Huntress Managed ITDR Reviews

My main use case for Huntress Managed ITDR is monitoring identity-related security threats, detecting compromised accounts, and identifying suspicious authentication activities.

Huntress Managed ITDR has positively impacted my organization by helping improve identity security visibility and awareness of potential account compromise, supporting earlier identification of suspicious authentication activities, and strengthening my approach to protecting user accounts and access privileges.

A specific outcome I have seen since using Huntress Managed ITDR is better visibility into identity-related security events and reduced manual effort during investigation. It helps my team identify suspicious account activity more effectively, and we are still tracking long-term metrics and do not have a verified percentage for reduced incidents or response times.

The best features that Huntress Managed ITDR offers include identity threat detection and monitoring, suspicious login and authentication detection, compromised account identification, privilege escalation monitoring, Microsoft 365 and identity environment visibility, managed SOC investigation and threat response, and automated remediation capabilities.

The human-led investigation and remediation aspect of Huntress Managed ITDR is important in my security operations because human-led investigation and remediation are essential for my security operations. While automated detection helps identify suspicious identity activities quickly, human expertise is crucial for understanding the context, validating threats, and avoiding unnecessary disruptions.

I assess the effectiveness of the 24/7 human-led detection and response for identity threats in Microsoft 365 environments positively because identity threats can occur outside of regular business hours, and continuous monitoring combined with expert investigation helps identify suspicious sign-ins, compromised accounts, and unusual authentication activities.

I have used the unwanted access detection feature, and it is very important because it helps improve visibility into unusual authentication activity and provides useful information for investigating potential identity-based threats, particularly in identifying suspicious sign-ins that bypass MFA.

We are using the Shadow Workflows feature, and its ability to detect attacker-created inbox rules and automation is valuable, particularly in Microsoft 365 environments, as such detection helps uncover hidden forwarding rules, automatic email redirection, and other persistent techniques used by attackers.

I consider the Rogue Apps OAuth abuse protection feature to be important for identity security, particularly in Microsoft 365 environments, as it helps identify potentially risky OAuth applications that may request excessive permissions or gain unauthorized access to organizational data.

I use the incident report timeline feature, and it provides a structured view of security events, investigation activities, and remediation steps, supporting internal audits and incident reviews by providing a clearer evidence trail.

I have utilized the mass outbound phishing detection feature, and it is effective for identifying compromised accounts that may be sending malicious emails to multiple recipients, which is especially important in Microsoft 365 environments.

Huntress Managed ITDR could be improved with broader identity provider integration, more customizable detection policies, advanced reporting, and greater flexibility in automated remediation. More detailed investigation timelines and an identity risk dashboard would also be useful.

I have been using Huntress Managed ITDR for the last one year.

Huntress Managed ITDR is stable.

In terms of scalability, it is a SaaS-based product, so its overall scalability is good.

We have not had any issues connecting with customer support, and the overall experience is good.

Previously, I relied on traditional identity monitoring with Microsoft 365 security controls and manual investigation of suspicious login activities before switching to Huntress Managed ITDR to improve identity threat detection.

In terms of return on investment, the main ROI has been operational efficiency rather than direct cost savings, as Huntress Managed ITDR helps reduce manual identity monitoring and investigation efforts through managed threat detection.

Overall, my experience with pricing, setup cost, and licensing is good. The pricing structure is straightforward, the setup cost is manageable because the solution is cloud-based, and licensing flexibility is important as the number of users and protected identities grow.

Before choosing Huntress Managed ITDR, I considered alternatives such as Microsoft Defender for Identity, Microsoft Entra ID Protection, and other identity threat detection solutions, focusing on threat detection accuracy and overall licensing cost.

On a scale of one to ten, I rate Huntress Managed ITDR an 8 out of 10.

I chose 8 out of 10 because of its strong identity threat monitoring and managed detection capabilities with opportunities to improve integration, reporting, and customization.

Regarding Huntress Managed ITDR's AI capabilities, I think its governance and security should prioritize transparency, data privacy, and secure handling of identity information, and human oversight is important for critical security decisions, especially when dealing with account suspension or access revocation. Clear audit trails and access controls are also essential.

In terms of the accuracy and reliability of Huntress Managed ITDR's AI output, AI-assisted detection helps identify unusual authentication patterns and prioritize suspicious activities, but alerts should include supporting evidence and sufficient context. I believe human validation is important before taking critical remediation actions.

Huntress Managed ITDR is deployed in my organization as a cloud-based solution, which is particularly relevant to cloud identity environments where monitoring authentication activity and account security is essential.

My advice for others looking into using Huntress Managed ITDR is to analyze your requirements and test or evaluate it on UAT platforms before implementing, as it offers valuable features.

My main use case for Huntress Managed ITDR is monitoring suspicious identity-related activities, detecting potential account compromises, and investigating unusual login behavior to help identify threats early.

One example of how I've used Huntress Managed ITDR for this was investigating an unusual login activity where a user account showed suspicious sign-in behavior. Huntress Managed ITDR helped highlight the activity, allowing me to review the login details, verify whether it was legitimate, and escalate it to the proper team for further investigation.

I also use Huntress Managed ITDR to help identify suspicious authentication patterns and potential compromised accounts. It helps improve visibility into identity-related threats and supports faster investigation and escalation, allowing the SOC team to respond to potential risks more efficiently.

Huntress Managed ITDR has improved our visibility into identity-related threats and helped our SOC team identify suspicious login activities more efficiently. It supports faster investigations, helps prioritize potential account compromises, and makes the alert triage escalation process more effective.

Huntress Managed ITDR has helped improve visibility into suspicious identity-related activities and made it easier to prioritize alerts for investigation. It supports a more efficient triage and escalation process, helping the team identify potential risks earlier. The main benefit has been improved threat visibility and a more structured investigation process.

The best features of Huntress Managed ITDR are suspicious login detection, monitoring identity-related threats, and alerts for potentially compromised accounts. I also find its threat detection and investigation capabilities useful because they help the SOC team identify unusual authentication activity, investigate potential risks, and escalate genuine threats more efficiently.

I find the alerting feature useful because it helps highlight suspicious identity activities in a timely manner. The alerts provide a good starting point for investigation, allowing me to review the activity, validate whether it is legitimate, and escalate potential threats when needed. Overall, the alerts are actionable and help our SOC team prioritize identity-related security issues.

