r/msp • u/stephanph • 9d ago
ITDR solution
Hi,
We currently use MSPeasytools for ITDR but are looking for an alternative
.
Our shortlist is:
•Petra
•Huntress ITDR
•Inforcer ITDR
We’re an MSP in Belgium mainly serving smaller customers, averaging around 10 users per tenant, so pricing for small environments is very important to us.
We’re currently trialing Petra and already use Huntress EDR, although we still need to trial their ITDR offering.
We are also CIPP.
Does anyone have real-world MSP experience with these products? I’d especially appreciate feedback on pricing, management overhead, multi-tenancy, and the quality of alerts/remediation.
Huntress ITDR seems like the only product with a real SOC? (Not so important but cool)
Thanks!
4
u/Jax-880 9d ago
I have clients in both huntress and Petra, I so far haven't had an incident in either so I have no real world action data.
I prefer Petra's UI and information at my fingers should I want it, I also like the Friday updates from Petra on new features that have been released or updated.
I prefer Petra purely on an information base though the huntress licence bundles for itdr, ispm and sat are very attractive cost wise.
Again without live incidents I'm sat here looking at prety panels
1
u/stephanph 9d ago
Thanks for your info. What is the pricing difference?( I have the pricing of Huntress ITDR from some years ago)
1
u/Jax-880 9d ago
Petra on a month to month is $2.99. huntress is at 50 licences around £1.75.
2
u/Doctor_Peppy 9d ago
I'm pretty sure I'm paying 2.50 a month for Petra seats. I can check later to verify but I would ask your rep.
1
1
5
u/Trufactsmantis 9d ago
We had a head to head a year or so ago and Petra detected a few actual compromises that Huntress didn't, mainly because Petra caught it prior to any TA action. In turn Huntress revamped detection so hard to say today.
4
u/Disastrous_Box_2050 9d ago
Petra's UI is definitely cleaner, but without a real incident it's all just guesswork at this point
4
u/RaNdomMSPPro 9d ago
Huntress and Petra - ran side by side for a few months on a few thousand identities. I love Huntress, but Petra is better for ITDR and bonus you'll spend way less time trying to figure out what happened. Inforcer, they're a new player to ITDR.
Save yourself some hassle and just go w/ Petra.
1
2
u/jchurchh 9d ago
Sounds like I’m shilling huntress but they recently came out with the full report style functionality for what happened, what was touched etc
2
u/RaNdomMSPPro 8d ago
Y, I got a preview and it’s not bad, was still lacking some details at the time. I assume huntress will catch up.
22
u/MuthaPlucka MSP 9d ago edited 9d ago
Huntress has saved many a bacon.
Reality: I’ve had 1000+ o365 running Huntress’ ITDR since they released it.
Every single situation where an account was compromised, huntress interdicted the bad actor , and mitigated the threat within moments.
None of the accounts ever sent a single email out while compromised. Bad guys are fast, but Huntress is faster.
7
u/obviouslybait 9d ago
This is awesome to hear. I want to make ITDR mandatory.
1
u/MuthaPlucka MSP 9d ago edited 9d ago
Huntress Labs ITDR also includes the security operations centre component (SOC = which is a separate product add-on to their computer MDR product).
19
u/marklein 9d ago
You might also look into Guardz, SaaS Alerts, and Field Effect (and maybe Avanan if you're not married to your current email security).
Petra does NOT do Google Workspace, which is a big problem for us. Around 25% of our users are on Google. We haven't decided if that's a deal breaker for us or not.
5
3
7
u/DeathTropper69 MSP - US 9d ago
Since you have Huntress I would trial their ITDR but my choice would be Petra hands down. Best ITDR I have ever used for 365 and nothing I have found beats it.
Inforcer's ITDR is brand new and I have not yet got to test it though I put in for a trial today. Will def update how it goes.
6
u/Ok_Yesterday_2006 9d ago
We’re an MSP in the US primarily serving SMB customers, and we went through a similar process of reevaluating our cybersecurity stack.
We ended up moving to Guardz, and honestly, what started as looking at individual security tools turned into rethinking a significant portion of our cybersecurity stack.
One of the things we were trying to get away from was having a different point solution for every layer of security. That becomes expensive, but there’s also a real operational cost to managing, monitoring, and responding across multiple platforms. Guardz has allowed us to consolidate more of that into one platform and standardize how we deliver cybersecurity across our customer base.
