Huntress Managed ITDR Reviews

My main use case for Huntress Managed ITDR is monitoring suspicious identity-related activities, detecting potential account compromises, and investigating unusual login behavior to help identify threats early.

One example of how I've used Huntress Managed ITDR for this was investigating an unusual login activity where a user account showed suspicious sign-in behavior. Huntress Managed ITDR helped highlight the activity, allowing me to review the login details, verify whether it was legitimate, and escalate it to the proper team for further investigation.

I also use Huntress Managed ITDR to help identify suspicious authentication patterns and potential compromised accounts. It helps improve visibility into identity-related threats and supports faster investigation and escalation, allowing the SOC team to respond to potential risks more efficiently.

Huntress Managed ITDR has improved our visibility into identity-related threats and helped our SOC team identify suspicious login activities more efficiently. It supports faster investigations, helps prioritize potential account compromises, and makes the alert triage escalation process more effective.

Huntress Managed ITDR has helped improve visibility into suspicious identity-related activities and made it easier to prioritize alerts for investigation. It supports a more efficient triage and escalation process, helping the team identify potential risks earlier. The main benefit has been improved threat visibility and a more structured investigation process.

The best features of Huntress Managed ITDR are suspicious login detection, monitoring identity-related threats, and alerts for potentially compromised accounts. I also find its threat detection and investigation capabilities useful because they help the SOC team identify unusual authentication activity, investigate potential risks, and escalate genuine threats more efficiently.

I find the alerting feature useful because it helps highlight suspicious identity activities in a timely manner. The alerts provide a good starting point for investigation, allowing me to review the activity, validate whether it is legitimate, and escalate potential threats when needed. Overall, the alerts are actionable and help our SOC team prioritize identity-related security issues.

I also find the identity threat monitoring and suspicious activity detection useful. These features help our SOC team identify potential compromises and investigate unusual behavior more efficiently. Overall, Huntress Managed ITDR provides useful visibility into identity-related threats and supports the investigation and escalation process.

I would rate the 24/7 human-led detection and response positively because it provides continuous monitoring of Microsoft 365 identity threats, helps investigate suspicious sign-ins, and supports timely alert validation and escalation. Having a security analyst review potential threats adds valuable context and helps reduce the risk of missed identity-based attacks.

I have used unwanted access detection to help identify suspicious sign-in activity that may indicate unauthorized access even when MFA is involved. It provides additional visibility into potentially compromised accounts and helps the SOC team investigate unusual authentication patterns and escalate potential threats.

I have limited hands-on experience with the Shadow Workflows feature, but it is useful for identifying suspicious inbox rules and automation that attackers may create to hide emails, redirect messages, or maintain access to compromised accounts. More detailed alerts showing the rule changes and their potential impact would make investigations easier for SOC analysts.

We have limited hands-on experience with the Rogue Apps or OAuth abuse protection feature, so I cannot provide a definitive effectiveness rating. However, detecting risky OAuth applications and suspicious permissions is valuable for identifying potential abuse of Microsoft 365 accounts. Detailed alerts highlighting excessive permissions, suspicious app activity, and potential data access would help SOC analysts investigate and escalate threats more effectively.

Human-led investigation and remediation are very important because automated alerts alone may not provide the full context of an identity-based threat. Security analysts can validate suspicious activity, distinguish legitimate behavior from potential attacks, and recommend appropriate remediation. This combination of continuous monitoring and human expertise helps improve investigation accuracy and ensures potential threats are escalated to the right team promptly.

Huntress Managed ITDR could be improved by providing more detailed alert context, clearer investigation steps, and better integration with SIEM and SOAR tools. Reducing false positives and offering more customization for alert severity would also help SOC analysts prioritize genuine threats and investigate them more efficiently.

I would also like to see more detailed incident timelines, better alert correlation, and more flexible reporting options. These improvements would help our SOC analysts understand the full context of identity-related threats, reduce manual investigation efforts, and make it easier to track security trends over time.

I think Huntress Managed ITDR's AI governance and security could be improved by providing more transparency into how AI-driven detections work, how customer data is protected, and how decisions are made. Clear documentation on data privacy, access controls, and human oversight would help build trust and ensure AI-assisted threat detection remains secure and reliable.

I find the AI capabilities useful for identifying suspicious identity activities and supporting investigations. However, accuracy and reliability depend on the quality of the alerts and available context. I would like to see fewer false positives, more transparent explanations for detections, and consistent results to help our SOC analysts make informed decisions.

I have been using Huntress Managed ITDR for approximately 1.2 years.

Huntress Managed ITDR is stable.

Huntress Managed ITDR offers good scalability for organizations that need to expand identity threat monitoring as their Microsoft 365 environment grows. Its cloud-based approach helps simplify deployment and ongoing management. However, I don't have specific metrics on performance at very large scales.

The customer support for Huntress Managed ITDR is good.

I would rate the customer support ten out of ten.

We have primarily focused on Huntress Managed ITDR for identity threat monitoring, and I don't have enough direct experience with a previous ITDR solution to compare it fairly or explain a specific switch.

I don't have exact ROI figures, but Huntress Managed ITDR helps improve efficiency by identifying suspicious identity activity earlier and reducing manual effort during alert triage. For example, timely alerts and investigation support can help analysts prioritize genuine threats faster and reduce the time spent reviewing suspicious sign-ins. This can improve security operations effectively, although I cannot quantify the financial savings or staffing impact.

My experience with pricing, setup cost, and licensing is limited as I haven't directly managed the purchasing or licensing process. From a SOC perspective, I would look for transparent pricing, flexible licensing based on the organization's needs, and a straightforward setup process with minimal maintenance overhead.

I wasn't directly involved in evaluating alternative solutions before choosing Huntress Managed ITDR, so I cannot confirm which vendors were considered. Common alternatives in the identity threat detection space include Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, and Proofpoint Identity Threat Defense.

I would rate Huntress Managed ITDR nine out of ten overall.

I chose an eight out of ten for Huntress Managed ITDR because it provides useful identity threat detection, timely alerts, and better visibility into suspicious activities. It helps SOC analysts investigate potential account compromises more efficiently. I would rate it higher if it offered more detailed alert context, fewer false positives, and stronger SIEM and SOAR integrations.

