Huntress expands Agentic Security Platform to strengthen cyber defenses. Huntress announced a series of enhancements to its Agentic Security Platform, designed to turn intelligence gathered from real-world cyberattacks into more proactive security defenses for customers and partners. Covering identity protection, endpoint security, SIEM, and security awareness, the new capabilities help organizations identify and address vulnerabilities before attackers can exploit them. By leveraging AI-driven automation and threat intelligence, Huntress aims to help businesses detect and disrupt cyberattacks at machine speed. These new innovations draw on the unique scale and collective intelligence of the Huntress Agentic Security Platform. With visibility across nearly 300,000 businesses, 17 million identities, and 6 million endpoints, Huntress turns real-time threat intelligence into protection at scale. When an attack targets one organization, Huntress applies those insights to strengthen defenses across its entire fleet through automated blocking, earlier detection of hidden compromises, attack disruption, and real-time user interventions. Whether customers use a single Huntress product or the full platform, they benefit from intelligence gathered across the entire ecosystem. Combined with the expertise of Huntress' 24/7 AI-centric SOC, these new capabilities enable defenders to anticipate and disrupt the adversary's next move. "Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack and leveraging our scale and elite security researchers to turn that intelligence into stronger protection," said Prakash Ramamurthy, Chief Product Officer at Huntress. "These innovations demonstrate how we're bringing together unrivaled human expertise, AI, and real-world threat intelligence to protect businesses at the speed adversaries operate." Compare Security Expanded innovations for the Huntress Agentic Security Platform include: * Adversary Infrastructure (Managed ITDR): The newest capability in Huntress Managed ITDR, Adversary Infrastructure, turns potential fire drills into continuous protection. When Huntress confirms hosting, relay, or proxy infrastructure used in an identity attack, Managed ITDR turns that intelligence into a blocking Conditional Access policy across every eligible, opted-in Microsoft 365 tenant the same day. This blocks identity attacks at sign-in and turns one customer's incident into protection for the broader Huntress customer fleet, before damage can be done to many. * Detection and Shut Down of Suspicious Service Principals (Managed ITDR): Building on intelligence from Huntress' investigation into the ConnectWise/SkyKick vendor compromise, which exposed how attackers exploited stolen vendor credentials to access Microsoft 365 environments, Huntress rapidly expanded Managed ITDR to detect and shut down malicious service principal activity. The new feature analyzes service principal sign-ins, alerts partners through detailed incident reports, and automatically disables compromised applications, stopping threats without requiring partners to intervene. Available now for tenants with Microsoft Entra ID P1 licensing or higher, the enhancement also provides greater visibility into application permissions and activity to help partners identify and mitigate risks. * Lookback (Managed ITDR): For newly onboarded Microsoft 365 tenants, Lookback reviews up to 180 days of login history from before Huntress was deployed to uncover evidence of compromise tied to credential theft, token theft, adversary-in-the-middle attacks, suspicious browsers, and data center logins. If a compromise is still active, Huntress investigates and revokes the affected identity's active sessions, protecting the tenant from lurking attackers and ensuring customers get immediate value from their Huntress deployment. During early access, Lookback helped an MSP uncover a compromised $2 million real estate wire transfer involving one of its customers, identifying suspicious activity dating back three days before onboarding and enabling the MSP to intervene and strengthen customer trust. * Brute Force Sentry (Managed SIEM): Detects and provides insight into brute-force activity across Windows RDP, RD Gateway, RDWeb, and Linux SSH, correlating failed sign-ins and subsequent successes across log sources. This gives customers visibility into exposed surfaces, targeted accounts, and persistent attack sources. The capability, which will be generally available November 18th, activates automatically when the required telemetry is available and clearly reports when coverage is unavailable and why. * Defense Drills (Managed SAT): Defense Drills put emerging attacker tradecraft recently detected by the Huntress SOC in front of users through short, hands-on simulations that show how attacks unfold and which warning signs to look for. Integrations with other products within the Huntress platform enable Defense Drills to serve as a real-time intervention to train a learner during an active compromise. For example, when a ClickFix attack is shut down by Managed EDR, it displays a pop-up explaining what it stopped and directing the user to a quick Defense Drill, where they learn what ClickFix is and how the attack works. This allows the user to learn from their mistake in real time rather than risk repeating it. Completion is recorded in the EDR incident report. This EDR-triggered training will be available to all EDR customers, regardless of SAT use, with plans to expand these interventions to other products and detections. * Identity Posture Assessment (Managed ISPM): On-demand report that provides a clear, shareable snapshot of any Microsoft 365 tenant's identity security posture, scored against the Huntress Identity Security Framework. The report provides actionable guidance through a prioritized list of identity security gaps and recommended next steps, with many controls Huntress can deploy through automated deployment in Huntress Managed ISPM. At the center of this innovation is Huntress' security DNA, bringing together its 24/7 AI-centric Security Operations Center (SOC), threat researchers, tactical response teams, and detection engineers to investigate attacks, uncover emerging adversary techniques, and turn those findings into new protections. This continuous feedback between Huntress' frontline security experts and telemetry from the nearly 300,000 businesses across the platform enables the rapid development and deployment of capabilities informed by threats observed in the wild, creating herd immunity. Compare Security "At Courser, our goal is to give small and midsize businesses access to the same level of cybersecurity protection and expertise that larger enterprises rely on, without the cost or complexity," said Steven Drew, Chief Technology Officer at Courser. "Huntress is an important part of that strategy, bringing advanced threat detection, expert threat research, and a 24/7 security operations center to our broader security offering. Their continued innovation helps us strengthen protection across our network of managed service providers and deliver better security outcomes for the businesses we serve." Huntress combines innovative technology with unrivaled security expertise to help internal security teams and MSPs strengthen their defenses, respond faster, and stay ahead of emerging threats without adding operational complexity. To learn more about the Huntress Agentic Security Platform, visit the website here.

