Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses

What it is

Huntress's "Tragic Quadrant" plots cyber threats against SMB/MSP environments on two axes: prevalence and "pucker factor" (closeness to a major disruption like ransomware, data theft, or BEC). It's built from telemetry across 5M+ endpoints, 15M identities, and ~300,000 organizations, current through Q1 2026.

How it works

The quadrant has four zones. The top-right "OH $#!T corner" (high prevalence + high pucker factor) holds RMM abuse, mailbox manipulation, and AiTM session-token theft — the summary already names these with their percentages. Outside that corner, three threats are placed differently: device code phishing is "low-key deadly" (low prevalence, high severity), ClickFix is a "daily pest with high stakes" (low prevalence, high severity — 2.2% of EDR signals but ~99% of those are high-severity), and AI-platform abuse is "overhyped, for now" (an emerging, still-low-volume pattern). A solid dot on the chart marks threats Huntress has observed being AI-accelerated.

What to do

The page's concrete recommendation is to triage using three questions tied to the OH $#!T corner: which RMM tools are approved for use, how mailbox rule changes are monitored, and how unusual session/token behavior is caught before escalation. For device code phishing specifically, it advises monitoring for unusual device code prompts and anomalous token use rather than relying on URL inspection, since the flow runs through Microsoft's legitimate login pages.

Caveats

AI-platform abuse is explicitly labeled by Huntress as not yet a high-prevalence threat — it's flagged as an emerging pattern worth watching rather than a current top-tier risk, despite the attention-grabbing claude.ai example already noted in the summary. The quadrant reflects Huntress's own SOC telemetry (its customer base), not industry-wide incident data.