Huntress Tragic Quadrant Rates 'Pucker Factor,' Reveals RMM as Biggest Risk
Security Boulevard, Tuesday, October 13th, 2026
Huntress maps attack tactics by prevalence and business impact, finding RMM tool abuse in 45% of endpoint incidents.
Huntress analyzed telemetry from more than five million endpoints and 15 million identities across nearly 300,000 organizations, plotting tactics by prevalence and by 'pucker factor', or proximity to serious business disruption.
Abuse of remote monitoring and management tools appeared in 45% of endpoint incidents and landed in the high-risk, high-prevalence quadrant.
Mailbox manipulation, such as altered rules, hidden vendor replies and redirected invoices, made up nearly a quarter of identity signals, while adversary-in-the-middle attacks that steal session tokens accounted for 18.9% of identity threats in 2025.
Experts advise treating RMM enrollment like admin account creation and adopting continuous session monitoring and just-in-time privileges.