My advice to others considering Huntress Managed ITDR is to evaluate how well it fits their Microsoft 365 environment, test its identity threat detection capabilities, and review the quality of its alerts. It is also important to assess integrations with existing security tools and ensure the SOC team has clear processes for investigating and escalating suspicious activities.

I work for an MSP, specifically on a security team focused on cybersecurity. We have many clients that use Huntress Managed ITDR, and it has proven invaluable. Just the other day, a user clicked on a malicious email and had her credentials stolen. Huntress Managed ITDR stopped the attack in its tracks. By the time we received the alert, her account was already locked down by Huntress Managed ITDR, and they provided us with remediation steps along with the ticket.

We use those remediation steps to create playbooks, which helps us remediate quickly and begin our investigation process if needed. I have not seen an instance where a bad actor has been able to do anything when our clients have Huntress Managed ITDR. They stop them in their tracks. Their product delivers exactly as advertised.

We also use Arctic Wolf as a service offering. Arctic Wolf has a Microsoft 365 integration and they are competent, but I do not think they are anywhere close to Huntress Managed ITDR because Arctic Wolf is primarily a SIEM alerting platform. They can perform containment and they are very good at it, but if I had to choose between all the major vendors I have used in the past, including those we offer here, it would be Huntress Managed ITDR. The team at Huntress Managed ITDR are good people. I have gotten to know many of the folks that work there, and you cannot beat a group with that kind of passion for cybersecurity and keeping people safe. I do not say that about many people because I am very particular about both good products and good people.

Their threat analytics and process insights are exceptional. When Huntress Managed ITDR finds malware, a virus, or a phishing email, their analytics have improved significantly over time. I remember when they were not very detailed, but now they provide comprehensive information down to the specific type of dependency affected on a host machine.

They show us exactly where all the infected files are located on the computer, which makes cleanup straightforward and invaluable.

I know they partner with Microsoft, and if you have Huntress Managed ITDR and Microsoft Defender, it is truly near real-time as stated. That is a very accurate claim.

I am not entirely certain if this is a technology limitation or a technical issue, but when certain things get reported like VPNs, the information is not always accurate. When we receive an alert that is backhauled from a VPN, such as a bad actor using a VPN, we do not always get that accurate information. I would not call that a criticism of Huntress Managed ITDR. I think that is a limitation of the technology itself.

More accurate VPN details would be beneficial.

About three years.

We have experienced no stability issues. One person on our team deploys Huntress Managed ITDR, though we have a few people authorized to do so. The most we have deployed in a single week is probably 30 clients for one solution.

Once it is deployed, it updates automatically and takes care of itself. The only time it does not update is when a computer is offline or does not have an internet connection. Otherwise, it just works.

Huntress Managed ITDR scales very easily. I always become excited when they discuss a new product and how we can integrate it into our solution stack and technology stack. All of their solutions integrate well with each other and add a broader security surface area to the client overall, which keeps the client better protected.

We contacted them for assistance with deploying to Macs because it was our first time. That was the only true assistance we needed, as they had made changes due to Apple's native security features in the Apple ecosystem. After having that technical call and some troubleshooting, the deployment became very easy. They were very insightful and helpful.

Positive

We use Arctic Wolf as a service offering. Arctic Wolf has a Microsoft 365 integration and they are competent, but I do not think they are anywhere close to Huntress Managed ITDR because Arctic Wolf is primarily a SIEM alerting platform. They can perform containment and are very good at it, but if I had to choose between all the major vendors I have used in the past, including those we offer here, it would be Huntress Managed ITDR. The team at Huntress Managed ITDR are good people. I have gotten to know many of the folks that work there, and you cannot beat a group with that kind of passion for cybersecurity and keeping people safe. I do not say that about many people because I am very particular about both good products and good people.

The initial deployment is very easy. Mapping a client's environment takes longer than actually deploying a Huntress Managed ITDR agent because the deployment is extremely fast and the agent installs very easily. As soon as it is installed, we receive all the telemetry instantly, and if it finds something, we immediately receive a ticket for it. Within the first 15 minutes of an agent install, it is working, which is excellent.

We contacted them for assistance with deploying to Macs because it was our first time. That was the only true assistance we needed, as they had made changes due to Apple's native security features in the Apple ecosystem. After having that technical call and some troubleshooting, the deployment became very easy. They were very insightful.

The pricing is excellent. You will not be able to beat Huntress Managed ITDR on pricing, and that is considering the capabilities Huntress Managed ITDR provides at their price level. I know this firsthand because we conduct extensive vendor sourcing for security products. What Huntress Managed ITDR offers is incredible compared to others. You get value, and you get more value than most people realize from their products versus competitors. You would be paying 10 times as much at other competitors.

The pricing is excellent. You will not be able to beat Huntress Managed ITDR on pricing, and that is considering the capabilities Huntress Managed ITDR provides at their price level. I know this firsthand because we conduct extensive vendor sourcing for security products. What Huntress Managed ITDR offers is incredible compared to others. You get value, and you get more value than most people realize from their products versus competitors. You would be paying 10 times as much at other competitors.

We use Arctic Wolf as a service offering. Arctic Wolf has a Microsoft 365 integration and they are competent, but I do not think they are anywhere close to Huntress Managed ITDR because Arctic Wolf is primarily a SIEM alerting platform. They can perform containment and are very good at it, but if I had to choose between all the major vendors I have used in the past, including those we offer here, it would be Huntress Managed ITDR. The team at Huntress Managed ITDR are good people. I have gotten to know many of the folks that work there, and you cannot beat a group with that kind of passion for cybersecurity and keeping people safe. I do not say that about many people because I am very particular about both good products and good people.

I have experience across all tools, but primarily in MDR, ITDR, and SIEM.

More accurate VPN details would be beneficial.

The SIEM solution is becoming increasingly customizable. The real customizable alerts are part of the SIEM offering, and they are working on simplifying that for custom alerts. The most challenging aspect is creating a custom alert because it requires knowledge of KQL, which is a SIEM query language used to build those alerts. Huntress Managed ITDR is working toward simplifying this process. We have had several conversations with them about making this easier, and they understand that KQL is not an easily learned language. The capabilities do help significantly, especially for clients with specialized equipment or equipment that is not regularly used, such as disaster recovery sites. We want customizable alerts to notify us of any suspicious ingress or egress. We maintain multiple threat intelligence feeds that we constantly update, allowing us to customize those alerts to monitor ports or services being actively exploited in the wild. We continuously update our alert configurations.

