Huntress Survey Finds Identity Attacks Rising and Detection Often Delayed
Summary
Huntress's 2025 survey of more than 600 IT and security professionals reports rising identity attacks, frequent detection delays, and significant losses, while many organizations plan to expand identity protection.
Key points
- The survey reports that 67% of organizations saw identity-related incidents increase over the previous three years; more than one-third said identity attacks account for over 40% of their security incidents.
- Respondents reported business email compromise (51%), credential theft (39%), VPN misuse (43%), session hijacking (23%), and rogue or malicious applications (45%).
- The report says 68% of organizations cannot detect identity threats until attackers have established persistence, while 25% can detect them within minutes.
- Half of respondents said they take hours to respond after detecting identity threats; 32% reported losses of at least $100,000 from such attacks.
- Although 65% said they were confident in detecting rogue apps, 45% reported advanced identity-protection maturity, and 66% had implemented identity threat detection and response.
- For the coming year, 89% said identity protection would be a priority and 74% planned to implement or expand ITDR; 71% struggled to measure return on investment.
Article Details
- Publisher
- Huntress
- Report Period
- 2025; some statistics cover the past year or past 3 years
- Scope
- Identity-related incidents, detection and response, organizational maturity, and investment in identity protection.
- Sample Size
- Input from over 600 IT and security professionals.
- Key Statistics
- 67% of organizations reported an increase in identity-related incidents over the past 3 years.
- 51% reported experiencing business email compromise in the past year.
- 68% said identity threats were not detected until after attackers had established persistence.
- 32% reported losses of $100,000 or more from identity attacks.
- Huntress reports that Managed ITDR stopped 28,000 identity-based threats in 6 months across 2 million identities, with an average response time under 3 minutes.
- Recommendations
- Implement or expand identity threat detection and response capabilities.
- Use tools that can stop identity attacks, not just check compliance.
- Measure the return on investment of identity-protection spending.