huntress Managed ITDR; I think it does exactly what it says and exactly what I need it to.

I don't have anything that comes to mind for needed improvements; perhaps something small or even a wish list feature.

I have been using Huntress Managed ITDR for around two years.

Huntress Managed ITDR is stable.

Huntress Managed ITDR's scalability is fine for me; when I have clients who need to add users, it can automatically configure them to the ICDR, which again, I predominantly use for Microsoft 365, so it is nice and easy.

Very rarely have I had to deal with customer support for Huntress Managed ITDR; the service generally just works. My colleague probably deals with Huntress support more than I do, but again, it is very minimal from a support point of view. My experience has been good.

Negative

I did not previously use a different solution.

The simple setup impacts my day-to-day work because the initial configuration I do not personally manage; my colleague does, but he has related to me that it is simple and easy to do. It makes my life easier that we will configure it and just get it working because it is a one-time thing, very nice and easy to do.

I have seen a return on investment because there is a saving in time; if a client did experience a breach, that would take a lot more of my time to resolve than having that alert to allow me to jump in and remediate it before it becomes a breach. In terms of return on investment as well, time, of course, but also commercially, I have seen a lot of growth in my security offering because of the ITDR service.

My experience with pricing, setup cost, and licensing is that there are no setup costs that I am privy to, so setup is fine. We do that ourselves.

The licensing cost, again, is a good price point that allows me to add it on to clients and it becomes a no-brainer for them to add it because the price of the service makes sense. It is not too expensive. The price deployment and setup from a cost point of view is all spot on.

Before choosing Huntress Managed ITDR, I did not evaluate other options; it was straight from Huntress.

The advice I would give to others looking into using Huntress Managed ITDR is that if you have a lot of clients using Microsoft 365, if you are concerned with the security element in any way, it is just a complete no-brainer to bolt this on to the tenant because it has saved me time, generated revenue, and it has helped a lot of my clients from a security aspect. I see a lot of potential breaches being stopped before they ever become an incident.

I do not have any additional thoughts about Huntress Managed ITDR before we wrap up; I think this has been quite in-depth. I think we have covered quite a lot, but the main takeaway is that the solution, not just this, the solution in general, the EDR as well, has allowed me to expand revenue, but more importantly, protect my clients in a way I have never been able to do before. I would give this solution a rating of 10 out of 10.

My main use case for Huntress Managed ITDR is to determine endpoint threats and to generally perform remediations, which usually happen automatically, followed by manual remediations.

A specific example of how I have used Huntress Managed ITDR for remediation is when a threat is detected. When an alert is given, I check the activity and if it is expected, I perform basic checks and run a full scan. If the activity is not expected, I allow the remediations to proceed. Once remediations are completed, I check manually with the endpoint. If any suspicious activity or links are present, I remove them.

Regarding my use case with Huntress Managed ITDR, I can say that most of the time it is beneficial to have Huntress Managed ITDR.

Huntress Managed ITDR has positively impacted my organization by helping me track suspicious activities and secure the environment, which is the main purpose of Huntress Managed ITDR.

Huntress Managed ITDR has saved time and improved response rates. Sometimes it takes time to perform remediations, but this depends on the endpoint. It is very effective in that if a threat is not safe for the environment, it isolates the devices, which is one of the great features that keeps the network safe.

The best features Huntress Managed ITDR offers include auto remediations. When it finds any threat, it provides remediations that only require one click. Once I click on it, the remediation performs automatically.

The auto remediation feature has made my job easier and more efficient because my time has been saved. It automatically removes suspicious paths or links, which makes the process much easier for me.

I would like to add that if it isolates a device, the isolation cannot be removed without my approval, and no other user or person can remove it.

The human-led investigation and remediation aspect of the solution is important in my security operations, as 70 percent of the work is generally done by Huntress Managed ITDR. However, 30 percent validation is required. I have to verify whatever suspicious links or anything still pending or present in the environment that needs verification.

I would assess the effectiveness of the 24/7 human-led detection and response for identity threats in Microsoft 365 environments as very good, though I have found few occurrences, though it is increasing.

I have used the unwanted access detection feature, and one of the threats we detected involved a bypass of MFA. This feature helped me immediately respond and reset user access and credentials.