I also find the identity threat monitoring and suspicious activity detection useful. These features help our SOC team identify potential compromises and investigate unusual behavior more efficiently. Overall, Huntress Managed ITDR provides useful visibility into identity-related threats and supports the investigation and escalation process.

I would rate the 24/7 human-led detection and response positively because it provides continuous monitoring of Microsoft 365 identity threats, helps investigate suspicious sign-ins, and supports timely alert validation and escalation. Having a security analyst review potential threats adds valuable context and helps reduce the risk of missed identity-based attacks.

I have used unwanted access detection to help identify suspicious sign-in activity that may indicate unauthorized access even when MFA is involved. It provides additional visibility into potentially compromised accounts and helps the SOC team investigate unusual authentication patterns and escalate potential threats.

I have limited hands-on experience with the Shadow Workflows feature, but it is useful for identifying suspicious inbox rules and automation that attackers may create to hide emails, redirect messages, or maintain access to compromised accounts. More detailed alerts showing the rule changes and their potential impact would make investigations easier for SOC analysts.

We have limited hands-on experience with the Rogue Apps or OAuth abuse protection feature, so I cannot provide a definitive effectiveness rating. However, detecting risky OAuth applications and suspicious permissions is valuable for identifying potential abuse of Microsoft 365 accounts. Detailed alerts highlighting excessive permissions, suspicious app activity, and potential data access would help SOC analysts investigate and escalate threats more effectively.

Human-led investigation and remediation are very important because automated alerts alone may not provide the full context of an identity-based threat. Security analysts can validate suspicious activity, distinguish legitimate behavior from potential attacks, and recommend appropriate remediation. This combination of continuous monitoring and human expertise helps improve investigation accuracy and ensures potential threats are escalated to the right team promptly.

Huntress Managed ITDR could be improved by providing more detailed alert context, clearer investigation steps, and better integration with SIEM and SOAR tools. Reducing false positives and offering more customization for alert severity would also help SOC analysts prioritize genuine threats and investigate them more efficiently.

I would also like to see more detailed incident timelines, better alert correlation, and more flexible reporting options. These improvements would help our SOC analysts understand the full context of identity-related threats, reduce manual investigation efforts, and make it easier to track security trends over time.

I think Huntress Managed ITDR's AI governance and security could be improved by providing more transparency into how AI-driven detections work, how customer data is protected, and how decisions are made. Clear documentation on data privacy, access controls, and human oversight would help build trust and ensure AI-assisted threat detection remains secure and reliable.

I find the AI capabilities useful for identifying suspicious identity activities and supporting investigations. However, accuracy and reliability depend on the quality of the alerts and available context. I would like to see fewer false positives, more transparent explanations for detections, and consistent results to help our SOC analysts make informed decisions.

I have been using Huntress Managed ITDR for approximately 1.2 years.

Huntress Managed ITDR is stable.

Huntress Managed ITDR offers good scalability for organizations that need to expand identity threat monitoring as their Microsoft 365 environment grows. Its cloud-based approach helps simplify deployment and ongoing management. However, I don't have specific metrics on performance at very large scales.

The customer support for Huntress Managed ITDR is good.

I would rate the customer support ten out of ten.

We have primarily focused on Huntress Managed ITDR for identity threat monitoring, and I don't have enough direct experience with a previous ITDR solution to compare it fairly or explain a specific switch.

I don't have exact ROI figures, but Huntress Managed ITDR helps improve efficiency by identifying suspicious identity activity earlier and reducing manual effort during alert triage. For example, timely alerts and investigation support can help analysts prioritize genuine threats faster and reduce the time spent reviewing suspicious sign-ins. This can improve security operations effectively, although I cannot quantify the financial savings or staffing impact.

My experience with pricing, setup cost, and licensing is limited as I haven't directly managed the purchasing or licensing process. From a SOC perspective, I would look for transparent pricing, flexible licensing based on the organization's needs, and a straightforward setup process with minimal maintenance overhead.

I wasn't directly involved in evaluating alternative solutions before choosing Huntress Managed ITDR, so I cannot confirm which vendors were considered. Common alternatives in the identity threat detection space include Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, and Proofpoint Identity Threat Defense.

I would rate Huntress Managed ITDR nine out of ten overall.

I chose an eight out of ten for Huntress Managed ITDR because it provides useful identity threat detection, timely alerts, and better visibility into suspicious activities. It helps SOC analysts investigate potential account compromises more efficiently. I would rate it higher if it offered more detailed alert context, fewer false positives, and stronger SIEM and SOAR integrations.

My advice to others considering Huntress Managed ITDR is to evaluate how well it fits their Microsoft 365 environment, test its identity threat detection capabilities, and review the quality of its alerts. It is also important to assess integrations with existing security tools and ensure the SOC team has clear processes for investigating and escalating suspicious activities.

I work for an MSP, specifically on a security team focused on cybersecurity. We have many clients that use Huntress Managed ITDR, and it has proven invaluable. Just the other day, a user clicked on a malicious email and had her credentials stolen. Huntress Managed ITDR stopped the attack in its tracks. By the time we received the alert, her account was already locked down by Huntress Managed ITDR, and they provided us with remediation steps along with the ticket.

We use those remediation steps to create playbooks, which helps us remediate quickly and begin our investigation process if needed. I have not seen an instance where a bad actor has been able to do anything when our clients have Huntress Managed ITDR. They stop them in their tracks. Their product delivers exactly as advertised.

We also use Arctic Wolf as a service offering. Arctic Wolf has a Microsoft 365 integration and they are competent, but I do not think they are anywhere close to Huntress Managed ITDR because Arctic Wolf is primarily a SIEM alerting platform. They can perform containment and they are very good at it, but if I had to choose between all the major vendors I have used in the past, including those we offer here, it would be Huntress Managed ITDR. The team at Huntress Managed ITDR are good people. I have gotten to know many of the folks that work there, and you cannot beat a group with that kind of passion for cybersecurity and keeping people safe. I do not say that about many people because I am very particular about both good products and good people.

Their threat analytics and process insights are exceptional. When Huntress Managed ITDR finds malware, a virus, or a phishing email, their analytics have improved significantly over time. I remember when they were not very detailed, but now they provide comprehensive information down to the specific type of dependency affected on a host machine.