We do pause auto-remediation from time to time, especially for quick-moving threats, because we want to take a deeper look. When we do this, we contact Huntress Managed ITDR support for additional insight to determine if they have encountered this type of malware or attack. We gain valuable knowledge from them that helps us update our playbooks and processes to better inform our clients about emerging threats. However, we commonly use the auto-remediation feature, and it works very well.

The pricing is excellent. You will not be able to beat Huntress Managed ITDR on pricing, and that is considering the capabilities Huntress Managed ITDR provides at their price level. I know this firsthand because we conduct extensive vendor sourcing for security products. What Huntress Managed ITDR offers is incredible compared to others. You get value, and you get more value than most people realize from their products versus competitors. You would be paying 10 times as much at other competitors.

I would rate this review a 10 out of 10.

Huntress Managed ITDR serves as another layer in my email security. I have email filtering to filter out malicious emails, but Huntress Managed ITDR is there in case anyone clicks on something or the threat actors get in another way. It provides another valuable layer of protection.

For me, the biggest strength of Huntress Managed ITDR is the human-led Security Operations Centre (SOC). There are plenty of security products using AI and machine learning to identify suspicious activity, but detecting something and knowing what to do about it are two different things.

I like the fact that Huntress combines technology with experienced security analysts who can investigate suspicious activity and respond when necessary. That 24/7 coverage is particularly valuable to me because, as a small business owner supporting other organisations, I can't be watching Microsoft 365 sign-in logs at two o'clock in the morning.

The detection of suspicious account activity and malicious OAuth applications is another important feature. In fact, I came across a phishing email sent from a compromised school account this morning. Rather than simply trying to steal a password, it directed the recipient towards a genuine Microsoft login page and attempted to trick them into granting an application extensive permissions to their Microsoft 365 environment.

That's the sort of attack that concerns me. Someone can have a strong password and MFA enabled but still be tricked into authorising a malicious application. Traditional antivirus isn't going to solve that problem.

I use Huntress's unwanted access detection and OAuth abuse protection features as additional safeguards against these sorts of attacks. I've not had any security incidents flagged in my own Microsoft 365 environment, although I've also spent considerable time securing it in the first place.

I've not yet used the shadow workspace feature, so I can't comment on that from personal experience.

Ultimately, what I value is having another set of eyes on identity security. Microsoft 365 is central to how many small businesses and schools operate, and a compromised account can cause an enormous amount of disruption. Huntress gives me additional visibility and a team of people who can help respond if something goes wrong.

The main improvement I'd like to see is closer integration between Huntress Managed ITDR and their newer Identity Security Posture Management (ISPM) offering.

ITDR is excellent at identifying suspicious activity and responding when something goes wrong, but I'd also like to see more emphasis on preventing problems in the first place. Microsoft 365 has an enormous number of security settings, and it's surprisingly easy for something to be overlooked or misconfigured.

Having the ability to identify those weaknesses, recommend changes and help put them right, alongside the existing 24/7 monitoring, would make a lot of sense to me. I'd much rather close a security gap today than investigate an attack tomorrow.

My other suggestion is around pricing, particularly for education.

I support schools where budgets are already stretched, and every additional pound spent on IT has to be justified. Per-user pricing can make ITDR difficult to afford, particularly in schools with hundreds of pupil accounts but relatively small IT budgets.

I'd love to see Huntress consider a different licensing model for education, perhaps based on the number of protected domains or a more affordable site licence.

I appreciate that monitoring 500 identities is not the same as monitoring 50, so any alternative would need to be commercially realistic. But I'd like to see protection made more accessible to schools that genuinely need it.

I believe good cyber security should be proportionate and affordable. It would be a shame if the organisations that could benefit most from this level of protection were priced out of it.

Beyond those two areas, I'm very happy with Huntress Managed ITDR and what it delivers.

I have been using Huntress Managed ITDR for approximately eighteen months.

I have never noticed any downtime with Huntress Managed ITDR, so I give them a rating of ten for stability.

Eight users work with Huntress Managed ITDR in my organization.

For technical support, I would give them a rating of nine. There is always room for improvement, but when I have contacted them, they have always been very good, very efficient, and answered my questions in the way I wanted them answered. I cannot really fault them.

Regarding return on investment, I probably have not achieved one. I am only using Huntress Managed ITDR internally at the moment, so I probably have not achieved a return on investment because I have a not-for-resale license to use it internally. Since it has not cost me anything to use, I cannot really answer that question.

From one to ten, I would say Huntress Managed ITDR falls pretty much in the middle. Huntress doesn't nickel and dime their customers. They believe in having protection for the majority of people. I would say they are not cheap and they are not expensive; they are probably pretty much in the middle.

I currently only use Huntress ITDR on their NFR licence, but hope to promote this to clients moving forward.

I have not tried the mass outbound phishing detection feature. I use an alternative product for phishing called Check Point Email Security, so I do not use that feature in Huntress Managed ITDR.

Since I use other solutions as well, when I compare Huntress Managed ITDR to other vendors and products for ITDR, I would say that I love Huntress Managed ITDR. They are a great company to work with. From Kyle, who is the co-founder at the top, to all of the representatives I speak to, they are a great company to work with. They are very supportive of partners and will do anything they can to help. I think they are one of the better companies I work with.

I actually have both relationships with Huntress Managed ITDR; I use it internally and I also sell it to my clients.

Huntress Managed ITDR is very easy to maintain. Once you have set it up, it pretty much runs itself. It is a managed service, so the Huntress Managed ITDR team is actually doing a lot of the work for you. All you need to do is authorize it in your Microsoft tenant, and then it pretty much runs itself. There is not a lot of maintenance required at all.

For anyone looking into ITDR, I would definitely recommend Huntress Managed ITDR. It is a human-led SOC using AI behind the scenes, and they are good at what they do. I do not think you can really beat Huntress Managed ITDR in this particular part of cybersecurity. I would rate this product a nine overall.

I have been working with Huntress Managed ITDR for about two months since we signed up.

The main benefits that Huntress Managed ITDR brings to the table, or how it helps improve the way the organization functions, is the defense-in-depth setup. It adds an extra layer to protect the most vulnerable part of an organization, which is the users and their identity. It allows a bit of breathing room for security teams to have this extra tool to catch any unwanted breaches or attacks to assist with small or overworked teams. Overall, it's something that each organization or company should look at investing in, and it's a great tool to have.