Improvements for Huntress Managed ITDR could include enhancing the dashboard. I have observed a few things such as antivirus parameters that generally become inactive or do not work on a full-fledged basis. In these cases, I have to manually intervene and reset the defender, after which it generally starts working again. These issues could be improved.

I have been using Huntress Managed ITDR for approximately one and a half years.

Huntress Managed ITDR is stable.

Huntress Managed ITDR has good scalability with high scalability and it is recommended.

Customer support for Huntress Managed ITDR is good.

I previously used Cylance before Huntress Managed ITDR. It was good, but not as effective. Cylance generally gave false alarms more often than actual alerts.

I have seen a return on investment with Huntress Managed ITDR because it is obviously time-saving.

Before choosing Huntress Managed ITDR, I evaluated other options including Cylance and Field Effect.

I would rate Huntress Managed ITDR an eight out of ten. I chose eight out of ten because it is a great tool. There are many tools available, but I have worked with tools that generally provided alerts that were mostly false positives. Huntress Managed ITDR generally gives good results by capturing actual threats and performing remediations accordingly. My advice to others looking into using Huntress Managed ITDR is that it obviously saves time, remediations can be performed with one click, and threats or suspicious activities are mostly actual alerts. Regarding Huntress Managed ITDR's AI capabilities, I did not use much with Huntress Managed ITDR. Concerning the accuracy and reliability of output from Huntress Managed ITDR's AI capabilities, the output is reliable. I rate Huntress Managed ITDR an eight out of ten overall.

Huntress Managed ITDR is a security tool that we use for security and identity protection.

Huntress Managed ITDR has provided excellent features during the past year that I have been using it. The best feature is the lack of false positives; when we receive an alert from Huntress Managed ITDR, the majority of the time they are true positives that are actionable, unlike some other tools which generate a lot of noise.

Huntress Managed ITDR has greatly helped in detecting and identifying threats. With Huntress Managed ITDR, we are able to catch things like mail flow rules that were created, and we had security incidents in the past that were remediated, but a couple of things were missed like those mail flow rules. Huntress Managed ITDR was able to catch all of those, so it is really valuable because we did not have anything protecting identities in the 365 environment until we obtained Huntress Managed ITDR. Another feature I really appreciated about Huntress Managed ITDR was that it was able to block a rule for non-company approved VPNs.

Overall, Huntress Managed ITDR has improved my organization by making it more secure, which is the biggest improvement, and by reducing noise, so we are able to focus more on actionable alerts.

One area that has room for improvement with Huntress Managed ITDR is that there was a gap with detections inside of America. Huntress Managed ITDR is really good at spotting threats outside of the country, but we had a security incident inside the country, and Huntress Managed ITDR was unable to help with that. A suggestion for improving Huntress Managed ITDR would be to add more ITDR specifically for inside of America.

I have been using Huntress Managed ITDR for about a year.

I would rate the stability of Huntress Managed ITDR as a ten, as I have not really experienced any downtime, bugs, or glitches.

Huntress Managed ITDR is definitely a scalable solution that fits our enterprise-level company needs. I would rate the scalability of Huntress Managed ITDR as a nine.

I would rate Huntress Managed ITDR's technical support as a seven, as I have only used it once or twice and my experience has been pretty good.

Positive

We have also tried SentinelOne as another solution.

Regarding the deployment itself, it was pretty straightforward and not really complex, and there were no challenges along the way.

We use real-time monitoring with Huntress Managed ITDR. We do use the automated incident response with Huntress Managed ITDR. The impact of utilizing the automated incident response with Huntress Managed ITDR has decreased our response time for true positives that could be potential threats in the environment; Huntress Managed ITDR is able to, in real-time, block those threats before we would even see an alert, so it helps keep the environment more secure than it would be without the tool.

Approximately, we have about 1,000 users using Huntress Managed ITDR. Huntress Managed ITDR requires no maintenance from our end as updates and patching are all handled by Huntress Managed ITDR.

I would definitely recommend Huntress Managed ITDR to other users because it is easy to use, and it does not provide too many false positives, which is very important, especially when you are dealing with a company the size that we are; we really need to focus on actionable alerts, and it is the best tool that we have found for protecting the Microsoft 365 environment. I would rate this product an eight overall.