They show us exactly where all the infected files are located on the computer, which makes cleanup straightforward and invaluable.

I know they partner with Microsoft, and if you have Huntress Managed ITDR and Microsoft Defender, it is truly near real-time as stated. That is a very accurate claim.

I am not entirely certain if this is a technology limitation or a technical issue, but when certain things get reported like VPNs, the information is not always accurate. When we receive an alert that is backhauled from a VPN, such as a bad actor using a VPN, we do not always get that accurate information. I would not call that a criticism of Huntress Managed ITDR. I think that is a limitation of the technology itself.

More accurate VPN details would be beneficial.

About three years.

We have experienced no stability issues. One person on our team deploys Huntress Managed ITDR, though we have a few people authorized to do so. The most we have deployed in a single week is probably 30 clients for one solution.

Once it is deployed, it updates automatically and takes care of itself. The only time it does not update is when a computer is offline or does not have an internet connection. Otherwise, it just works.

Huntress Managed ITDR scales very easily. I always become excited when they discuss a new product and how we can integrate it into our solution stack and technology stack. All of their solutions integrate well with each other and add a broader security surface area to the client overall, which keeps the client better protected.

We contacted them for assistance with deploying to Macs because it was our first time. That was the only true assistance we needed, as they had made changes due to Apple's native security features in the Apple ecosystem. After having that technical call and some troubleshooting, the deployment became very easy. They were very insightful and helpful.

Positive

We use Arctic Wolf as a service offering. Arctic Wolf has a Microsoft 365 integration and they are competent, but I do not think they are anywhere close to Huntress Managed ITDR because Arctic Wolf is primarily a SIEM alerting platform. They can perform containment and are very good at it, but if I had to choose between all the major vendors I have used in the past, including those we offer here, it would be Huntress Managed ITDR. The team at Huntress Managed ITDR are good people. I have gotten to know many of the folks that work there, and you cannot beat a group with that kind of passion for cybersecurity and keeping people safe. I do not say that about many people because I am very particular about both good products and good people.

The initial deployment is very easy. Mapping a client's environment takes longer than actually deploying a Huntress Managed ITDR agent because the deployment is extremely fast and the agent installs very easily. As soon as it is installed, we receive all the telemetry instantly, and if it finds something, we immediately receive a ticket for it. Within the first 15 minutes of an agent install, it is working, which is excellent.

We contacted them for assistance with deploying to Macs because it was our first time. That was the only true assistance we needed, as they had made changes due to Apple's native security features in the Apple ecosystem. After having that technical call and some troubleshooting, the deployment became very easy. They were very insightful.

The pricing is excellent. You will not be able to beat Huntress Managed ITDR on pricing, and that is considering the capabilities Huntress Managed ITDR provides at their price level. I know this firsthand because we conduct extensive vendor sourcing for security products. What Huntress Managed ITDR offers is incredible compared to others. You get value, and you get more value than most people realize from their products versus competitors. You would be paying 10 times as much at other competitors.

The pricing is excellent. You will not be able to beat Huntress Managed ITDR on pricing, and that is considering the capabilities Huntress Managed ITDR provides at their price level. I know this firsthand because we conduct extensive vendor sourcing for security products. What Huntress Managed ITDR offers is incredible compared to others. You get value, and you get more value than most people realize from their products versus competitors. You would be paying 10 times as much at other competitors.

We use Arctic Wolf as a service offering. Arctic Wolf has a Microsoft 365 integration and they are competent, but I do not think they are anywhere close to Huntress Managed ITDR because Arctic Wolf is primarily a SIEM alerting platform. They can perform containment and are very good at it, but if I had to choose between all the major vendors I have used in the past, including those we offer here, it would be Huntress Managed ITDR. The team at Huntress Managed ITDR are good people. I have gotten to know many of the folks that work there, and you cannot beat a group with that kind of passion for cybersecurity and keeping people safe. I do not say that about many people because I am very particular about both good products and good people.

I have experience across all tools, but primarily in MDR, ITDR, and SIEM.

More accurate VPN details would be beneficial.

The SIEM solution is becoming increasingly customizable. The real customizable alerts are part of the SIEM offering, and they are working on simplifying that for custom alerts. The most challenging aspect is creating a custom alert because it requires knowledge of KQL, which is a SIEM query language used to build those alerts. Huntress Managed ITDR is working toward simplifying this process. We have had several conversations with them about making this easier, and they understand that KQL is not an easily learned language. The capabilities do help significantly, especially for clients with specialized equipment or equipment that is not regularly used, such as disaster recovery sites. We want customizable alerts to notify us of any suspicious ingress or egress. We maintain multiple threat intelligence feeds that we constantly update, allowing us to customize those alerts to monitor ports or services being actively exploited in the wild. We continuously update our alert configurations.

We do pause auto-remediation from time to time, especially for quick-moving threats, because we want to take a deeper look. When we do this, we contact Huntress Managed ITDR support for additional insight to determine if they have encountered this type of malware or attack. We gain valuable knowledge from them that helps us update our playbooks and processes to better inform our clients about emerging threats. However, we commonly use the auto-remediation feature, and it works very well.

The pricing is excellent. You will not be able to beat Huntress Managed ITDR on pricing, and that is considering the capabilities Huntress Managed ITDR provides at their price level. I know this firsthand because we conduct extensive vendor sourcing for security products. What Huntress Managed ITDR offers is incredible compared to others. You get value, and you get more value than most people realize from their products versus competitors. You would be paying 10 times as much at other competitors.

I would rate this review a 10 out of 10.

Huntress Managed ITDR serves as another layer in my email security. I have email filtering to filter out malicious emails, but Huntress Managed ITDR is there in case anyone clicks on something or the threat actors get in another way. It provides another valuable layer of protection.

For me, the biggest strength of Huntress Managed ITDR is the human-led Security Operations Centre (SOC). There are plenty of security products using AI and machine learning to identify suspicious activity, but detecting something and knowing what to do about it are two different things.

I like the fact that Huntress combines technology with experienced security analysts who can investigate suspicious activity and respond when necessary. That 24/7 coverage is particularly valuable to me because, as a small business owner supporting other organisations, I can't be watching Microsoft 365 sign-in logs at two o'clock in the morning.