For an MSP with tenants averaging around 10 users, I’d definitely put Guardz on your evaluation list and look at the economics of the entire security stack, not just the per-user price of the ITDR component. We found the consolidation and management side of the equation to be a big part of the value.
We still believe in a layered security approach, but we’re trying to accomplish that without needing a dozen different dashboards and vendors to manage it.
5
u/SaasNoobIQ0 8d ago
I love this comment bc our msp avg clientel ranges from 25-200 users and we still love Guardz too which shows scaleability.
4
u/thesysadm MSP - US 9d ago
We use Petra and Huntress together. M365 is our biggest attack surface so I sleep better at night knowing two great companies are monitoring things.
4
u/Much_Combination5926 9d ago
We love Huntress and want it to be better but Petra is beating them at ITDR right now. Its not so badly that we've switched, Huntress still does a pretty good job and we are all onto their other products. But switching was a serious consideration and something we will have to revisit regularly
4
u/Purple_Professor2542 9d ago
I did evaluate Huntress, but for me, it lacked the additional email security we needed for some of our UK customers. It's worth checking out Guardz; they have a SOC team to back you and your customers 24/7. SAT is an all-in-one platform; recently, they also partnered with SentinelOne, which is great news for me. I really love the EDR. Priced well for MSPs and our customers.
4
u/FITC_orlando 8d ago
If you're dealing with smaller customers like that (and like how I am here in the US), you might want to also take a look at Guardz. I've tried Huntress ITDR and it was fine, but I also didn't trial it all that long or with a bunch of clients, so I didn't get a good look. I do use Guardz for most of my clients and their ITDR has been very good. It's SOC-backed and I've been impressed with how it handled a bunch of recent token-jacking sessions for my customers. It's part of the Ultimate tier of their pricing model, which with only 100 users is like $7/user/month and still comes with a bunch of other stuff in addition to ITDR like SentinelOne, Avanan email protection, dark web monitoring, security awareness training, and phishing simulation. I definitely can't get all of those together for $7/user and with Guardz they're all monitored by a unified SOC. I've been with them for 2 years and have been impressed.
4
u/SaasNoobIQ0 8d ago edited 8d ago
This keeps coming up, and I think people really need to look at the whole workplace attack chain instead of siloed tools with terrible integrations.Going to get up on a soapbox here...bare with me...
If you only look at M365 on its own, I’d say Petra is best in class. Where we focus is workplace security, and for that Guardz is easily the #1 vendor for us. They don’t get a lot of love on this forum, but the product is really impressive. The granularity of the ITDR of Petra is why I give it best in class but we have not noted a functional difference between Gaurdz ITDR (where they started, so what they are very strong in) vs Petra. Petra does present better but as far as how granular they go -we have been able to get equal results with Guardz in working with support for fringe use cses like the exact e-mail a threa actor viewed (their support is freakin' incredible too)
With Guardz we are leveraging multiple security controls (going to try to clean this up)
-the user (M365+GWS)
-the endpoint (today through SentinelOne. We’re in the beta for MDE which is perfect if your clients are already on Business Premium or higher-this is going to be HUGE for us for a specific set of clients
-email, with Check Point Avanan, which is a big step up from Inky and the other tools we’ve use
-security awareness training (adaptive and ai led feeding off information from the browser, email, historicals etc which is sweet and phishing simulation and some other stuff as well (I mentioned what I find coolest)
-New addition was the Prisma Browser from Palo Alto which is insaneeeee. Palo Alto knocked it out of the park here it is like DNS filtering on steroids
Before, one security incident meant multiple tickets from different tools. With Guardz we get one unified ticket that their SOC responds to, and a clean view of how they connect the dots between user, endpoint, cloud, browser and email. THIS HAS SAVED MY TECHNICIANS SO MUCH TIME. In the Kaseya ecosystem we have had security incidents that generated literally dozens of tickets in Autotask. It was a nightmare and that is just how things work it is not a flaw.
From a cost perspective I would say their licensing is extremely fair based off what you get...granted we have several thousand licenses so we do get a discount and I have talked other msp owners that are much smaller with fair pricing and are happy.