The vast majority of our customers use M365 services, and ID theft is becoming a really prevalent threat. You can start protecting against that with conditional access policies, or take a solution like Huntress Managed ITDR, which does it for you. We are providing end-user education and thought guidance around identity theft, and their natural reaction is to ask if we have a solution that can deal with it. Huntress Managed ITDR does.

ID theft, credential interception, and related threats are probably really prevalent threats that Huntress Managed ITDR helps us with, and we're seeing plenty of our smaller clients get really impacted by it. Having a solution that we can trust is important. At the price point, it's really accessible for our SMB clients. We didn't look at anything else. We just took Huntress because it was there. Having it in a single dashboard that I can look at, and I have it open all the time, is clear and concise. I don't have to spend loads of time working out what I need to deal with or what I don't. The clear actionable insights are really good.

The best features in Huntress Managed ITDR are that it's very easy to very quickly have our clients protected, and at a very reasonable price point.

The real-time monitoring feature in Huntress Managed ITDR is valuable. I've had one or two incidents raised with Huntress Managed ITDR, and every time it's very clear what the incident is and what the next steps I need to take are. It doesn't just say there's an incident and to do something. It says what I should do, step by step, and why. So when I go back to the end-user community and explain that we need to change something or take action, when they naturally ask why, I don't have to work that out myself. It's already told me.

Huntress Managed ITDR is very good because I can make sure we're not getting false positives and a whole bunch of alerts that just become noise. I can really tailor what we get.

There are two things regarding Huntress Managed ITDR. If we have a client that only has M365 Business Standard, all of the MFA details just show as unknown. I think it's actually a Microsoft licensing issue, but I don't think it's a Huntress issue. It would be nice for that to maybe be a little bit more clear. The reason I say this is when I've shown a client their company in our portal, there's a whole bunch of users in there that just show unknown, and they immediately ask what that is. I have to explain it's because they're using Business Basic and so on, and it just doesn't look that clean. It would be better if it just said standard or something.

I've been working with Huntress Managed ITDR for about six months.

The performance of Huntress Managed ITDR product has been really good for us. I've not experienced any issues. Every time I've logged in, it's been quick. We've not seen any downtime with it, so I'm really pleased.

I can't see any issues regarding the scalability aspect of Huntress Managed ITDR. I don't really know what the limits are from its scalability. I can't see us ever getting towards those. The way that the console is organized makes it really easy. The more clients we onboard, it just adds some additional organizations, which makes it very easy to break those down. It doesn't make the console noisy or anything, so I can't see there being any issues from our point of view.

With Huntress Managed ITDR tech support, it's absolutely spot on. I've not needed to reach out myself directly, but the information I get from them where there's been incidents logged is superb. I've been doing a technical job since 1998, and there are very few times I've had from an organization clear communication about what the issue is, why we need to deal with it, and what we need to do to get it dealt with. Usually, it's just an issue and away we go. I'm really pleased with tech support. Our account management, onboarding, and moving forward has been absolutely superb.

Positive

The experience with the initial setup of Huntress Managed ITDR product is absolutely spot on. It's very easy. We're really well supported by Huntress to get onboarded. The actual onboarding process is quite easy and very well documented, and it's really quick as well.

It's not really measurable with Huntress Managed ITDR. Obviously there's always some margin in there. For us, it was really about making sure we had the solution in our portfolio to take to our clients.

I think it's really important that people considering it actually get a demo of the platform and perhaps a trial because the proof is in the pudding. They really should see it in action. It's a quality solution. I would rate this review as a 9 out of 10.

We're using Huntress Managed ITDR mostly for connection monitoring and also for detecting connections from outside the country. Recently, we had an escalation for a specific IP address from the United States. We don't allow United States connections in our tenant, but we do allow one specific IP address to be connected from there. We monitored everything, found out that it was an allowed connection, and then dismissed and resolved it.

We also use Huntress Managed ITDR specifically for unwanted access detection. We really love the product at the moment.

