Full Report
Why Huntress’ 2025 Managed ITDR Report should be required reading for every security team.
Analysis Summary
# Industry News: Identity Emerges as the Primary Security Surface in 2025
## Summary
Huntress has released its 2025 Managed ITDR Report, signaling a definitive shift in the threat landscape where identity has surpassed the physical endpoint as the primary attack surface. The report highlights that while 67% of organizations have seen identity-related incidents surge, a significant "reality gap" remains between perceived security confidence and actual detection capabilities.
## Key Details
- **Date:** May 20, 2025
- **Companies Involved:** Huntress (Primary), Microsoft (M365 ecosystem focus), Google (Workspace integration).
- **Category:** Market Analysis / Product Strategy Update
## The Story
The release of Huntress’ 2025 Managed ITDR (Identity Threat Detection and Response) Report marks a pivotal moment for the SMB and mid-market cybersecurity sectors. The data, compiled from over 600 IT professionals, reveals that attackers have largely bypassed traditional MFA and endpoint defenses to exploit session tokens, rogue OAuth applications, and Microsoft 365 configurations.
Key findings show that identity attacks now constitute over 40% of all security incidents for one-third of businesses. Perhaps most concerning is the "detection lag": 68% of organizations only identify these threats after attackers have established persistence. In response, Huntress is pivoting its platform to treat identity as the "new perimeter," expanding its Managed ITDR capabilities to cover Google Workspace and introducing "Rogue App" detection to combat malicious OAuth integrations.
## Business Impact
### For the Companies Involved (Huntress)
- **Revenue Opportunities:** With 68% of businesses increasing identity protection budgets, Huntress is positioned to capture a growing segment of the security spend.
- **Platform Stickiness:** Expanding into Google Workspace and "Rogue App" detection moves Huntress from a focused EDR vendor to a comprehensive security platform provider.
### For Competitors
- **Feature War:** Competitors in the Managed Detection and Response (MDR) space must now accelerate their ITDR roadmaps or risk losing market share to vendors offering integrated endpoint and identity signals.
- **Service Pressure:** The move toward "Managed" ITDR (including a 24/7 SOC) raises the bar for automated-only tools that fail to provide human-led remediation.
### For Customers
- **Improved Security Posture:** Organizations can shift from reactive "inbox cleanup" to proactive identity hardening, potentially avoiding the $100,000+ losses reported by 32% of victims.
- **ROI Pressure:** While capabilities are increasing, 71% of customers struggle to measure ROI, suggesting a need for better reporting tools.
### For the Market
- **Consolidation of Categories:** The blurring lines between EDR, ITDR, and ISPM (Identity Security Posture Management) suggest an industry-wide trend toward unified security platforms rather than point solutions.
## Technical Implications
- **Beyond MFA:** The report confirms that static MFA is no longer a silver bullet; session hijacking and token theft are successfully bypassing legacy secondary authentication.
- **OAuth Risks:** The rise of "Rogue Apps" indicates that attackers are moving away from phishing for passwords toward phishing for permissions.
## Strategic Analysis
- **Market Positioning:** Huntress is successfully positioning itself as the champion of the "under-resourced" security team, providing high-level ITDR capabilities that were previously only available to enterprises.
- **Competitive Advantage:** Their "SOC-led" response provides a human layer that bridges the gap between a detection (an alert) and a resolution (locking a compromised account).
- **Challenges:** The primary obstacle is the "Reality Gap." Convincing organizations to move budget from legacy endpoint protection to identity-centric tools remains a sales hurdle despite the threat data.
## Industry Reactions
- **Analyst Sentiment:** The report is viewed as a "wake-up call" for the mid-market, confirming that Business Email Compromise (BEC) has evolved into a sophisticated identity-access game.
- **Market Response:** Growing demand for ITDR is driving a surge in "identity-first" security architectures (Zero Trust).
## Future Outlook
- **Predictions:** Expect "Identity Posture Management" to become a standard compliance requirement within the next 18 months.
- **What to Watch For:** Watch for Huntress to expand its "Rogue App" detection to include other SaaS ecosystems like Salesforce or Slack as attackers diversify beyond M365 and Google.
## For Security Professionals
Practitioners should prioritize reviewing their "Shadow Workflows" and OAuth application permissions. The data suggests that if you are not detecting identity threats within minutes, you are likely only finding them after the damage is irreversible. Moving toward a managed ITDR model can help bridge the gap between detection and response times.