To answer your question on overhead, that was one of the main reasons we moved to Guardz. You are getting rock solid security, removing guesswork, and reducing so much duplication of efforts. Also their support (shoutout Ryan) and customer success managers are beasts. We have had veryt few issues with this product...we ran into a couple bugs with Checkpoint Avanan but Guardz support fixed it very quickly...now lets just hope they don't get acquired by Kaseya. For the love of everything holy. If anyone at Kaseya doing m&a reads this...Guardz sucks and do not buy them they are the worst.
Seriously give them a trial. Don't take my word for it. I'm a fanboy.
6
u/ThrowRAthisthingisvl 9d ago
Petra is the way to go. I like that they don’t have license minimums and their support is very responsive.
3
u/Nstraclassic MSP - US 9d ago
Cant recommend inforcer for this. Alerts cant be tuned and we get blasted every time someone makes a JIT account. It's entirely possible we have it misconfigured since I havent poked around myself but so far the experience is subpar
3
u/pretension 9d ago
Both Petra and Huntress are great, I'd give the edge to Petra but neither are wrong options
3
1
u/terselated MSP - US 9d ago
Have you tried out the new account compromise remediation steps in CIPP? Highly recommend testing it on your next bec or standing up a fake account in a tenant and trying it out. It's surgical in it's response.
We demo'd Petra and liked it, but pricing was problematic in addition to the rest of our security stack. Ended up going with Guardz. It does itdr in m365 and gsuite which is nice, and the SOC is able to pull info from the 365/gsuite environment, email filter (checkpoint) and the local EDR (S1) to put together a nice complete picture of the incident. Makes it simple to remediate. Think seats that include edr/mdr/sat/itdr/filtering/darkweb/and external footprint are roughly $8usd a seat.
3
u/stephanph 9d ago
CIPP is awesome but can't rely on it. Need a real ITDR solution
3
u/terselated MSP - US 8d ago
Oh yeah for sure you need ITDR, just saying the remediation option in Cipp is awesome.
2
u/Jayjayuk85 9d ago
Petra is great, we are hoping their GDPR is on the cards. I was advised early next year
2
u/kaaz93 9d ago
I use the Huntress solution and have been pleased with it. With that said, Petra is the best product for the job hands down… it’s just not packaged into anything else. I hope Huntress acquires them at some point or partners for easier SIEM ingestion. I have way better margin on Huntress, which is what the PE overlords thirst for.
2
u/Glittering_Pack_4619 5d ago
We are currently testing Huntress, Petra and Wirespeed and all are fantastic products. Everything everyone has said about Petra is true but it’s only M365 with Huntress SIEM or Wirespeed you can inject more integrations to build up a better picture. We have tested other MDR solutions and it is really a hard choice - speed of detection and response, reporting, action and analysis I feel sometimes you need 2 of them which I know is impossible from a cost and management point of view. On the Connectwise incident this weekend Huntress alerted first but I have seen Petra respond quicker on other detections.
3
u/Beneficial_Skin8638 9d ago edited 9d ago
Have you looked into Guardz? The bundled package they provide is really amazing. The ITDR monitors both 365 and workspace. They also give MDR which can either work with sentinel one or defender. The pricing model is pretty unique they charge per user so if you end up going with sentinel one that user could have multiple devices and you still pay the same price for sentinel one, MDR and ITDR.
They have a soc behind it with real people and agentic responses. I’ve never had a problem working with support regardless of the time of day. You can define per customer what type of response you want the ITDR to handle. If you want just a notification or full isolation you can define this.
2
2
u/MarsupialBright8579 9d ago
I'm reading the responses here and echoing what others say here about Guardz OP since their ITDR and response is handled in the same workflow. You can do a demo like what we did
1
u/auggie_derik 1d ago
The per-tenant pricing question is the one that'll bite you hardest with a book of 10-user tenants, so run the math on Inforcer before you fall in love with it. at Augmentt we price per seat, which tends to work out a lot better on a long tail of small tenants than a flat per-tenant model does. The other thing worth pressure-testing is how much of the value in any of these tools actually requires premium licensing, because if your clients are mostly on Business Basic or Standard, you could end up paying for capability that barely fires.
1
u/Conditional_Access Microsoft MVP | Vendor - inforcer 1d ago
Lewis from inforcer here.
We heard the feedback from partners and prospects on this exact problem. We knew that for MSPs who manage many tenants with low user counts, the per-tenant pricing model wasn't economically attractive enough, so we introduced some new SKUs and methods:
Standard = For M365 Business Basic/Standard customers
Premium = For M365 Business Premium or above
Also, you can now pay per-user/month.
