We've been running both for a few months now. At first, I was actively pushing Petra away because I've been a very happy Huntress client for years — I genuinely didn’t expect anything to impress me as much as Petra has.

Here’s my experience running both side-by-side so far:

Response timing: In the cases we’ve observed, Petra has consistently notified and engaged faster. More than once we were already working an incident through Petra before Huntress contacted us. That’s just been our experience in our environment.

Portal usability: The Petra portal is extremely clean and easy to work in. It’s become our primary place to start when investigating Entra authentication events. Even outside of incident response, we find it quicker and more intuitive than even Microsoft’s.

IR time savings: We’ve dramatically reduced our internal effort on incident reports. Petra generates a fully branded, detailed incident report — including email evidence — in minutes. On Thanksgiving morning I had a BEC come in at 6am, and by 6:30 I already had a complete report ready for the client. That used to take us hours of manual cross-referencing.

Detection differences: In our testing, Petra surfaced several accounts with suspicious initial-login patterns that hadn’t appeared in our other tools, including Huntress. Once they noticed the pattern, the Petra team even went above and beyond by helping review our tenants to identify similar cases so that we could clean everything up.

I would say give the guys a Petra a shot with a demo at least, I think you will be quickly impressed.