The detection of suspicious account activity and malicious OAuth applications is another important feature. In fact, I came across a phishing email sent from a compromised school account this morning. Rather than simply trying to steal a password, it directed the recipient towards a genuine Microsoft login page and attempted to trick them into granting an application extensive permissions to their Microsoft 365 environment.

That's the sort of attack that concerns me. Someone can have a strong password and MFA enabled but still be tricked into authorising a malicious application. Traditional antivirus isn't going to solve that problem.

I use Huntress's unwanted access detection and OAuth abuse protection features as additional safeguards against these sorts of attacks. I've not had any security incidents flagged in my own Microsoft 365 environment, although I've also spent considerable time securing it in the first place.

I've not yet used the shadow workspace feature, so I can't comment on that from personal experience.

Ultimately, what I value is having another set of eyes on identity security. Microsoft 365 is central to how many small businesses and schools operate, and a compromised account can cause an enormous amount of disruption. Huntress gives me additional visibility and a team of people who can help respond if something goes wrong.

The main improvement I'd like to see is closer integration between Huntress Managed ITDR and their newer Identity Security Posture Management (ISPM) offering.

ITDR is excellent at identifying suspicious activity and responding when something goes wrong, but I'd also like to see more emphasis on preventing problems in the first place. Microsoft 365 has an enormous number of security settings, and it's surprisingly easy for something to be overlooked or misconfigured.

Having the ability to identify those weaknesses, recommend changes and help put them right, alongside the existing 24/7 monitoring, would make a lot of sense to me. I'd much rather close a security gap today than investigate an attack tomorrow.

My other suggestion is around pricing, particularly for education.

I support schools where budgets are already stretched, and every additional pound spent on IT has to be justified. Per-user pricing can make ITDR difficult to afford, particularly in schools with hundreds of pupil accounts but relatively small IT budgets.

I'd love to see Huntress consider a different licensing model for education, perhaps based on the number of protected domains or a more affordable site licence.

I appreciate that monitoring 500 identities is not the same as monitoring 50, so any alternative would need to be commercially realistic. But I'd like to see protection made more accessible to schools that genuinely need it.

I believe good cyber security should be proportionate and affordable. It would be a shame if the organisations that could benefit most from this level of protection were priced out of it.

Beyond those two areas, I'm very happy with Huntress Managed ITDR and what it delivers.

I have been using Huntress Managed ITDR for approximately eighteen months.

I have never noticed any downtime with Huntress Managed ITDR, so I give them a rating of ten for stability.

Eight users work with Huntress Managed ITDR in my organization.

For technical support, I would give them a rating of nine. There is always room for improvement, but when I have contacted them, they have always been very good, very efficient, and answered my questions in the way I wanted them answered. I cannot really fault them.

Regarding return on investment, I probably have not achieved one. I am only using Huntress Managed ITDR internally at the moment, so I probably have not achieved a return on investment because I have a not-for-resale license to use it internally. Since it has not cost me anything to use, I cannot really answer that question.

From one to ten, I would say Huntress Managed ITDR falls pretty much in the middle. Huntress doesn't nickel and dime their customers. They believe in having protection for the majority of people. I would say they are not cheap and they are not expensive; they are probably pretty much in the middle.

I currently only use Huntress ITDR on their NFR licence, but hope to promote this to clients moving forward.

I have not tried the mass outbound phishing detection feature. I use an alternative product for phishing called Check Point Email Security, so I do not use that feature in Huntress Managed ITDR.

Since I use other solutions as well, when I compare Huntress Managed ITDR to other vendors and products for ITDR, I would say that I love Huntress Managed ITDR. They are a great company to work with. From Kyle, who is the co-founder at the top, to all of the representatives I speak to, they are a great company to work with. They are very supportive of partners and will do anything they can to help. I think they are one of the better companies I work with.

I actually have both relationships with Huntress Managed ITDR; I use it internally and I also sell it to my clients.

Huntress Managed ITDR is very easy to maintain. Once you have set it up, it pretty much runs itself. It is a managed service, so the Huntress Managed ITDR team is actually doing a lot of the work for you. All you need to do is authorize it in your Microsoft tenant, and then it pretty much runs itself. There is not a lot of maintenance required at all.

For anyone looking into ITDR, I would definitely recommend Huntress Managed ITDR. It is a human-led SOC using AI behind the scenes, and they are good at what they do. I do not think you can really beat Huntress Managed ITDR in this particular part of cybersecurity. I would rate this product a nine overall.

I have been working with Huntress Managed ITDR for about two months since we signed up.

The main benefits that Huntress Managed ITDR brings to the table, or how it helps improve the way the organization functions, is the defense-in-depth setup. It adds an extra layer to protect the most vulnerable part of an organization, which is the users and their identity. It allows a bit of breathing room for security teams to have this extra tool to catch any unwanted breaches or attacks to assist with small or overworked teams. Overall, it's something that each organization or company should look at investing in, and it's a great tool to have.

What I appreciate about Huntress Managed ITDR are the ease of use and the ease of setup from a management perspective. Because we're an MSP and supporting a bunch of clients, it's simple to get connected to 365 or Google. The fact that it has a 24-hour human-led SOC behind it, on top of AI automation, is also great. I know that there's at least a human looking at any of these alerts outside of us that can rein in the robots. To sum it all up: ease of use, ease of management from an MSP perspective, and it's human-centric from the report side and the security side.

This human-led investigation and remediation aspect of the solution is very important in my security. Because we deal with a lot of SMEs, I think every client we deal with is an SME, so it's under 200. We try to make a human-led experience from all of our IT stack. The fact that I know I can reach out to an actual human to further discuss security alerts and get their understanding and knowledge is great. AI is good, but it can give a lot of false information, and you're talking to a robot. So it's good to have; it's a very high priority.

What I would like to see improved or maybe enhanced in Huntress Managed ITDR is that when you first set it up for a tenant, there are a number of false positives that pop up. Once we had the onboarding call with Huntress, we were able to determine that it was just a cleanup on the 365 side of things. So there is a little bit of fine-tuning you have to do, but overall, I couldn't really think of too many other negatives.

There are no missing features that I would like to see included to Huntress Managed ITDR in the future or some functionalities that require some kind of enhancement at this moment. Because we've only been using it for a couple of months now, I think everything that it's there for and that it does is everything we need. I can't think of any feature enhancements as of yet.

