Huntress Survey Finds Lean Security Teams Struggle With Identity Threats and Alert Noise
Summary
A Huntress survey of 1,050 IT and security professionals found teams feel least prepared for identity attacks, while 64.1% say at least a quarter of their alerts are noise. The article recommends improving alert quality, identity visibility, and incident ownership.
Key points
- Nearly one in five surveyed organizations relies on one person for cybersecurity; only 39.6% report having a dedicated in-house security team.
- Identity threats, including business email compromise, account takeover, and session hijacking, were the area respondents felt least prepared to defend against (26.5%).
- Although speed of detection and response was the top measure of success, 64.1% said at least 25% of their alerts were noise.
- Huntress describes an identity-compromise case in which analysts traced suspicious logins to multiple additional compromised accounts and secured them.
- Survey respondents reported using AI for threat detection (69%), user and entity behavior analysis (55.3%), and automated incident response (51%).
- The article recommends auditing alert quality, improving visibility into identity sessions and tokens, clarifying incident roles, and designing systems to account for human error.
Article Details
- Publisher
- Huntress
- Report Period
- 2026-04-13
- Scope
- Survey of internal IT and security professionals across North America and the UK on security-team preparedness, resources, and practices.
- Sample Size
- 1,050 respondents
- Key Statistics
- 39.6% of respondents have a dedicated in-house cybersecurity team.
- 18% report that cybersecurity is handled by a single person.
- 72.3% rate their IT budget as at least adequate.
- 64.1% report that at least 25% of their security alerts are noise.
- 26.5% feel least prepared to defend against identity-based attacks, including business email compromise, account takeover, and session hijacking.
- Recommendations
- Audit alert quality and determine what proportion of alerts lead to meaningful action.
- Treat identity as a primary attack surface; assess visibility into session behavior, SaaS permissions, and token usage.
- Clarify incident-response ownership before an incident occurs.
- Design systems to catch human errors early rather than assuming they will not happen.