What I appreciate about Huntress Managed ITDR are the ease of use and the ease of setup from a management perspective. Because we're an MSP and supporting a bunch of clients, it's simple to get connected to 365 or Google. The fact that it has a 24-hour human-led SOC behind it, on top of AI automation, is also great. I know that there's at least a human looking at any of these alerts outside of us that can rein in the robots. To sum it all up: ease of use, ease of management from an MSP perspective, and it's human-centric from the report side and the security side.

This human-led investigation and remediation aspect of the solution is very important in my security. Because we deal with a lot of SMEs, I think every client we deal with is an SME, so it's under 200. We try to make a human-led experience from all of our IT stack. The fact that I know I can reach out to an actual human to further discuss security alerts and get their understanding and knowledge is great. AI is good, but it can give a lot of false information, and you're talking to a robot. So it's good to have; it's a very high priority.

What I would like to see improved or maybe enhanced in Huntress Managed ITDR is that when you first set it up for a tenant, there are a number of false positives that pop up. Once we had the onboarding call with Huntress, we were able to determine that it was just a cleanup on the 365 side of things. So there is a little bit of fine-tuning you have to do, but overall, I couldn't really think of too many other negatives.

There are no missing features that I would like to see included to Huntress Managed ITDR in the future or some functionalities that require some kind of enhancement at this moment. Because we've only been using it for a couple of months now, I think everything that it's there for and that it does is everything we need. I can't think of any feature enhancements as of yet.

I have not had any crashes, downtimes, or performance issues with Huntress Managed ITDR because it's set up as an inline SaaS solution; if it were to go down, it's not going to take down the infrastructure. I haven't seen any issues with that.

My thoughts on the scalability aspect are that because Huntress Managed ITDR is a new offering, we will be scaling it out. We're in the process of scaling it out. We have it set up for us and a couple of others, and we're now including it in our offerings. So we will be scaling out shortly, soon, I hope.

I evaluate customer service and technical support of Huntress Managed ITDR as good and great. I've had a chat with their SOC support team; they were great. The main discussions we had were during the onboarding, and the people involved were fantastic.

I did not previously use a different product for IDR. However, we have looked at other companies, such as CrowdStrike's IDR setup. We ultimately decided to use Huntress Managed ITDR as our first IDR.

The setup process and the deployment part overall for Huntress Managed ITDR is purely just connecting your tenant, whether it's 365 or Google Workspace. You need to be a super admin on either, and then you just connect that. You point Huntress Managed ITDR to the platform. Setup is simple on that side, and then you let it run for, I think, 24 hours before it starts populating data. Then, once that's on there, you clean up the false positives. More than likely, it's just the actual configuration on your identity. You adjust all that, and then once that's on, we linked it up to our ticketing platform, which we use HaloPSA. That was easy to set up. So, if we get any alerts or any critical investigations, they get sent through to our ticketing system and assigned to an engineer. Overall, it took an hour to get the general setup configured. Then we waited 24 hours until we started seeing information, and now it just runs itself. We hop in when we get alerts and check things every now and then.

We purchased Huntress Managed ITDR directly through Huntress.

I have seen measurable benefits with Huntress Managed ITDR. From a breach perspective, it has prevented several users' accounts from being potentially compromised. If we weren't informed about it and there was a data breach or money lost, I think for the general price of however much it is per user, in comparison to the cost of a breach, the ROI is pretty well guaranteed the minute you set it up. I can't give the specific numbers because I don't have those, but I just know that Huntress Managed ITDR is definitely a plus and a bonus.

I don't handle licensing. I'm on the engineer side of things. But from basic internal knowledge, Huntress Managed ITDR is a cheaper product than what we originally had. Sorry, I was thinking of IDR and security awareness training. According to the team, the licensing costs are fine. I can't give too much information on that in terms of pricing.

The key differences, both pros and cons of Huntress Managed ITDR in comparison to CrowdStrike are that I think the CrowdStrike requirements are an additional SKU, and the pricing was more. The configuration overall was a little bit more. CrowdStrike seems to be more purely at enterprise levels, whereas Huntress Managed ITDR, although it's enterprise, seems to fit into the SME/SMB environment a lot more. The initial calls that we had with Huntress Managed ITDR support team and sales team, they just did everything right.

If Huntress Managed ITDR is something that you as an organization are looking at implementing, you should. In this day and age, identity is the most important element, and having all the tools you can to lock that down for the sake of your users is a must. So, get on it. I would rate this product a 10 out of 10.

My main use case for Huntress Managed ITDR is to monitor identity-related threats, detect suspicious login activity, and identify potential account compromises. Day to day, the goal is to investigate unusual activity behavior, detect compromised credentials, and respond quickly to identity-based attacks to protect our organizational accounts and systems.

One example I can provide is detecting a successful login where an account has multiple failed login attempts, followed by a successful one from an unusual location. Using Huntress Managed ITDR, I investigate the login details, check the source IP address, review the user's recent activity, and verify whether the login is legitimate. If the activity appears malicious, I escalate the incident, secure the account, revoke their active session, and reset the password if required. This helps prevent unauthorized access and reduce the risk of further compromise.

Huntress Managed ITDR has positively impacted my organization by strengthening our identity security through improved visibility into suspicious login activities and potential account compromises. It also supports faster investigations of identity-related alerts, helps identify unusual behavior, and enables the security team to respond proactively to potential threats. Overall, it has reduced the risk of unauthorized access and improved our security capability to protect user accounts.

Since using Huntress Managed ITDR, I can assert that we have better visibility into suspicious identity activity and potential account compromises. It helps streamline investigations by providing relevant alerts and useful context, allowing us to prioritize threats and respond more efficiently. While I don't have specific metrics to quantify the improvement, better visibility and faster identification of potential identity threats are valuable for our security operations.

The best features I can point out are suspicious login detection, monitoring of identity-related threats, detection of account compromises, and alerts for unusual changes in user permissions or configurations. These features help identify potential identity attacks, investigate suspicious activity, authenticate the activity, and respond quickly to protect user accounts.