I have not had any crashes, downtimes, or performance issues with Huntress Managed ITDR because it's set up as an inline SaaS solution; if it were to go down, it's not going to take down the infrastructure. I haven't seen any issues with that.

My thoughts on the scalability aspect are that because Huntress Managed ITDR is a new offering, we will be scaling it out. We're in the process of scaling it out. We have it set up for us and a couple of others, and we're now including it in our offerings. So we will be scaling out shortly, soon, I hope.

I evaluate customer service and technical support of Huntress Managed ITDR as good and great. I've had a chat with their SOC support team; they were great. The main discussions we had were during the onboarding, and the people involved were fantastic.

I did not previously use a different product for IDR. However, we have looked at other companies, such as CrowdStrike's IDR setup. We ultimately decided to use Huntress Managed ITDR as our first IDR.

The setup process and the deployment part overall for Huntress Managed ITDR is purely just connecting your tenant, whether it's 365 or Google Workspace. You need to be a super admin on either, and then you just connect that. You point Huntress Managed ITDR to the platform. Setup is simple on that side, and then you let it run for, I think, 24 hours before it starts populating data. Then, once that's on there, you clean up the false positives. More than likely, it's just the actual configuration on your identity. You adjust all that, and then once that's on, we linked it up to our ticketing platform, which we use HaloPSA. That was easy to set up. So, if we get any alerts or any critical investigations, they get sent through to our ticketing system and assigned to an engineer. Overall, it took an hour to get the general setup configured. Then we waited 24 hours until we started seeing information, and now it just runs itself. We hop in when we get alerts and check things every now and then.

We purchased Huntress Managed ITDR directly through Huntress.

I have seen measurable benefits with Huntress Managed ITDR. From a breach perspective, it has prevented several users' accounts from being potentially compromised. If we weren't informed about it and there was a data breach or money lost, I think for the general price of however much it is per user, in comparison to the cost of a breach, the ROI is pretty well guaranteed the minute you set it up. I can't give the specific numbers because I don't have those, but I just know that Huntress Managed ITDR is definitely a plus and a bonus.

I don't handle licensing. I'm on the engineer side of things. But from basic internal knowledge, Huntress Managed ITDR is a cheaper product than what we originally had. Sorry, I was thinking of IDR and security awareness training. According to the team, the licensing costs are fine. I can't give too much information on that in terms of pricing.

The key differences, both pros and cons of Huntress Managed ITDR in comparison to CrowdStrike are that I think the CrowdStrike requirements are an additional SKU, and the pricing was more. The configuration overall was a little bit more. CrowdStrike seems to be more purely at enterprise levels, whereas Huntress Managed ITDR, although it's enterprise, seems to fit into the SME/SMB environment a lot more. The initial calls that we had with Huntress Managed ITDR support team and sales team, they just did everything right.

If Huntress Managed ITDR is something that you as an organization are looking at implementing, you should. In this day and age, identity is the most important element, and having all the tools you can to lock that down for the sake of your users is a must. So, get on it. I would rate this product a 10 out of 10.

My main use case for Huntress Managed ITDR is to monitor identity-related threats, detect suspicious login activity, and identify potential account compromises. Day to day, the goal is to investigate unusual activity behavior, detect compromised credentials, and respond quickly to identity-based attacks to protect our organizational accounts and systems.

One example I can provide is detecting a successful login where an account has multiple failed login attempts, followed by a successful one from an unusual location. Using Huntress Managed ITDR, I investigate the login details, check the source IP address, review the user's recent activity, and verify whether the login is legitimate. If the activity appears malicious, I escalate the incident, secure the account, revoke their active session, and reset the password if required. This helps prevent unauthorized access and reduce the risk of further compromise.

Huntress Managed ITDR has positively impacted my organization by strengthening our identity security through improved visibility into suspicious login activities and potential account compromises. It also supports faster investigations of identity-related alerts, helps identify unusual behavior, and enables the security team to respond proactively to potential threats. Overall, it has reduced the risk of unauthorized access and improved our security capability to protect user accounts.

Since using Huntress Managed ITDR, I can assert that we have better visibility into suspicious identity activity and potential account compromises. It helps streamline investigations by providing relevant alerts and useful context, allowing us to prioritize threats and respond more efficiently. While I don't have specific metrics to quantify the improvement, better visibility and faster identification of potential identity threats are valuable for our security operations.

The best features I can point out are suspicious login detection, monitoring of identity-related threats, detection of account compromises, and alerts for unusual changes in user permissions or configurations. These features help identify potential identity attacks, investigate suspicious activity, authenticate the activity, and respond quickly to protect user accounts.

I find real-time detection of suspicious activity to be the most valuable because it helps us identify potential account compromises as early as possible. For example, if a user account shows unusual login behavior or multiple failed attempts followed by a successful login, we can investigate the activity and verify its legitimacy, taking immediate actions if necessary. This reduces the risk of unauthorized access and minimizes the potential impact of identity-based attacks.

I assess the effectiveness of the 24/7 human-led detection and response for identity threats in Microsoft 365 environments to be valuable because identity-based attacks can occur at any time. Continuous monitoring combined with human expertise helps identify suspicious sign-ins, compromised accounts, unusual mailbox activity, and unauthorized permission changes. Human-led investigation adds context to alerts and helps distinguish genuine alerts from legitimate activity. Timely investigation, clear communication, and actionable remediation recommendations are key to reducing the impact of identity-based attacks.

I have utilized the Shadow Workflows feature, and it is a valuable capability for identifying suspicious inbox rules and automation that an attacker may create after compromising a Microsoft 365 account. For example, an attacker might create an inbox rule to automatically forward mail externally or hide security alerts. Detecting these changes helps security teams investigate potential account compromises and verify whether the rules are legitimate, allowing for appropriate remediation steps. Clear alerts and detailed investigation context are important for responding quickly and reducing the risk of data theft.

I use the Rogue OAuth abuse protection feature, which is valuable for identifying potential malicious or risky OAuth applications that request excessive permissions to access Microsoft 365 data. For example, an application requesting permission to read emails or access files unnecessarily could indicate a potential security risk. Identifying such applications helps the security team investigate suspicious permissions, verify application legitimacy, and revoke access when necessary. Detailed alerts and clear remediation guidance would enhance this feature's effectiveness.

