Huntress has announced a wave of new capabilities across its Agentic Security Platform, designed to turn intelligence gathered from live attacks into proactive defences for every customer, rather than leaving each incident as one organisation’s problem.
The updates span Managed ITDR, Managed EDR, Managed SIEM, Managed SAT and Managed ISPM. They draw on the company’s visibility across nearly 300,000 businesses, 17 million identities and 6 million endpoints, combined with its 24/7 AI-centric Security Operations Center (SOC).
The principle is simple: when an attack targets one organisation, Huntress applies what it learns across its entire fleet through automated blocking, earlier detection of hidden compromises, attack disruption and real-time user interventions.
“Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack and leveraging our scale and elite security researchers to turn that intelligence into stronger protection,” said Prakash Ramamurthy, Chief Product Officer at Huntress. “These innovations demonstrate how we’re bringing together unrivaled human expertise, AI, and real-world threat intelligence to protect businesses at the speed adversaries operate.”
Blocking identity attacks at sign-in
The headline addition to Managed ITDR is Adversary Infrastructure. When Huntress confirms hosting, relay or proxy infrastructure being used in an identity attack, it converts that intelligence into a blocking Conditional Access policy across every eligible, opted-in Microsoft 365 tenant the same day. One customer’s incident becomes protection for the wider customer base before the attacker can move on to the next target.
Managed ITDR also now detects and shuts down suspicious service principals. The feature builds on Huntress’ investigation into the ConnectWise/SkyKick vendor compromise, in which attackers used stolen vendor credentials to access Microsoft 365 environments. It analyses service principal sign-ins, issues detailed incident reports and automatically disables compromised applications without partner intervention. It is available now for tenants with Microsoft Entra ID P1 licensing or higher.
A third ITDR feature, Lookback, reviews up to 180 days of login history for newly onboarded Microsoft 365 tenants. It looks for evidence of credential theft, token theft, adversary-in-the-middle attacks, suspicious browsers and data centre logins that predate deployment. Where a compromise is still active, Huntress investigates and revokes the affected identity’s sessions. During early access, Lookback helped an MSP uncover a compromised $2 million real estate wire transfer, with suspicious activity dating back three days before onboarding.
Disrupting remote ransomware
Huntress says nearly 30% of the ransomware cases it observed this year originated from an unprotected system, which attackers use as a foothold for reconnaissance and to launch attacks across the network. Because these remote attacks leave few conventional indicators on protected endpoints, they are hard for traditional endpoint tools to stop.
Managed EDR now uses Ransomware Canaries to detect this activity and automatically block communication between protected systems and the compromised, unprotected machine, stopping the spread. The capability becomes generally available on 30 November and activates automatically on systems protected by Managed EDR.
Brute force visibility and identity posture
Brute Force Sentry, a new Managed SIEM capability, detects brute-force activity across Windows RDP, RD Gateway, RDWeb and Linux SSH, correlating failed sign-ins with subsequent successes across log sources. Customers gain visibility into exposed surfaces, targeted accounts and persistent attack sources. It activates automatically when the required telemetry is available, reports clearly when coverage is unavailable and why, and will be generally available on 18 November.
Managed ISPM adds an on-demand Identity Posture Assessment: a shareable snapshot of any Microsoft 365 tenant’s identity security posture, scored against the Huntress Identity Security Framework, with a prioritised list of gaps and recommended next steps.
Training users mid-attack
On the human side, Managed SAT introduces Defense Drills: short, hands-on simulations built from attacker tradecraft recently detected by the Huntress SOC. Integration with Managed EDR means the drills can act as a real-time intervention. When a ClickFix attack is shut down, the user sees a pop-up explaining what was stopped and is directed to a quick drill on how ClickFix works. The EDR incident report records completion. The EDR-triggered training will be available to all EDR customers, whether or not they use SAT.
“The fact that Managed SAT from Huntress is built on real tradecraft that their SOC is seeing in the wild has helped us demonstrate to school administrators and users how an entire district could be compromised in just a few minutes,” said Michael Codis, Systems & Network Administrator, Hunterdon County Educational Services Commission. “Showing how that risk comes to life is incredibly powerful.”
Huntress says the continuous feedback loop between its SOC analysts, threat researchers, tactical response teams, and detection engineers, combined with telemetry from across its customer base, allows it to develop and deploy protections informed by threats observed in the wild.