The best features Huntress Managed ITDR offers include having everything easy to access with all the correct information, particularly the triggering events that led to an escalation or incident. We really also love the timelines and the investigation done by the SOC agents that are assigned to the case.

The reactivity of all the systems stands out as the most valuable for our team. If a connection is detected, it does not take long before we are made aware of it through our ticket systems. Once it's done, the investigation is great because we can take most of the information there and put it in our incident report and give that to the client.

The speed of Huntress Managed ITDR has impacted our organization positively. Our previous system took two to three hours to detect something not right with the connection. With Huntress Managed ITDR, it takes half an hour at maximum.

I opened a ticket with support to ask if it would be possible in the near future to exclude some IP addresses instead of a whole country or only a specific VPN service. I learned that this was a feature that was in development, so it will come. This would help us greatly to be able to pinpoint specific connections.

I'm not sure what the AI capabilities of Huntress Managed ITDR are. What I think is a SOC agent working might be AI, but in any case, it seems to be working great.

I've been using Huntress Managed ITDR for about six months.

Huntress Managed ITDR has shown no stability issues.

Huntress Managed ITDR's scalability looks great. We are having a lot of clients already on it, 68 clients currently, and it seems great. Some of these clients have hundreds of users and agents, and it's all working fine.

The customer support is awesome. It's honestly one of the greatest customer support experiences I've had the pleasure to work with. I would rate the customer support a 10 out of 10.

We did use Office Protect and Office Protect Alliance. We switched because there was no automation in their detection. Microsoft 365 details were coming in and then some SOC agents were monitoring everything and reading our baselines each time. Depending on which SOC agent was working on the case, sometimes they were responding correctly, following our baseline, and sometimes they wouldn't. There were too many human incidents on their end for us to continue with those. Also, the response time was awful, sometimes three to four hours before we get notified of anything going wrong, and even at some point it went a whole day without having any news. We detected it ourselves and fixed it ourselves, and then we had to call Office Protect to ask them what happened.

Huntress was already on our radar, so we just went with it.

From what I heard, the implementation was great, it was fine and everyone was happy about it.

If you're looking for a great solution with a lower response time that is just working great out of the box, Huntress Managed ITDR is a great product. I would rate this solution 9 out of 10.

My primary use case for Huntress Managed ITDR is keeping an eye on identity-related threats across Microsoft 365, such as suspicious logins, MFA fatigue attacks, and privilege abuse. It fills the gap that standard M365 alerting would miss.

One thing I value most about Huntress Managed ITDR is that it is easy to configure and manage across multiple tenants because it gives me a global view of all the users.

The customizable alerts in Huntress Managed ITDR are a great feature that benefits me.

In terms of room for improvement, I think they can expand the coverage beyond Microsoft 365. For example, there is nothing for Google Workspace users. Since my own organization uses Google Workspace, I have to use another solution myself, so a Google Workspace edition would be really beneficial.

I have been using Huntress Managed ITDR for six months.

In terms of stability, the solution is very stable, and the cloud platform itself is reliable. We have not run into any downtime that affects the monitoring or remediation.

Huntress Managed ITDR scales really well for an MSSP. The multi-tenant dashboard makes it easy to monitor dozens of clients at once, and adding new user accounts is straightforward. Overall, it runs very smoothly without any operational overhead on my side as the MSSP.

Regarding the technical support for Huntress Managed ITDR, I have not had an incident, so I do not have direct experience yet, but I am very close with the salesperson on their team, and they are very quick to respond.

The support for Huntress Managed ITDR is fantastic, so I would give them a nine.

Positive

I have used a Blackpoint cloud solution as an alternative to Huntress Managed ITDR.

The deployment of Huntress Managed ITDR is very easy; it is similar to its EDR deployment.

For deploying Huntress Managed ITDR, you only need yourself; there is documentation that you can refer to as well.

The maintenance for Huntress Managed ITDR requires no maintenance on my end. It is self-reliant in that once it is set up, it does most of the heavy lifting, and you really just have to review alerts as it monitors for any issues. I really value how Huntress does most of the heavy lifting and monitoring for the identities.

I believe the pricing for Huntress Managed ITDR is very fair.