Human-led investigation and remediation are extremely important in my security operations because automated alerts alone may not provide full context for an identity threat. Experienced analysts validate suspicious activity, distinguish genuine threats from false positives, and determine appropriate responses. For example, if a compromised Microsoft 365 account has suspicious inbox rules or unauthorized OAuth permissions, human-led investigation helps confirm the threat and guides remediation, such as revoking access, terminating active sessions, and securing the account. This improves response quality and reduces the risk of further compromise.

The mass outbound phishing detection feature is valuable because it helps identify compromised accounts sending phishing emails to multiple recipients. Detecting unusual email-sending patterns quickly allows the security team to investigate affected accounts and take actions such as temporarily disabling accounts or revoking sessions and resetting credentials. Its effectiveness depends on timely detection, accurate alerts, and rapid remediation, which can help limit the spread of phishing emails and reduce the impact on the organization.

Huntress Managed ITDR could be improved by providing more detailed investigation timelines, more customizable alerts, and better integration with other security tools.

I chose a rating of nine out of ten because of the improvements that I have suggested. What keeps me from giving it a perfect ten is the need for more advanced automation, customizable alerting, and detailed investigation timelines.

I have been using Huntress Managed ITDR for one year.

Huntress Managed ITDR is quite stable. We do not experience any downtime or issues, so it is stable.

I think Huntress Managed ITDR's scalability is good. As the number of log sources increases, it quietly aligns with it. It offers a scalable approach to identify threat detection by helping organizations monitor user accounts and identify suspicious activity as the environment grows. Centralized monitoring and actionable alerts help security teams manage multiple accounts without significantly increasing manual effort. Flexible deployment, integration with Microsoft 365, and efficient alert management are important advantages for organizations expanding their security operations.

The customer support is good. Since I do not face any issues, I cannot provide an accurate assessment, but I think it will be good.

Huntress Managed ITDR can provide a positive return on investment by improving the detection of identity-based threats and reducing manual investigation efforts. Centralized alerts and actionable investigation details help analysts identify suspicious activity more effectively and respond faster. However, I do not have specific metrics such as money saved, time saved, or fewer employees needed.

I would rate Huntress Managed ITDR nine out of ten.

I believe strong governance and security are essential for AI-powered security tools. Huntress should ensure that its AI capabilities follow clear data privacy policies, protect sensitive identity information, and maintain strict access controls and transparency. Transparency about how AI is used, regular security assessments, and human oversight are also important to ensure reliable and responsible threat detection. These measures help build trust and protect the organization's data.

I believe AI capabilities can improve the accuracy and efficiency of identity threat detection by helping identify unusual login patterns and suspicious account activities. Reliability is especially important when investigating potential account compromises. Consistent results, fewer false positives, clear explanations for alerts, and human verification for critical decisions would help ensure accurate decision-making and build confidence in the platform. I think its accuracy and reliability could be good.

I recommend evaluating Huntress Managed ITDR if your organization wants to strengthen its identity security and improve visibility into suspicious account activities. Its identity threat detection, investigation support, and response capabilities can help identify potential account compromises and reduce the risk of unauthorized access. Before adopting it, assess your organization's requirements, verify integration with the existing Microsoft 365 environment, and understand the pricing and licensing options.

I use Huntress Managed ITDR to detect user activity and monitor their access.

The best features in Huntress Managed ITDR include its ability to detect which VPN the user is using. Another valuable feature is that I always get notified when a user attempts to log in from an unauthorized country.

Regarding the human detection in Huntress Managed ITDR, I would say it is 80% accurate. The analyst from Huntress is quite useful in the way they help to monitor and detect activity that I would never have seen before if I had not deployed Huntress.

I use the Unwanted Access Detection feature in Huntress Managed ITDR to detect suspicious sign-ins by location and by country. I use that to control access from my client.

I did use the Rogue Apps feature, such as the OAuth abuse protection in Huntress Managed ITDR. It helps to detect software that is not supposed to be installed by the user. I would say the accuracy of the Rogue Apps detection in Huntress Managed ITDR is 90%.

I use the incident report timeline feature in Huntress Managed ITDR. When I review an incident, I use the timeline.

In my experience with Huntress Managed ITDR, I think the timeline that is included in the report is accurate. I can base my questions on the timeline and ask the user whether they performed certain activities at that specific time.

In my opinion, Huntress Managed ITDR currently has no areas that have room for improvement. If anything could be improved in Huntress Managed ITDR, perhaps the report could provide a different kind of report that is more meaningful.

I have been working with Huntress Managed ITDR for about one year plus.

I rate the stability in Huntress Managed ITDR as nine.

Approximately 100 users use Huntress Managed ITDR. My clients using Huntress Managed ITDR include all different types and sizes. I rate scalability in Huntress Managed ITDR as 10.

I rate technical support for Huntress Managed ITDR as 10 out of 10.

I have tried Microsoft and CrowdStrike. Huntress Managed ITDR is much easier for me to use.

For return on investment with Huntress Managed ITDR, I would estimate about 20 to 25.

Regarding pricing, I find Huntress Managed ITDR much cheaper and more affordable compared to other ITDR solutions.

When comparing Huntress Managed ITDR with other solutions or other vendors, I would say it is much more straightforward and much more user-friendly compared to other solutions.

I would say it is easy to maintain Huntress Managed ITDR. I would definitely recommend Huntress Managed ITDR to other vendors because it is definitely easy to use, easy to set up, and we can get results very fast. This means the ROI also becomes faster to achieve. I rate Huntress Managed ITDR overall as 10 out of 10.

My main use case for Huntress Managed ITDR is protecting people's accounts on 365.

I use Huntress Managed ITDR to protect accounts on 365 by deploying it to all of our customer's endpoints as included in their contract, which ensures that they don't get phished or compromised. Most importantly for us, it means that we have to deal with fewer tickets and worry about things less.

The best features Huntress Managed ITDR offers are its response times and speed; compared to Defender, we find it to be much faster when detecting a compromise. It also alerts us and lets us know if we need to do anything, and if we're not available and a risky situation arises, the SOC team can take steps for us like locking the account down. If it's something minor, we don't have to interrupt the user; we can just investigate and make choices if needed.

Huntress Managed ITDR has positively impacted our organization by making it so people don't see the negative incidents anymore; they might not jump for joy at having Huntress Managed ITDR, but they certainly don't get compromised and accidentally send someone loads of money. For us, it saves a lot of work and makes people more aware of attacks and what's happening, ultimately saving us time and labor.

