Huntress Identifies Key Cyber Threats in New Tragic Quadrant Ranking

• •RMM abuse is the most common threat, involved in 45% of incidents.
• •Mailbox manipulation and adversary-in-the-middle attacks are significant identity threats.
• •The Tragic Quadrant ranks threats based on prevalence and potential damage.

Huntress has released its Tragic Quadrant, highlighting the most common cyber threats affecting businesses in 2026. The ranking focuses on two factors: the prevalence of tactics and their potential for causing significant damage. Key threats include Remote Monitoring and Management (RMM) abuse, which accounted for 45% of endpoint incidents in Q1 2026. Mailbox manipulation and adversary-in-the-middle attacks are also notable, comprising 24.6% and 18.9% of identity threat signals, respectively. The data is based on telemetry from over 5 million endpoints and 15 million identities across nearly 300,000 organizations. Huntress emphasizes that many of these tactics exploit trusted tools and workflows, making them particularly dangerous. The report suggests that while AI is enhancing some attacks, it has not fundamentally changed the techniques used by attackers.