If my environment uses Microsoft, I really prefer Huntress, but if it is a Google environment, I have to go with Blackpoint, simply because Huntress does not have that offering yet.

The deployment of Huntress Managed ITDR takes under an hour, as it is just connecting the tenant with the platform, so it is quite quick.

I do not use the real-time monitoring feature as they called it in Huntress Managed ITDR.

I think the automated incident response in Huntress Managed ITDR probably is not triggered until a real attack happens, so I probably have not had a use case for it yet.

I would rate Huntress Managed ITDR an eight, but I am going to give it a seven because they do not have Google Workspace yet. Overall, I would say a seven for Huntress Managed ITDR because they do not have any third-party solutions yet. They are very Microsoft-centric, which means most MSPs need to have another solution to fulfill their requirements with clients.

My use case for Huntress Managed ITDR is peace of mind knowing where and how our accounts are being accessed from, how they are being accessed, and giving us the control and insight into that access.

My favorite feature of Huntress Managed ITDR is the automatic alerting and the automatic remediation. They will actually go and block an account or shut off its access if it does not meet our certain criteria.

I love the threat analytics provided by Huntress Managed ITDR, and that is part of the reason why we got it.

I benefit from the customizable alerts in Huntress Managed ITDR as I have used them to set up certain alerts for certain particular scenarios.

I appreciate the real-time monitoring feature of Huntress Managed ITDR. I appreciate the graphical interface it gives to see exactly where in the world people are accessing your environment from, what they are accessing, and what devices they are accessing it from.

Huntress Managed ITDR could improve by cleaning up the dashboard interface. I have to go to multiple screens to do something, so streamlining that dashboard experience would help.

I have been using it for approximately two years now.

I have not seen any sort of downtime with Huntress Managed ITDR.

We deployed Huntress Managed ITDR for 150 users to begin with, and from what I understand, it can scale even way further than that. We are barely scratching the surface.

The quality and the speed of the support for Huntress Managed ITDR were excellent. It was resolved the same day. I got links to comprehensive knowledge bases that provided all the information I was looking for. I would give a score of nine to the support provided by Huntress Managed ITDR.

Positive

The initial deployment of Huntress Managed ITDR was super easy. It was an hour and it was done.

Just one person is required for Huntress Managed ITDR. I did it myself.

I saw the benefits of Huntress Managed ITDR because I knew of someone else who was using the product, and that is when I jumped on it and decided to deploy it in my environment.

The pricing of Huntress Managed ITDR is competitive and fair. It was competitive and it came within budget.

The built-in Microsoft solution would be comparable. Huntress Managed ITDR is monitoring a Microsoft environment. The built-in features that Microsoft provides are not as granular as Huntress Managed ITDR is, but it would be the most comparable competitive alternative.

There were a couple of issues with Huntress Managed ITDR I needed to submit a support ticket for at the beginning, but that was solved within the same day.

I do not have too much regulatory compliance I need to meet with Huntress Managed ITDR, so that is not something I really take advantage of.

Huntress Managed ITDR does not require any maintenance on my end. Sometimes I might not access it for a week or two, and it is just running and it is alerting me when it needs to.

I would give this review a rating of nine.

Huntress Managed ITDR is used for threat detection and response, similar to EDR but specifically for identity.

The best features of Huntress Managed ITDR include the visibility provided through the Huntress dashboard. It allows us to quickly identify risky users, assess the identity security posture of each customer, and see which signals are actively being investigated. From a security perspective, it adds an important layer of protection for our Microsoft 365 tenants and identities.

The human-led investigation and remediation model is one of the primary reasons we chose Huntress Managed ITDR. While advances in AI have lowered the barrier to building security monitoring capabilities, effective threat detection still requires human judgement and context. Huntress combines AI-assisted analysis with human expertise, giving us confidence that potential threats are being reviewed and validated by experienced analysts.

The impact of this feature on our ability to identify suspicious sign-ins and other identity-related risks is significant. Huntress distinguishes between confirmed incidents and escalations that require additional review. When an escalation is raised, it means the SOC has identified activity that warrants attention but may require customer-specific context to determine whether it is malicious or benign. This collaborative approach helps ensure that potentially important signals are not overlooked while keeping alert volumes at a manageable level. That said, there is still room for improvement in the tuning and contextualization of certain escalations, as some ultimately turn out to be expected or legitimate business activity. Further refinement in this area could reduce the amount of validation work required from our team without impacting security outcomes.