It's hard to quantify the savings, and I haven't got the data available, but an incident could take an hour out of an engineer's time, and a significant incident could take a business offline for hours or days, potentially compromising crucial infrastructure. However, with Huntress Managed ITDR, we don't have to deal with those scenarios because they simply don't happen.

I see improvements to the HaloPSA integration as something that could be better; it would be good to see more information in the ticket raised. Currently, it can sometimes just say there's been an incident because of a VPN login. What would be really crucial would be to see the affected user and some of the login information ahead of time so we can react faster or slower if needed.

I would also mention that we have a very large charitable customer who can't afford Huntress Managed ITDR, but they need it the most; if there was some charitable way of supplying Huntress Managed ITDR, we could really benefit from that. Additionally, education is very crucial, but they often don't have the budget or their budget is government-funded and requires bidding. If there were educational or nonprofit funding, that would be really helpful.

I have been using Huntress Managed ITDR for about three years.

Huntress Managed ITDR is stable; I don't think I've encountered any issues except maybe the website being down once for about half an hour over the years, but overall, everything is good.

Huntress Managed ITDR's scalability is very impressive, as it can be deployed in an instant with no considerations needed.

The customer support we receive is excellent; we have a good account manager who's helpful with technical questions. I've not contacted support myself, but I know someone else has, and they reported it was good.

Positive

Previously, we used Webroot for our antivirus, but we switched to Huntress EDR, which led us into Huntress Managed ITDR when it was advertised to us.

My experience with pricing, setup costs, and licensing has been pretty good; we got a good rate and continue to receive declining buy prices. We're generally kept up to date by the account managers, although I've mentioned there's no educational pricing yet, which has been mentioned before. I think more sales material and clarity on the RRP cost would be beneficial, as sometimes we have to price ourselves. I've looked at the sales material in Huntress Hub, and it's not too helpful in that regard.

Before choosing Huntress Managed ITDR, we evaluated other options, including Bitwarden.

Huntress Managed ITDR is deployed using their hosted version, which I assume is on a private cloud.

I would advise others looking into using Huntress Managed ITDR not to underestimate the importance of identity-based security; antivirus is fine, but it's all about social engineering and accessing highly privileged information. Many people aren't aware of potential incidents occurring, but Huntress Managed ITDR can look back at events to find ones that may have already happened as well as any ongoing incidents, which I feel people prefer to ignore because it causes worry. It's crucial to have full 24/7 reactive support for identity-based attacks.

I would appreciate the chance to use Huntress Managed ITDR with Google; we had one customer who was going to use it for Google but ended up moving to 365. I am happy to see they would cover other vendors as well since 365 might not always be the only provider, and if there is ever a significant change with other providers, it would be great to see that included. I would rate this product a 9 out of 10.

My main use case for Huntress Managed ITDR is to get all of our contract clients into basically a full security suite, especially after experiencing disastrous results with a bunch of Kaseya products, which led us to dump them very quickly in search of new solutions. Huntress has always been at the top of our list, and we managed to secure a deal that initially seemed too good to be true. Ultimately, we decided to fully transition everything over to Huntress because it consistently finds threats that nobody else is finding.

A specific example of how we're using Huntress Managed ITDR with our clients includes implementing it on any Microsoft 365 instance that we have, which allows us to catch numerous things that other tools miss, particularly the usage of unauthorized VPNs. When someone attempts to install a VPN such as Proton VPN without our approval, it instantly locks them out, illustrating that they cannot operate outside of our established guidelines. This situation leads to logging the event and informing the business management that the user was locked out for this reason.

Huntress Managed ITDR has positively impacted our organization by providing us with the confidence that we're effectively protected, even when clients neglect our recommendations for training sessions. Knowing that we've transitioned away from Kaseya products, which failed us during a significant ransomware incident, gives us a sense of security, as Huntress's response times have proven to be far superior.

Since switching to Huntress Managed ITDR, we've noticed time savings particularly in setup processes. By integrating Huntress Managed ITDR with our remote management tool, we streamline the installation of necessary software on new machines, ultimately improving efficiency. We maintain a 100% conversion rate for clients experiencing incidents, as they come to us seeking guidance on preventing similar situations from arising.

One of the best features that Huntress Managed ITDR offers is the ability to communicate with clients effectively. For example, when someone informs us that they will be out of the country, we can ensure they still maintain access to critical information while advising them on security precautions such as avoiding hotel VPNs. The embedded rules in Huntress Managed ITDR enable us to create exceptions based on individual circumstances, which we find invaluable.

Huntress Managed ITDR fits into our workflow by emphasizing to customers the importance of communication with us; we shouldn't just be the endpoint for reporting issues. We explain that implementing the best protective products is crucial, but just as important is educating them on how to spot phishing emails and ensuring they adhere to internal technology agreements. If they follow our instructions, the chances of encountering compromised accounts become virtually nonexistent.

I don't believe Huntress Managed ITDR can be improved significantly considering my experience with various SOC products; it stands out as the easiest and most effective solution available. The internal team is addressing shortcomings effectively, and I feel it's not my place to suggest additional fixes.

I cannot think of any specific features that need improvement or additions to Huntress Managed ITDR. If I sat down to really analyze it, perhaps I could come up with something, but nothing comes to mind at this moment.

Setting up and managing exceptions in Huntress Managed ITDR does come with challenges, primarily because we often fail to document our own processes. This leads to us contacting Huntress support frequently for assistance with issues we thought we had resolved in the past. However, their support has been excellent, often providing clear solutions and accessible knowledge base articles to assist us in better documentation practices.

I have been using Huntress Managed ITDR for about about eight months.

Huntress Managed ITDR is quite stable, providing reliable functionality without significant issues.

The scalability of Huntress Managed ITDR essentially aligns with Huntress's system capabilities. If we were to onboard a large customer base, we would coordinate with our account representative to accommodate their needs, ensuring reassurance regarding capacity.

In terms of customer support, I mostly interact with tech support, which has been positive since I've never required escalated customer support. Most of my inquiries to tech support are due to personal errors rather than product faults, which speaks to the functionality of Huntress Managed ITDR.

I chose a rating of 10 for Huntress Managed ITDR because of the ease with which I can reach support. We have an internal motto, PUFF, which stands for 'pick up the freaking phone.' If there's an urgent need for clarification, being able to talk quickly to SOC personnel is invaluable.

