Team: Huntress Managed Endpoint Detection and Response (EDR)
Summary: The Security Insights Report replaces the Monthly and Quarterly Threat Report with a monthly and quarterly summary of how Huntress protected your account and organizations.
In this Article
Overview
Where to Find the Report
Huntress Reports at a Glance
Transition Timeline
What's in the Report
What's New
What Hasn't Changed
Account-Level and Organization-Level Reports
Frequently Asked Questions
Related Articles
Overview
The Security Insights Report is the monthly and quarterly report that shows what Huntress did to protect your organizations during the reporting period. It replaces the Monthly and Quarterly Threat Report.
The report covers more than threats, so it has a new name. Alongside detection and response activity, it shows your coverage, your security posture, and the work the Huntress 24/7 AI-assisted Security Operations Center (SOC) performed for you. It answers one question: what has Huntress done for me lately?
Huntress generates a report for your account and one for each organization. Each report includes pages only for the Huntress products that the account or organization has set up. The landscape layout works for screen sharing and for quarterly business review (QBR) decks, and it can carry your logo and highlight color.
Where to Find the Report
Huntress generates the Security Insights Report for your account and for each organization, whether or not anyone is set up to receive it by email. You can always find it on the Reports page in Huntress:
- Account-level report: the account's Reports page
- Organization-level report: that organization's Reports page
Huntress emails a report only to the recipients you add. Recipients are set separately for the account and for each organization:
| To email this report | Add recipients here |
|---|---|
| Account-level report | Account Report Recipients, in Account > Settings > Brand Settings |
| An organization's report | That organization's Branded Report Recipients |
If you already receive the legacy Threat Report by email, the Security Insights Report goes to the same addresses. You don't need to change anything.
Each Reports page has a Report Recipients card that lists the current recipients, or shows No recipients configured. Select Manage Recipients to change them. For step-by-step instructions, see Configure Recipients, Branding, and Language.
Huntress Reports at a Glance
Huntress generates several reports. Use this table to find the one you need:
| Report | Who it's for | How often | Where to find it |
|---|---|---|---|
| Security Insights Report | IT and security teams, MSP technicians, and MSP owners | Monthly and quarterly | The Reports page, where it's listed as Monthly Summary (New) or Quarterly Summary (New), and email if recipients are set up |
| Legacy Threat Report | Same audience, being retired | Monthly and quarterly through February 1, 2027 | The Reports page, and email if recipients are set up |
| Results Snapshot | Non-technical stakeholders, such as business owners | Monthly and quarterly | The Reports page, and email if recipients are set up |
| EDR Assessment Report | Prospects and newly onboarded organizations | On demand | Reports page |
| Identity Security Assessment and Identity Posture Assessment | Microsoft 365 tenants | On demand | See Get Your Identity Security Assessment Report |
| Weekly and monthly summary emails | Individual Huntress users | Weekly or monthly, set per user | Email only |
| SAT Monthly Report | Huntress Managed Security Awareness Training (SAT) administrators and the client contacts they add | Monthly | Email, and the Reports page in the SAT Admin Portal |
The SAT Monthly Report is separate from the Security Insights Report.
Transition Timeline
Huntress is moving every account from the legacy Threat Report to the Security Insights Report over the next few months. Here's the schedule:
| Date | What happens |
|---|---|
| November 16, 2026 | The Security Insights Report is generated for all accounts and organizations for the first time and emailed to your existing report recipients. |
| December 1, 2026, January 1, 2027, and February 1, 2027 | Huntress generates both the Security Insights Report and the legacy Threat Report each month. On January 1, it also generates both quarterly reports. February 1 is the last time the legacy Threat Report is generated. |
| March 1, 2027 | The legacy Threat Report is retired. From this date on, Huntress generates only the Security Insights Report. |
Note: These dates are when reports are generated. Reports are emailed only to recipients you've added. See Where to Find the Report.
Important: You have three months to move any automations from the old report to the new one.
If you forward, parse, or archive the legacy Threat Report in a workflow, update that workflow to use the Security Insights Report before March 1, 2027.
What's in the Report
Each report includes only the pages for products the account or organization has set up. There are no locked or placeholder pages for products you don't use. This table lists every page and where to learn more:
| Page | What it shows | Learn more |
|---|---|---|
| Cover | The account or organization name, the reporting period, and your logo when branding is set |
Configure Recipients, Branding, and Language
|
| Executive Summary | Incidents resolved, incident trend, SOC Performance, Cybersecurity Coverage, SOC Analysis Breakdown, severity, and top investigated organizations |
What's on the Executive Summary?
|
| Endpoint Detection and Response through Managed EDR | Protected endpoints, endpoint security activity, threat breakdown, and actions taken |
What Do the Managed EDR Pages Show?
|
| Detection Capabilities | Ransomware Canaries, Persistent Footholds, and Process Insights |
What Do the Managed EDR Pages Show?
|
| Managed Antivirus | Microsoft Defender Antivirus status, events, and exclusions |
What Do the Managed EDR Pages Show?
|
| Firewall Status Monitoring | Windows Firewall status and policy conflicts |
What Do the Managed EDR Pages Show?
|
| External Recon | Externally exposed IP addresses, ports, and services |
What Do the Managed EDR Pages Show?