I find real-time detection of suspicious activity to be the most valuable because it helps us identify potential account compromises as early as possible. For example, if a user account shows unusual login behavior or multiple failed attempts followed by a successful login, we can investigate the activity and verify its legitimacy, taking immediate actions if necessary. This reduces the risk of unauthorized access and minimizes the potential impact of identity-based attacks.

I assess the effectiveness of the 24/7 human-led detection and response for identity threats in Microsoft 365 environments to be valuable because identity-based attacks can occur at any time. Continuous monitoring combined with human expertise helps identify suspicious sign-ins, compromised accounts, unusual mailbox activity, and unauthorized permission changes. Human-led investigation adds context to alerts and helps distinguish genuine alerts from legitimate activity. Timely investigation, clear communication, and actionable remediation recommendations are key to reducing the impact of identity-based attacks.

I have utilized the Shadow Workflows feature, and it is a valuable capability for identifying suspicious inbox rules and automation that an attacker may create after compromising a Microsoft 365 account. For example, an attacker might create an inbox rule to automatically forward mail externally or hide security alerts. Detecting these changes helps security teams investigate potential account compromises and verify whether the rules are legitimate, allowing for appropriate remediation steps. Clear alerts and detailed investigation context are important for responding quickly and reducing the risk of data theft.

I use the Rogue OAuth abuse protection feature, which is valuable for identifying potential malicious or risky OAuth applications that request excessive permissions to access Microsoft 365 data. For example, an application requesting permission to read emails or access files unnecessarily could indicate a potential security risk. Identifying such applications helps the security team investigate suspicious permissions, verify application legitimacy, and revoke access when necessary. Detailed alerts and clear remediation guidance would enhance this feature's effectiveness.

Human-led investigation and remediation are extremely important in my security operations because automated alerts alone may not provide full context for an identity threat. Experienced analysts validate suspicious activity, distinguish genuine threats from false positives, and determine appropriate responses. For example, if a compromised Microsoft 365 account has suspicious inbox rules or unauthorized OAuth permissions, human-led investigation helps confirm the threat and guides remediation, such as revoking access, terminating active sessions, and securing the account. This improves response quality and reduces the risk of further compromise.

The mass outbound phishing detection feature is valuable because it helps identify compromised accounts sending phishing emails to multiple recipients. Detecting unusual email-sending patterns quickly allows the security team to investigate affected accounts and take actions such as temporarily disabling accounts or revoking sessions and resetting credentials. Its effectiveness depends on timely detection, accurate alerts, and rapid remediation, which can help limit the spread of phishing emails and reduce the impact on the organization.

Huntress Managed ITDR could be improved by providing more detailed investigation timelines, more customizable alerts, and better integration with other security tools.

I chose a rating of nine out of ten because of the improvements that I have suggested. What keeps me from giving it a perfect ten is the need for more advanced automation, customizable alerting, and detailed investigation timelines.

I have been using Huntress Managed ITDR for one year.

Huntress Managed ITDR is quite stable. We do not experience any downtime or issues, so it is stable.

I think Huntress Managed ITDR's scalability is good. As the number of log sources increases, it quietly aligns with it. It offers a scalable approach to identify threat detection by helping organizations monitor user accounts and identify suspicious activity as the environment grows. Centralized monitoring and actionable alerts help security teams manage multiple accounts without significantly increasing manual effort. Flexible deployment, integration with Microsoft 365, and efficient alert management are important advantages for organizations expanding their security operations.

The customer support is good. Since I do not face any issues, I cannot provide an accurate assessment, but I think it will be good.

Huntress Managed ITDR can provide a positive return on investment by improving the detection of identity-based threats and reducing manual investigation efforts. Centralized alerts and actionable investigation details help analysts identify suspicious activity more effectively and respond faster. However, I do not have specific metrics such as money saved, time saved, or fewer employees needed.

I would rate Huntress Managed ITDR nine out of ten.

I believe strong governance and security are essential for AI-powered security tools. Huntress should ensure that its AI capabilities follow clear data privacy policies, protect sensitive identity information, and maintain strict access controls and transparency. Transparency about how AI is used, regular security assessments, and human oversight are also important to ensure reliable and responsible threat detection. These measures help build trust and protect the organization's data.

I believe AI capabilities can improve the accuracy and efficiency of identity threat detection by helping identify unusual login patterns and suspicious account activities. Reliability is especially important when investigating potential account compromises. Consistent results, fewer false positives, clear explanations for alerts, and human verification for critical decisions would help ensure accurate decision-making and build confidence in the platform. I think its accuracy and reliability could be good.

I recommend evaluating Huntress Managed ITDR if your organization wants to strengthen its identity security and improve visibility into suspicious account activities. Its identity threat detection, investigation support, and response capabilities can help identify potential account compromises and reduce the risk of unauthorized access. Before adopting it, assess your organization's requirements, verify integration with the existing Microsoft 365 environment, and understand the pricing and licensing options.

My main use case for Huntress Managed ITDR is protecting people's accounts on 365.

I use Huntress Managed ITDR to protect accounts on 365 by deploying it to all of our customer's endpoints as included in their contract, which ensures that they don't get phished or compromised. Most importantly for us, it means that we have to deal with fewer tickets and worry about things less.

The best features Huntress Managed ITDR offers are its response times and speed; compared to Defender, we find it to be much faster when detecting a compromise. It also alerts us and lets us know if we need to do anything, and if we're not available and a risky situation arises, the SOC team can take steps for us like locking the account down. If it's something minor, we don't have to interrupt the user; we can just investigate and make choices if needed.

Huntress Managed ITDR has positively impacted our organization by making it so people don't see the negative incidents anymore; they might not jump for joy at having Huntress Managed ITDR, but they certainly don't get compromised and accidentally send someone loads of money. For us, it saves a lot of work and makes people more aware of attacks and what's happening, ultimately saving us time and labor.

It's hard to quantify the savings, and I haven't got the data available, but an incident could take an hour out of an engineer's time, and a significant incident could take a business offline for hours or days, potentially compromising crucial infrastructure. However, with Huntress Managed ITDR, we don't have to deal with those scenarios because they simply don't happen.

I see improvements to the HaloPSA integration as something that could be better; it would be good to see more information in the ticket raised. Currently, it can sometimes just say there's been an incident because of a VPN login. What would be really crucial would be to see the affected user and some of the login information ahead of time so we can react faster or slower if needed.

