Huntress has recently unveiled a series of new features across its Agentic Security Platform, aimed at transforming intelligence gathered from live cyberattacks into proactive defenses for all clients. This strategic move sidesteps the problem of allowing individual incidents to remain isolated to one organization. Instead, Huntress works to leverage collective intelligence, thereby fostering an environment of comprehensive protection.
The updates are extensive and span several key areas, including Managed ITDR (Identity Threat Detection and Response), Managed EDR (Endpoint Detection and Response), Managed SIEM (Security Information and Event Management), Managed SAT (Security Awareness Training), and Managed ISPM (Identity Security Posture Management). They capitalize on the company’s expansive visibility, which incorporates data from nearly 300,000 businesses, 17 million identities, and 6 million endpoints. This visibility is further enhanced by the continuous monitoring capabilities of its 24/7 AI-driven Security Operations Center (SOC).
The core principle of Huntress’s approach is elegantly straightforward: when one organization suffers an attack, the insights gained from that incident are applied across the entire customer base. This is accomplished through automated blocking mechanisms, the earlier detection of concealed compromises, disruption of attacks, and real-time interventions for users. By synthesizing these elements, Huntress aims to transform reactive measures into proactive defenses.
Prakash Ramamurthy, Huntress’s Chief Product Officer, emphasized the importance of knowing the adversary better than anyone else in order to anticipate their next moves. He articulated this concept by stating, “Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack.” He further highlighted how Huntress combines elite human expertise, advanced AI capabilities, and real-world threat intelligence to provide timely and effective protection against emerging threats.
One of the standout features included in the latest update is the addition of Adversary Infrastructure within Managed ITDR. This feature empowers Huntress to confirm the infrastructure—such as hosting, relay, or proxy services—being employed in identity attacks. The intelligence gathered is then converted into a blocking Conditional Access policy that can be deployed across every eligible Microsoft 365 tenant on the same day. This proactive approach ensures that one client’s incident translates into a protective measure for others before attackers can pivot to a new target.
Additionally, Managed ITDR has enhanced its capabilities to detect and promptly shut down suspicious service principals. This feature arose from an investigation into the ConnectWise/SkyKick vendor compromise, where attackers exploited stolen vendor credentials to penetrate Microsoft 365 environments. Huntress’s new detection capabilities analyze service principal sign-ins, generate comprehensive incident reports, and automatically deactivate any compromised applications, all without requiring partner intervention. This enhancement is now accessible to tenants utilizing Microsoft Entra ID P1 licensing or higher.
A further innovation, dubbed Lookback, allows for the analysis of up to 180 days of login history for newly onboarded Microsoft 365 tenants. This feature specifically targets the detection of credential and token theft, adversary-in-the-middle attacks, and identifies suspicious browser activity and data center logins that occurred prior to the tenant’s actual deployment. In cases where an active compromise is detected, Huntress will conduct an investigation and terminate the affected identity’s sessions. Notably, during an early access phase, Lookback helped a Managed Service Provider (MSP) uncover a compromised $2 million real estate wire transfer, revealing suspicious activity that dated back to three days before the tenant’s onboarding.
In the fight against ransomware, Huntress has observed that nearly 30% of the ransomware cases reported in 2023 originated from unprotected systems. Attackers use these vulnerable points as footholds for reconnaissance, allowing them to launch extensive network attacks. To counter this, the Managed EDR now utilizes Ransomware Canaries, which effectively detect such activities and prevent communication between compromised systems and protected endpoints, thereby halting potential outbreaks. This capability is set to be generally available starting November 30 and will be automatically activated for systems already protected by Managed EDR.
The new Managed SIEM capability, known as Brute Force Sentry, introduces advanced detection for brute-force sign-in attempts across various platforms, such as Windows RDP and Linux SSH. It correlates failed attempts with subsequent successes across different log sources, thereby providing customers with invaluable insights into exposed attack surfaces and persistently targeted accounts. This feature will automatically activate when the necessary telemetry is available and will officially launch on November 18.
On the user training front, Huntress has rolled out Managed SAT, which features Defense Drills—short, hands-on simulations inspired by recent attacker tactics identified by the Huntress SOC. This initiative is integrated with Managed EDR, enabling drills to take place in real-time. When a ClickFix attack is successfully neutralized, the user receives an instant pop-up explaining the stopped attack and is directed toward a quick drill on the ClickFix methodology. Instances of training completion are documented in the EDR incident report, thereby enhancing user awareness and security posture.
Michael Codis, Systems and Network Administrator at Hunterdon County Educational Services Commission, remarked on the effectiveness of the Managed SAT program: “The fact that Managed SAT from Huntress is built on real tradecraft that their SOC is seeing in the wild has helped us demonstrate to school administrators and users how an entire district could be compromised in just a few minutes.”
Huntress’s continuous feedback loop—ingrained in the collaborative environment between SOC analysts, threat researchers, tactical response teams, and detection engineers—enables the company to adapt and develop protective solutions based on live threats observed across its diverse customer landscape.
Through these innovative advancements, Huntress is not only enhancing its own platform’s capabilities but is also paving the way for a collective defense strategy that ultimately aims to provide comprehensive protection against the increasingly sophisticated threat landscape that organizations face today.