|
| Identity Protection through Managed ITDR | Protected identities, identity security activity, threat breakdown, and actions taken |
What Do the Managed ITDR Pages Show?
|
| Identity Capabilities | Unwanted Access rules, Rogue Applications, and Inbox Rules |
What Do the Managed ITDR Pages Show?
|
| Data Monitoring through Managed SIEM | Log sources, data security activity, data usage, retention, and Smart Filtering |
What Does the Managed SIEM Page Show?
|
| Managed ISPM | Compliance Rating, Microsoft Secure Score, and posture activity |
What Does the Managed ISPM Page Show?
|
| Incident Log | Each incident resolved during the period, with a summary and the remediations performed |
|
What's New
The Security Insights Report changes several parts of the legacy Threat Report. Compared with that report, it adds:
- A redesigned Executive Summary. It includes a six-month incident trend, incidents by product, SOC Performance with hours saved, Cybersecurity Coverage, and the organizations Huntress investigated most.
- A Managed ISPM page. For accounts with Huntress Managed Identity Security Posture Management (ISPM), the report shows Compliance Rating, Microsoft Secure Score, and posture activity.
- An Identity Capabilities page. Unwanted Access rules, Rogue Applications, and a new Inbox Rules section share one page.
- More Managed SIEM detail. The SIEM page adds data usage against your data pool, data retention, Smart Filtering, and the organizations ingesting the most data.
- A more detailed Incident Log. Each incident includes a summary and a breakdown of the remediations performed.
- Top Investigated Organizations by product. The EDR and ITDR pages show where investigations concentrated.
Several features from the April 2026 report update carry over in the new design: co-branding, the landscape layout, Firewall Status Monitoring, External Recon, and coverage of Huntress Managed Identity Threat Detection and Response (ITDR) and Huntress Managed Security Information and Event Management (SIEM).
The Analyst Notes section is no longer part of the monthly and quarterly report.
The report now counts only Critical and High incidents resolved during the period. Low-severity incidents aren't included, so incident counts can be lower than in the legacy Threat Report.
What Hasn't Changed
Most of how reports are generated and delivered stays the same:
- Monthly reports are generated on the first day of each month, and quarterly reports on the first day of each quarter. If recipients are set up, the email can arrive up to about two hours later.
- Huntress generates a report for the account and one for each organization.
- Organization report recipients are still managed in each organization's settings, and account report recipients in Settings > Brand Settings.
- Branding, including your logo and highlight color, is still set in Settings > Brand Settings.
- The Report Language setting (English, Spanish, French, or Dutch) still applies to the account and all of its organizations.
- You can still generate a report for a custom date range of up to 3 months from the Reports page.
Account-Level and Organization-Level Reports
An account-level report covers every organization in the account. An organization-level report covers one organization and leaves out the sections that compare organizations. These sections appear only on account-level reports:
- SOC Performance, including hours saved, on the Executive Summary
- Top Investigated Organizations on the Executive Summary, Managed EDR, and Managed ITDR pages
- Organization Breakdown on the Managed EDR page
- Mapped Organizations on the Managed ITDR page
- Enabled organizations, Top Organizations by Data Ingested, Data Usage, and Data Storage & Retention on the Managed SIEM page
- Organization counts, Top Organizations, the average Compliance Rating, Organization Secure Score Breakdown, hours saved, and Deployment Method Breakdown on the Managed ISPM page
Frequently Asked Questions
These are the questions partners ask most about the change.
Why am I receiving two reports?
From November 16, 2026, through February 1, 2027, your report recipients receive both the Security Insights Report and the legacy Threat Report. This gives you time to update any workflows built around the legacy report.
Do I need to do anything?
No. Anyone who already receives the legacy Threat Report by email also receives the Security Insights Report, so you don't need to change your recipients. If you've automated anything around the legacy report, such as forwarding rules, parsing, or archiving, update it before March 1, 2027, when the legacy report is retired.
Can I stop receiving the legacy report early?
No. Huntress generates both reports for every account and organization through February 1, 2027. Starting March 1, 2027, it generates only the Security Insights Report. Removing an organization's recipients stops both emails, not only the legacy one.
Why doesn't my report include a Managed ISPM, Managed ITDR, or Managed SIEM page?
A product page appears only when that product was set up for the account or organization during the reporting period. Products that are part of your subscription but were never set up don't get a page. For what counts as set up, see Troubleshoot the Security Insights Report.
Why does the Security Insights Report show fewer incidents than the legacy Threat Report?
The Security Insights Report counts only Critical and High incidents, and it counts them when they're resolved. For more causes, see Troubleshoot the Security Insights Report.
What is the Results Snapshot?
The Results Snapshot is a separate one-page report for non-technical stakeholders. Huntress generates it for each organization and emails it to that organization's report recipients.
Will my old reports disappear?
No. Reports that were already generated stay on the Reports page.
How do I share feedback on the report?
Share ideas and requests at feedback.huntress.io.
Related Articles
These articles cover each part of the report in more detail:
- Security Insights Report - What's on the Executive Summary?
- Security Insights Report - How Are Metrics and Hours Saved Calculated?
- Security Insights Report - Configure Recipients, Branding, and Language
- Troubleshoot the Security Insights Report
- Security Insights Report - What's in the Incident Log?
- Add Your Company Branding to Huntress Reports and Ransomware Canaries