I would also mention that we have a very large charitable customer who can't afford Huntress Managed ITDR, but they need it the most; if there was some charitable way of supplying Huntress Managed ITDR, we could really benefit from that. Additionally, education is very crucial, but they often don't have the budget or their budget is government-funded and requires bidding. If there were educational or nonprofit funding, that would be really helpful.

I have been using Huntress Managed ITDR for about three years.

Huntress Managed ITDR is stable; I don't think I've encountered any issues except maybe the website being down once for about half an hour over the years, but overall, everything is good.

Huntress Managed ITDR's scalability is very impressive, as it can be deployed in an instant with no considerations needed.

The customer support we receive is excellent; we have a good account manager who's helpful with technical questions. I've not contacted support myself, but I know someone else has, and they reported it was good.

Positive

Previously, we used Webroot for our antivirus, but we switched to Huntress EDR, which led us into Huntress Managed ITDR when it was advertised to us.

My experience with pricing, setup costs, and licensing has been pretty good; we got a good rate and continue to receive declining buy prices. We're generally kept up to date by the account managers, although I've mentioned there's no educational pricing yet, which has been mentioned before. I think more sales material and clarity on the RRP cost would be beneficial, as sometimes we have to price ourselves. I've looked at the sales material in Huntress Hub, and it's not too helpful in that regard.

Before choosing Huntress Managed ITDR, we evaluated other options, including Bitwarden.

Huntress Managed ITDR is deployed using their hosted version, which I assume is on a private cloud.

I would advise others looking into using Huntress Managed ITDR not to underestimate the importance of identity-based security; antivirus is fine, but it's all about social engineering and accessing highly privileged information. Many people aren't aware of potential incidents occurring, but Huntress Managed ITDR can look back at events to find ones that may have already happened as well as any ongoing incidents, which I feel people prefer to ignore because it causes worry. It's crucial to have full 24/7 reactive support for identity-based attacks.

I would appreciate the chance to use Huntress Managed ITDR with Google; we had one customer who was going to use it for Google but ended up moving to 365. I am happy to see they would cover other vendors as well since 365 might not always be the only provider, and if there is ever a significant change with other providers, it would be great to see that included. I would rate this product a 9 out of 10.

My main use case for Huntress Managed ITDR is to get all of our contract clients into basically a full security suite, especially after experiencing disastrous results with a bunch of Kaseya products, which led us to dump them very quickly in search of new solutions. Huntress has always been at the top of our list, and we managed to secure a deal that initially seemed too good to be true. Ultimately, we decided to fully transition everything over to Huntress because it consistently finds threats that nobody else is finding.

A specific example of how we're using Huntress Managed ITDR with our clients includes implementing it on any Microsoft 365 instance that we have, which allows us to catch numerous things that other tools miss, particularly the usage of unauthorized VPNs. When someone attempts to install a VPN such as Proton VPN without our approval, it instantly locks them out, illustrating that they cannot operate outside of our established guidelines. This situation leads to logging the event and informing the business management that the user was locked out for this reason.

Huntress Managed ITDR has positively impacted our organization by providing us with the confidence that we're effectively protected, even when clients neglect our recommendations for training sessions. Knowing that we've transitioned away from Kaseya products, which failed us during a significant ransomware incident, gives us a sense of security, as Huntress's response times have proven to be far superior.

Since switching to Huntress Managed ITDR, we've noticed time savings particularly in setup processes. By integrating Huntress Managed ITDR with our remote management tool, we streamline the installation of necessary software on new machines, ultimately improving efficiency. We maintain a 100% conversion rate for clients experiencing incidents, as they come to us seeking guidance on preventing similar situations from arising.

One of the best features that Huntress Managed ITDR offers is the ability to communicate with clients effectively. For example, when someone informs us that they will be out of the country, we can ensure they still maintain access to critical information while advising them on security precautions such as avoiding hotel VPNs. The embedded rules in Huntress Managed ITDR enable us to create exceptions based on individual circumstances, which we find invaluable.

Huntress Managed ITDR fits into our workflow by emphasizing to customers the importance of communication with us; we shouldn't just be the endpoint for reporting issues. We explain that implementing the best protective products is crucial, but just as important is educating them on how to spot phishing emails and ensuring they adhere to internal technology agreements. If they follow our instructions, the chances of encountering compromised accounts become virtually nonexistent.

I don't believe Huntress Managed ITDR can be improved significantly considering my experience with various SOC products; it stands out as the easiest and most effective solution available. The internal team is addressing shortcomings effectively, and I feel it's not my place to suggest additional fixes.

I cannot think of any specific features that need improvement or additions to Huntress Managed ITDR. If I sat down to really analyze it, perhaps I could come up with something, but nothing comes to mind at this moment.

Setting up and managing exceptions in Huntress Managed ITDR does come with challenges, primarily because we often fail to document our own processes. This leads to us contacting Huntress support frequently for assistance with issues we thought we had resolved in the past. However, their support has been excellent, often providing clear solutions and accessible knowledge base articles to assist us in better documentation practices.

I have been using Huntress Managed ITDR for about about eight months.

Huntress Managed ITDR is quite stable, providing reliable functionality without significant issues.

The scalability of Huntress Managed ITDR essentially aligns with Huntress's system capabilities. If we were to onboard a large customer base, we would coordinate with our account representative to accommodate their needs, ensuring reassurance regarding capacity.

In terms of customer support, I mostly interact with tech support, which has been positive since I've never required escalated customer support. Most of my inquiries to tech support are due to personal errors rather than product faults, which speaks to the functionality of Huntress Managed ITDR.

I chose a rating of 10 for Huntress Managed ITDR because of the ease with which I can reach support. We have an internal motto, PUFF, which stands for 'pick up the freaking phone.' If there's an urgent need for clarification, being able to talk quickly to SOC personnel is invaluable.

Previously, we used the Kaseya solution, both its EDR and Rocket Cyber products, which failed to identify basic infections or more serious threats. Our issues ranged from frequent infections to severe security breaches taking hours for them to respond. In contrast, Huntress Managed ITDR's immediate lockdown response would prevent such breaches from occurring.

While we explored other options before settling on Huntress Managed ITDR, we ultimately didn't conduct thorough evaluations because of its excellent reputation in MSP communities. The feedback we received regarding Huntress Managed ITDR's effectiveness overshadowed other competitors, leading us to choose it without hesitation.