Previously, we used the Kaseya solution, both its EDR and Rocket Cyber products, which failed to identify basic infections or more serious threats. Our issues ranged from frequent infections to severe security breaches taking hours for them to respond. In contrast, Huntress Managed ITDR's immediate lockdown response would prevent such breaches from occurring.

While we explored other options before settling on Huntress Managed ITDR, we ultimately didn't conduct thorough evaluations because of its excellent reputation in MSP communities. The feedback we received regarding Huntress Managed ITDR's effectiveness overshadowed other competitors, leading us to choose it without hesitation.

My experience with pricing, setup cost, and licensing for Huntress Managed ITDR is positive overall. There weren't significant setup costs beyond the internal time invested in learning the product, and the licensing is clear, detailing usage and costs without any hidden fees. Although Huntress Managed ITDR is more expensive than our previous solution, its efficiency ultimately saves us money in the long run.

There's no differential impact regarding needing fewer employees, but we certainly experience time savings. Utilizing Huntress Managed ITDR allows us to review and approve remediation plans faster, alleviating the burden of manual checks, leading to a return on investment as clients who resisted our training come back after incidents asking how they could have avoided them.

Huntress Managed ITDR has positively impacted our organization by providing us with the confidence that we're effectively protected, even when clients neglect our recommendations for training sessions. Knowing that we've transitioned away from Kaseya products, which failed us during a significant ransomware incident, gives us a sense of security, as Huntress Managed ITDR's response times have proven to be far superior.

Since switching to Huntress Managed ITDR, we've noticed time savings particularly in setup processes. By integrating Huntress Managed ITDR with our remote management tool, we streamline the installation of necessary software on new machines, ultimately improving efficiency. We maintain a 100% conversion rate for clients experiencing incidents, as they come to us seeking guidance on preventing similar situations from arising.

I gave Huntress Managed ITDR a review rating of 10 out of 10.

My main use case for Huntress Managed ITDR is using it across my client base to review the Microsoft 365 threat landscape, and as part of their managed SOC, I alert for anomalies and suspicious activity and then take preventative measures.

A specific example of how I used Huntress Managed ITDR to catch or prevent a threat was when I had a client logging in from the United States last week with suspicious logins. They had a successful MFA token pass-through that came from an iPhone. I took precautions to lock that account out until I verified if the user was actually in the US or if it was a confirmed breach.

I also use Huntress Managed ITDR to protect my client's Microsoft environments as well as device threats. I identified through the Huntress agent that someone on a file server was downloading torrents, and I was able to detect and remediate that.

Huntress Managed ITDR has positively impacted my organization by allowing me to know that my Microsoft tenants are being monitored and protected through Huntress Managed ITDR, which enables my team to continue doing other parts of the job.

In terms of specific outcomes or metrics, Huntress Managed ITDR has saved my team's time, reduced incidents, and improved response speed. It has saved my technician's time because they are not having to go through and analyze logs and events. It has protected my clients in many instances, and I have been able to show that value to the client in terms of being able to protect their tenants.

The best features Huntress Managed ITDR offers include the depth of information it gives me without overwhelming me. It is quite direct and straight to the point, and it also provides remediation actions and information without needing to dig deeper. It is quite good for security engineers who are quite new; they are able to quickly pick up the ticket, understand the issue, and identify a remediation plan.

The remediation recommendations from Huntress Managed ITDR have helped my team a lot, and the guidance is clear. When I had a suspected breach for one account that had successful logins overseas, it turned out they did not have MFA enforced on their account. Huntress Managed ITDR gave me remediation steps of rotating the user's password and then enforcing MFA for that user, all in the recommendations from Huntress Managed ITDR for that incident.

Regarding Huntress Managed ITDR's AI capabilities, I think its governance and security are excellent; it allows me to make sure that my business is protecting its AI capabilities and governance within each tenant.

In terms of the accuracy and reliability of output, I think Huntress Managed ITDR is quite accurate, and it is still learning and quite new, so I think it will continue to get better over time.

The human-led investigation and remediation aspect of the solution is definitely pretty important; I want to make sure that a person is actually reviewing my incidents and catching things that AI may potentially miss.

I assess the effectiveness of the 24/7 human-led detection and response for identity threats in Microsoft 365 environments as very good; it is very good at picking up threats in a timely manner and alerting me while ensuring that I have the remediation plan right in front of me.

I have used the incident report timeline feature, and I assess its ability to provide defensible evidence for my IT teams and cyber insurance purposes as great. It allows me to see how the threat got through, what happened, and show it to my clients on how quickly it was mitigated.

For improving Huntress Managed ITDR, I think continuing to protect Microsoft tenants better and validating the alerts to verify an actual compromise or a false positive would be beneficial. This includes taking into consideration conditional access policies, and I think further enhancing their product suite would be valuable.

I have been using Huntress Managed ITDR for around six months.

Huntress Managed ITDR is stable.

In terms of scalability, I think it is very scalable; I have about 50 clients using it currently, so I believe it scales very well.

The customer support is great; I have account managers that I can contact, or I can use the general support lines as well.

On a scale of one to 10, I rate the customer support a nine.

I used to use Kaseya MDR, but I switched because I was finding inconsistencies when the SOC was actually investigating and when I was notified of an actual threat, so I needed to do something significant to resolve that.

I have seen a return on investment, and the biggest measure for me is time saved; I do not need to have security engineers or dedicated security engineers looking at my Microsoft tenants, so I can focus on my tech stack.

My experience with pricing, setup cost, and licensing was positive; there is obviously a cost to all products, but it was quite comparable to the other products I have used, and the setup cost was reasonable.

On a scale of one to 10, I rate Huntress Managed ITDR a nine.

I chose a nine out of 10 because the product just works. It has a clean, intuitive interface that gives me the information I need right in front of me, and it is an all-around solid product.

Huntress Managed ITDR is deployed in my organization primarily on a private cloud, although I do have some on-premise infrastructure as well, so it is a hybrid deployment.

I use Azure as my cloud provider.

My advice for others looking into using Huntress Managed ITDR is to roll out the entire stack with Huntress so you get full visibility into the whole product suite and just make sure you are utilizing the best Microsoft licensing available so that you can protect your clients.