Blog Post
CMMC: The Opportunity ($$) and Challenge for MSPs
CMMC isn't just another compliance checkbox — it's a market shift that will sort MSPs into winners and losers. If the EMR mandate taught you anything, it's that early movers win.
The Huntress Tragic Quadrant
Ranking the Cyber Tactics Wrecking Businesses
Download Your Report
You know those analyst grids that sort security vendors into leaders and visionaries? Those are great if you're buying software. They don't tell you a thing about what's actually going to hit your business next.
So we built our own: The Huntress Tragic Quadrant. It's designed to separate the hype from the real deal, ranking the cyber tactics we're actually seeing wreck businesses right now, not whatever's trending in the headlines this week.
If you're running security without a Fortune 500 budget, you can't chase every malicious tactic that makes the news, so this quadrant ranks the ones that deserve your time. We plotted 11 threats based on two basic criteria:
- Prevalence (the x-axis) is how often we run into each tactic.
- Pucker Factor (the y-axis) is how close it gets you to real trouble before you've had a chance to catch it. You can guess why we named it that.
The result is our data-backed (and highly opinionated) view of the threats that actually deserve your attention. Not everything on this chart is equally urgent, and the quadrant is built to show you exactly which is which at a glance.
If you’re not sure where to start, look at the top right. That's the OH $#!T zone, where RMM abuse, mailbox manipulation, and account takeover live, the tactics that show up the most and hit the hardest. Close those gaps first.
From there, work your way around the rest of the quadrant. The threats that show up less often still earn their spot for a reason, and the full report walks through exactly why each one lands where it does.
Get the Full Report
The quadrant tells you what to prioritize. The report tells you why, and what to do about it. For every tactic on the chart, you'll get:
- Why it lands where it does — the real numbers and detections behind its placement
- The tradecraft — how the attack actually works, in plain terms
- A bottom line you can act on — practical next steps, not just a threat summary
- A real example from the field — pulled straight from our SOC's own investigations
Download the full report to get the complete breakdown, tactic by tactic, and figure out exactly what your business should focus on first.
Related Resources
- Read more about CMMC: The Opportunity ($$) and Challenge for MSPs
- Read more about Operational Resilience: Turning Your Incident Response Plan Into Muscle MemoryBlog Post
Operational Resilience: Turning Your Incident Response Plan Into Muscle Memory
An incident response plan only works if it's tested. Learn the 5 pillars of operational resilience and how to turn your plan into muscle memory before an attack hits.
- Read more about What is Software as a Service (SaaS)?Cybersecurity 101
What is Software as a Service (SaaS)?
Learn what Software as a Service (SaaS) is, how it works, and key cybersecurity considerations for secure SaaS implementation in your organization.
- Read more about Breaking Down Ransomware Attacks and How to Stay AheadBlog Post
Breaking Down Ransomware Attacks and How to Stay Ahead
No endpoint is immune. Ransomware is hitting businesses of every size, and double extortion has become the default. Here's how to break down what these attacks actually look like to stay ahead.
- Read more about OpenClaw, Rogue Agents, and Application HygieneBlog Post
OpenClaw, Rogue Agents, and Application Hygiene
OpenClaw AI agents pose a security risk in Microsoft tenants because they're often granted broad, high-impact cloud permissions that an attacker could immediately inherit if the agent is compromised. Learn why proactive application hygiene, which includes continuous monitoring and trimming unnecessary permissions, is essential for managing this identity-based threat.
- Read more about Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM PersistenceBlog Post
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.
- Read more about Active Exploitation of Gladinet CentreStack/Triofox Insecure Cryptography VulnerabilityBlog Post
Active Exploitation of Gladinet CentreStack/Triofox Insecure Cryptography Vulnerability
Gladinet CentreStack is being actively exploited, with the cl0p ransomware group now reportedly targeting internet-facing servers. Huntress has been tracking this from the start and has the latest updates.
- Read more about What is the Advanced Encryption Standard (AES)?Cybersecurity 101
What is the Advanced Encryption Standard (AES)?
Learn about the Advanced Encryption Standard (AES), a top-tier encryption protocol trusted for safeguarding sensitive data. Explore its history, functionality, features, and practical applications.
- Read more about Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform ServersBlog Post
Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
Huntress SOC found a threat actor exploiting a file upload flaw in recreation management to breach 3 municipal servers and steal payment data.
Frequently asked questions
It's Huntress's own ranking of the cyber tactics most likely to impact businesses right now, based on real detection data from the 5M+ endpoints, 15M+ identities, and nearly 300k organizations we protect.
Most rankings are built on surveys, vendor submissions, or general industry sentiment. This one is built entirely on what Huntress's SOC actually sees across the environments we monitor, so every placement on the chart is backed by a real detection rate, not an opinion poll.
No. Every tactic is broken down in plain language, with a clear bottom line on what it means for your business and what to do next, whether or not you have a dedicated security team.
Watch us hack the quadrant live! Our team will be putting the quadrant to the test, spinning up the real techniques that landed on it and showing just how fast modern tradecraft goes from idea to execution.