My experience with pricing, setup cost, and licensing for Huntress Managed ITDR is positive overall. There weren't significant setup costs beyond the internal time invested in learning the product, and the licensing is clear, detailing usage and costs without any hidden fees. Although Huntress Managed ITDR is more expensive than our previous solution, its efficiency ultimately saves us money in the long run.

There's no differential impact regarding needing fewer employees, but we certainly experience time savings. Utilizing Huntress Managed ITDR allows us to review and approve remediation plans faster, alleviating the burden of manual checks, leading to a return on investment as clients who resisted our training come back after incidents asking how they could have avoided them.

Huntress Managed ITDR has positively impacted our organization by providing us with the confidence that we're effectively protected, even when clients neglect our recommendations for training sessions. Knowing that we've transitioned away from Kaseya products, which failed us during a significant ransomware incident, gives us a sense of security, as Huntress Managed ITDR's response times have proven to be far superior.

Since switching to Huntress Managed ITDR, we've noticed time savings particularly in setup processes. By integrating Huntress Managed ITDR with our remote management tool, we streamline the installation of necessary software on new machines, ultimately improving efficiency. We maintain a 100% conversion rate for clients experiencing incidents, as they come to us seeking guidance on preventing similar situations from arising.

I gave Huntress Managed ITDR a review rating of 10 out of 10.

Huntress Managed ITDR was to replace an existing solution, as we were using CrowdStrike previously, and the big one for us is to essentially manage suspicious and risky behavior with our user identities, knowing that most of our past historical incidents and compromises came through user identities, giving us a layer of visibility, a support team, and 24/7 response to weird activity happening in our Microsoft environment.

One thing I appreciate the most about Huntress Managed ITDR is that the dashboard is incredibly clear, allowing me to go in and understand what's happening across our organization and users and know where I need to act, drawing my attention in when there are actions that need to be taken, providing that full, high-level, bird's-eye view of everything happening with identity security in our organization.

Their real-time monitoring, including how they retroactively search through logs, has impressed me in action, especially when they found a threat that had been in our system for months during our proof of concept. I appreciate that their real-time monitoring also goes back in time if they find out about a threat later, and the notifications for that, along with the automatic remediations, are incredibly efficient, with one instance where a VPN account was closed out within minutes after an unexpected login. Additionally, there's a new AI-based timeline view that provides a really great breakdown of what actually happened in that event, plus the option to press the SOC button and talk to a human for additional support.

When discussing the downsides of Huntress Managed ITDR, I think one of the advantages is that they've been adding features, including a feature for retroactive hunting for apps that might be deployed in our organization and might be at risk, a great example of a gap they filled. One challenge has been applying rules to staff only due to the option in the VPN rules where I can either deny all VPNs for the organization or do case-by-case exceptions, with no in-between. As a K to 12 school, I would love to see more granular user group level restrictions and alerts. For instance, having all students flagged if high school students log in with a VPN, which I expect at this point, versus a different security risk level for staff, leading to potential trade-offs in our general use cases.

We have been using Huntress Managed ITDR for two months.

Regarding stability, I experience no issues at all with Huntress Managed ITDR, as it consistently accesses data and the platform has always been available for me to find what I need.

I find scalability with Huntress Managed ITDR very easy; we could add 100 users, and I appreciate that they are flexible on licensing, with discussions about scaling up occurring at renewal time rather than requiring immediate payment.

I appreciate the technical support for Huntress Managed ITDR because I can reach out to support and get an immediate pop-up chat, allowing me to speak with a person right away during my last inquiry with the SOC, where we were able to address something we weren't sure about, resolving the challenges we faced. I give the support for Huntress Managed ITDR a rating of 10 out of 10.

Positive

I have used direct alternatives to Huntress Managed ITDR, such as Microsoft E5 and Microsoft Defender for Identity, which we use in parallel as one of the data sources, alongside CrowdStrike identity monitoring, referred to as IDP.

The initial deployment for Huntress Managed ITDR was very easy, as I essentially had to click a button, grant the right permissions, and it took care of the rest needed to ingest data, contrasting with competitors where I had to go through extensive documentation.

If I were to compare Huntress Managed ITDR with the alternatives, I find that if I were a larger organization, CrowdStrike might have had a few more functionalities, particularly in the query filter prior to Huntress adding several new search tools recently, allowing me to get what I need all in one context. I appreciate that Huntress bills for usable, useful data, having stripped out unnecessary storage features that previously caused issues, ensuring I only maintain data necessary for security.

One thing I appreciate the most about Huntress Managed ITDR is that the dashboard is incredibly clear, allowing me to go in and understand what's happening across our organization and users and know where I need to act, drawing my attention in when there are actions that need to be taken, providing that full, high-level, bird's-eye view of everything happening with identity security in our organization.

Their real-time monitoring, including how they retroactively search through logs, has impressed me in action, especially when they found a threat that had been in our system for months during our proof of concept. I appreciate that their real-time monitoring also goes back in time if they find out about a threat later, and the notifications for that, along with the automatic remediations, are incredibly efficient, with one instance where a VPN account was closed out within minutes after an unexpected login. Additionally, there's a new AI-based timeline view that provides a really great breakdown of what actually happened in that event, plus the option to press the SOC button and talk to a human for additional support.

Although we do not have any regulatory requirements in our organization, Huntress Managed ITDR has added smart filter data, and we recently tried to go back and investigate something related to a privacy breach, finding it had all the search information necessary to retrieve what we needed. The new features in the search simplify how to search through the logs for information, giving me confidence in my ability to investigate something retroactively, even in the absence of specific regulatory needs.

I just recently turned on the automated incident response within Huntress Managed ITDR and watched it work, which seems to act quickly by automatically taking essential actions while providing remediation tasks afterward, giving me the assurance that they'll do what's necessary to keep the environment secure, even if it temporarily inconveniences a user.

Regarding customizable alerts in Huntress Managed ITDR, we set up alerts for my team to receive phone calls and emails when there's an incident, ensuring we aren't relying on a single person during critical incidents, which I appreciate.

In terms of pricing for Huntress Managed ITDR, it is very affordable from a K to 12 perspective, and considering the cost of a breach, having this peace of mind to proactively act in our environment is worth its weight in gold.

Regarding maintenance on Huntress Managed ITDR, I am not aware of any required maintenance since the tool seems to maintain an existing relationship with Microsoft Entra and operates self-maintaining, with the advantage of receiving a monthly newsletter about new features.