Another key benefit is the visibility into potentially malicious or risky applications. We receive alerts where the Huntress SOC has already performed an initial analysis, allowing us to focus our efforts on validation and remediation. Many of these findings would not typically be detected by traditional antivirus or EDR solutions, making Managed ITDR a valuable addition to our overall security stack.

Overall, Huntress strikes a good balance between detection quality and operational efficiency. As an outsourced SOC provider, avoiding alert fatigue is critical, and Huntress generally performs well in surfacing meaningful security events while limiting unnecessary noise.

In ITDR, the area that has room for improvement is the escalations, which are conceptually good. However, we receive many false positives, so I believe this is something that needs to be improved.

I have been using Huntress Managed ITDR for approximately the same period as the EDR, which is around two years.

Regarding stability, I rate Huntress Managed ITDR as a nine.

For scalability, I also rate it as a nine, as it is very scalable.

I also rate the technical support of Huntress Managed ITDR as a nine.

From an ROI perspective, we do not look at it in that way, as we sell the 24/7 SOC solutions to our customers and take a margin from that. We are reselling the product and taking a margin on it.

My advice for others looking into this product is to recommend conducting a proof of concept by installing it on a tenant to get immediate insights, or trying it out for a couple of months to see firsthand the value it provides. I would rate this product a nine overall.

My main use case for Huntress Managed ITDR is that we recently replaced one of our tools with it, and it has been working great so far. We appreciate receiving calls when a breach happens that give us advance notice, and we get notified and act on it fast.

I normally use Huntress Managed ITDR only when there is a breach or when there is an alert that we have to check. That is when we receive a call from Huntress Managed ITDR, and that is when we use it, but not on a day-to-day basis. It has been great working with Huntress Managed ITDR.

The best features that Huntress Managed ITDR offers include the ability to isolate a computer and have one of the Huntress engineers work on it and manage it, which is great. Additionally, receiving an automated call when an incident happens is also great.

Huntress Managed ITDR has been great in helping our team respond to incidents. The last time we had an issue, I contacted Huntress support engineers through chat, and they walked me through the process of isolating the computer. While we isolated the computer, we received a message that the computer had been remediated. There were a couple of things I had to do after remediation, which I completed after we put the computer back to the way it was and removed it from isolation. The positive impact Huntress Managed ITDR has on my organization is that we can act on incidents in a timely manner, allowing us to stop threats before they harm our organization.

Previously, with our other vendor, they only notified us through Teams, which was complicated. With Huntress Managed ITDR, the fact that they give us an automated call about an incident lets me respond faster to incidents. I do not have to wait six hours to check Teams to see if there was an incident or a breach. This has impacted us positively; I would say there is a six-hour difference in response time.

One thing about how Huntress Managed ITDR can be improved is that there are times in which we do not necessarily need to be engaged, and isolation can be triggered automatically so we do not have to do it. When Huntress Managed ITDR sees this is necessary, they can act on our behalf and isolate the computers without requiring our involvement. Because that takes a bit of time, and the faster we stop threats, the better.

I have been using Huntress Managed ITDR for one year.

Huntress Managed ITDR is stable.

Huntress Managed ITDR is pretty scalable; we are able to deploy it with our solution pretty fast.

Customer support for Huntress Managed ITDR is great; I would rate it a 10 out of 10.

We previously used Duo SGN.

I cannot speak to pricing, but the setup cost for Huntress Managed ITDR is quite fast.

I can say that there are fewer employees needed to handle it based on my job role; that is as far as I can tell you regarding return on investment.

We did not evaluate other options before choosing Huntress Managed ITDR; we switched based on feedback.

We are using the Incident Report Timeline feature, and for a couple of incidents, it has been great. We can provide it as evidence of how fast we act on incidents.

I would advise others looking into using Huntress Managed ITDR to not think twice and to make the switch. It has been working great for our organization, exceeded expectations, and beaten other vendors. Huntress Managed ITDR deserves a review rating of 9 out of 10.