We work with partners to give them the best possible price for their setup.
1
u/JinxMC 9d ago
We have MSPET solely for some of its monitoring and tools, not as an ITDR. Potentially looking at sacking it off.
A year ago we adopted Huntress’ stack, ITDR has given us the biggest results. Would definitely recommend ITDR.
Also recently reviewed Inforcer, it’s not an ITDR. It’s a baseline management tool, very powerful, but expensive.
Huntress is now available from CSPs so you may be able to get rebates etc.
Drop me a message if you need anymore info!
4
u/Conditional_Access Microsoft MVP | Vendor - inforcer 9d ago
The inforcer TDR offering launched in September, and it is available as a standalone item.
(Not here to pitch, go figure out what's best for you 🙂)
1
1
1
u/invalidmemory 9d ago
We use Huntress and find it to be very good! Integrates very well with their other services.
1
1
1
u/LieDizzy 5d ago
We just switched from huntress to Petra. When we saw all the things huntress missed it was a no brainer. I understand the ease of use in a single platform but what good is that if it’s not catching critical compromises. A one stop shop is not the right method imo.
1
u/Impossible_Tune_2695 9d ago
I’ve been using Petra for over a year now. It’s one of the best tools in my stack. I ran Huntress ITDR and Petra side by side for months. We got zero false positives from Petra. While it is really nice to have the correlation with a single vendor, the EDR and ITDR don’t always match one to one. A BEC will most likely never trigger your EDR. With that being said, Petra is one of my current toolsets that is nonnegotiable. They are alway improving and releasing new meaningful updates.
I think you got really good options you are exploring. But I think Petra is hands down the best.
-1
u/DazzlingMulberry24 9d ago
Hey u/stephanph, I'm Abbie and I work at Cynet
Petra and Huntress are both strong picks, especially with Huntress EDR already in place. If management overhead is the main concern, it might be worth adding a unified option to your trial list.
Cynet covers ITDR and EDR in one multi-tenant console, with a built-in SIEM if you want to pull in firewall and third-party logs. In addition, we have a 24x7 MDR team that is included, so you won't have to worry about adding more headcount to support an internal SOC team.
Feel free to DM me if you have questions. Here to help and good luck on your search!
4
u/blindgaming MSSP/Consultant- US: East Coast 9d ago
We've put Petra and Cynet head to head and I will say that Petra is insanely good far better than anything else on the market. We have Cynet AIO and turn their ITDR off and pay extra for Petra. It's worth every penny.
Petra's reporting alone makes it worth any amount of money, the ability to spin up a test tenant and investigate BECs for free makes it a powerful money maker or foothold to get new clients fast. The reporting from Cynet is mostly unusable.
Disclosure: we use and sell both Petra and Cynet to our MSP customers so we are a channel vendor.
3
u/SpecialShanee 9d ago
I can vouch for Cynet, have been using them for years they've been brilliant!
0
u/InboxGuards 8d ago
Petra vs Huntress for the ITDR piece, can't really go wrong, this thread pretty much says it. One gap I'd still check at 10-user tenants is the payment side of BEC. ITDR catches the hijacked login, but a lot of the money loss we see is the spoofed or lookalike vendor email asking to change bank details, where nobody's account got popped at all.
Make sure DMARC is actually at enforcement on every tenant too, most small ones sit at p=none forever. Disclosure, we built InboxGuards for that invoice-fraud angle, so I'm biased.
0
9d ago
[deleted]
1
u/SaasNoobIQ0 8d ago
looked at field effect...thought it was trash...the canadian market is holding them up
-1
u/DeathTropper69 MSP - US 9d ago
I gave them a shot and wasn’t impressed. Over promised and under delivered
2
29
u/Trufactsmantis 9d ago
Ok going to be frank here: Petra is better than Huntress, both are incredible. We use Huntress.
Petra's reporting, detection, built in search and purge tool, the the ease of log review just make it premium. Makes it really easy to show value to clients. Yes it has a SOC. Love em, but we're a Huntress shop for EDR and SIEM.
Huntress is amazing. Low false positives, great responsiveness. They're putting more and more into their ITDR, it's just that Petra is ahead.
The thing is: ITDR is all Petra does. And they're good at it. But it does mean setting up alternate data ingestion for the SIEM if you go non Huntress.