I give this review an overall rating of 10 out of 10.

My main use case for Huntress Managed ITDR is protecting clients' Microsoft 365 tenants.

A specific example of how I use Huntress Managed ITDR to protect those Microsoft 365 tenants is when I see the alerts come through; it can be anything from a location or logging in from a location abroad that isn't normal for the client. It allows me to jump in to that threat and isolate it and remediate it before anything happens.

The best features Huntress Managed ITDR offers are that the configuration for Microsoft 365 is very simple and easy to set up, and the actual security that it brings. In many cases this year, in particular where the threat landscape has been higher, it has allowed me to protect my clients before anything actually happens.

Huntress Managed ITDR has impacted my organization positively because, as well as securing our clients, it has given us another service that we can offer to our clients, which increases revenue. The main thing is that I have a tool in place because predominantly all of my clients use Microsoft 365, so I have that security tool to give to them, which protects them. Ultimately, it is commercially beneficial too.

I have noticed both measurable outcomes since using Huntress Managed ITDR; there has been a revenue increase because we are doing some volume now with the Microsoft 365 ITDR or MDR, as we call it. I am stopping breaches left, right, and center, so it has definitely had a positive impact on both.

Honestly, I don't have any advice on how to improve Huntress Managed ITDR; I think it does exactly what it says and exactly what I need it to.

I don't have anything that comes to mind for needed improvements; perhaps something small or even a wish list feature.

I have been using Huntress Managed ITDR for around two years.

Huntress Managed ITDR is stable.

Huntress Managed ITDR's scalability is fine for me; when I have clients who need to add users, it can automatically configure them to the ICDR, which again, I predominantly use for Microsoft 365, so it is nice and easy.

Very rarely have I had to deal with customer support for Huntress Managed ITDR; the service generally just works. My colleague probably deals with Huntress support more than I do, but again, it is very minimal from a support point of view. My experience has been good.

Negative

I did not previously use a different solution.

The simple setup impacts my day-to-day work because the initial configuration I do not personally manage; my colleague does, but he has related to me that it is simple and easy to do. It makes my life easier that we will configure it and just get it working because it is a one-time thing, very nice and easy to do.

I have seen a return on investment because there is a saving in time; if a client did experience a breach, that would take a lot more of my time to resolve than having that alert to allow me to jump in and remediate it before it becomes a breach. In terms of return on investment as well, time, of course, but also commercially, I have seen a lot of growth in my security offering because of the ITDR service.

My experience with pricing, setup cost, and licensing is that there are no setup costs that I am privy to, so setup is fine. We do that ourselves.

The licensing cost, again, is a good price point that allows me to add it on to clients and it becomes a no-brainer for them to add it because the price of the service makes sense. It is not too expensive. The price deployment and setup from a cost point of view is all spot on.

Before choosing Huntress Managed ITDR, I did not evaluate other options; it was straight from Huntress.

The advice I would give to others looking into using Huntress Managed ITDR is that if you have a lot of clients using Microsoft 365, if you are concerned with the security element in any way, it is just a complete no-brainer to bolt this on to the tenant because it has saved me time, generated revenue, and it has helped a lot of my clients from a security aspect. I see a lot of potential breaches being stopped before they ever become an incident.

I do not have any additional thoughts about Huntress Managed ITDR before we wrap up; I think this has been quite in-depth. I think we have covered quite a lot, but the main takeaway is that the solution, not just this, the solution in general, the EDR as well, has allowed me to expand revenue, but more importantly, protect my clients in a way I have never been able to do before. I would give this solution a rating of 10 out of 10.

Huntress Managed ITDR is a security tool that we use for security and identity protection.

Huntress Managed ITDR has provided excellent features during the past year that I have been using it. The best feature is the lack of false positives; when we receive an alert from Huntress Managed ITDR, the majority of the time they are true positives that are actionable, unlike some other tools which generate a lot of noise.

Huntress Managed ITDR has greatly helped in detecting and identifying threats. With Huntress Managed ITDR, we are able to catch things like mail flow rules that were created, and we had security incidents in the past that were remediated, but a couple of things were missed like those mail flow rules. Huntress Managed ITDR was able to catch all of those, so it is really valuable because we did not have anything protecting identities in the 365 environment until we obtained Huntress Managed ITDR. Another feature I really appreciated about Huntress Managed ITDR was that it was able to block a rule for non-company approved VPNs.

Overall, Huntress Managed ITDR has improved my organization by making it more secure, which is the biggest improvement, and by reducing noise, so we are able to focus more on actionable alerts.

One area that has room for improvement with Huntress Managed ITDR is that there was a gap with detections inside of America. Huntress Managed ITDR is really good at spotting threats outside of the country, but we had a security incident inside the country, and Huntress Managed ITDR was unable to help with that. A suggestion for improving Huntress Managed ITDR would be to add more ITDR specifically for inside of America.

I have been using Huntress Managed ITDR for about a year.

I would rate the stability of Huntress Managed ITDR as a ten, as I have not really experienced any downtime, bugs, or glitches.

Huntress Managed ITDR is definitely a scalable solution that fits our enterprise-level company needs. I would rate the scalability of Huntress Managed ITDR as a nine.

I would rate Huntress Managed ITDR's technical support as a seven, as I have only used it once or twice and my experience has been pretty good.

Positive

We have also tried SentinelOne as another solution.

Regarding the deployment itself, it was pretty straightforward and not really complex, and there were no challenges along the way.

We use real-time monitoring with Huntress Managed ITDR. We do use the automated incident response with Huntress Managed ITDR. The impact of utilizing the automated incident response with Huntress Managed ITDR has decreased our response time for true positives that could be potential threats in the environment; Huntress Managed ITDR is able to, in real-time, block those threats before we would even see an alert, so it helps keep the environment more secure than it would be without the tool.

Approximately, we have about 1,000 users using Huntress Managed ITDR. Huntress Managed ITDR requires no maintenance from our end as updates and patching are all handled by Huntress Managed ITDR.

I would definitely recommend Huntress Managed ITDR to other users because it is easy to use, and it does not provide too many false positives, which is very important, especially when you are dealing with a company the size that we are; we really need to focus on actionable alerts, and it is the best tool that we have found for protecting the Microsoft 365 environment. I would rate this product an eight overall.