The mechanics of herd immunity: Huntress and the agentic era. COLUMBIA, MD - November 05, 2026 In the modern theater of cyber warfare, the most profound asymmetry lies not in capital, but in speed. Threat actors have fully operationalized automation, launching machine-speed attacks that exploit vulnerabilities, hijack sessions, and deploy ransomware before a human analyst can even open a ticket. For the enterprise giants, the answer has been to build massive, AI-driven security operations centers. But for the vast middle market - the small-to-medium businesses (SMBs) and the Managed Service Providers (MSPs) that serve them - the headwinds of this automated threat landscape have often felt insurmountable. Today, Huntress announced a sweeping wave of innovations across its Agentic Security Platform, signaling a structural shift in how the middle market defends itself. By rolling out new capabilities across identity, endpoint, and security awareness, the Maryland-based firm is attempting to solve the speed asymmetry. The strategy is built on a concept that is rare in cybersecurity: operationalized herd immunity. With visibility across nearly 300,000 businesses, 17 million identities, and 6 million endpoints, Huntress is taking the telemetry of isolated attacks and weaponizing it into collective, automated defense. It is a masterclass in building permanence and resilience in an unpredictable global landscape. The network effect: operationalizing herd immunity. The most strategically significant update in this rollout is the introduction of Adversary Infrastructure within Huntress's Managed Identity Threat Detection and Response (ITDR) suite. Historically, if an attacker used a specific proxy or hosting infrastructure to launch an identity attack against a company in Ohio, a company in London remained vulnerable to that exact same infrastructure until threat feeds were manually updated and policies deployed. Huntress has collapsed that timeline. When its Security Operations Center (SOC) confirms malicious hosting, relay, or proxy infrastructure, the platform translates that intelligence into a blocking Conditional Access policy across every eligible, opted-in Microsoft 365 tenant on the same day. It blocks identity attacks at sign-in, effectively turning one customer's incident into an automated shield for the broader fleet. "Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack and leveraging our scale and elite security researchers to turn that intelligence into stronger protection," said Prakash Ramamurthy, Chief Product Officer at Huntress. However, fleet-wide automation carries inherent operational risks. Automated Conditional Access policies can inadvertently block legitimate users if false positives occur, leading to business disruption. Furthermore, this specific capability requires Microsoft Entra ID P1 licensing or higher. For MSPs managing clients on basic Microsoft 365 tiers, unlocking this "herd immunity" will require upselling clients to higher licensing brackets. Yet, for those equipped with the right licensing, the ability to counter automated attacks with automated, cross-tenant policy enforcement represents a massive leap forward in structural resilience. Onboarding in reverse: the anatomy of pre-existing breaches. One of the most insidious challenges in the MSP space is inheriting a client who is already silently compromised. Attackers frequently utilize adversary-in-the-middle (AiTM) tactics and session token theft to bypass multi-factor authentication, lying dormant in a network to monitor communications and plan financial fraud. To address this, Huntress introduced "Lookback," a feature that essentially turns the standard onboarding process into an active incident response engagement. Upon deployment, Lookback scans up to 180 days of a Microsoft 365 tenant's login history to uncover evidence of credential theft, suspicious browsers, and data center logins that occurred long before Huntress was ever installed. The efficacy of this retrospective approach has already been tested in the field. During early access, the Lookback feature helped an MSP uncover a compromised $2 million real estate wire transfer. The tool identified suspicious activity dating back three days prior to the MSP taking over the account, allowing for immediate intervention. By investigating and revoking the affected identity's active sessions, Huntress neutralizes lurking attackers, ensuring that the foundation of a new client relationship is built on a genuinely clean slate. "Security onboarding is no longer just about deploying agents; it is an active incident response engagement from day one," noted an independent cybersecurity analyst specializing in identity architecture. "If you aren't looking backward when you deploy a new tool, you are likely building a fortress around an enemy that is already inside the gates." Unmanaged risks and the agentic reality. The term "agentic AI" has dominated industry discourse in 2026, with giants like CrowdStrike, SentinelOne, and Microsoft pushing the narrative of autonomous AI agents that can plan, reason, and execute multi-step security tasks without human intervention. Huntress utilizes the "agentic" terminology, but its execution is distinctly hybrid. Rather than relying on purely autonomous black-box AI, Huntress uses AI to connect signals and cut through noise, heavily augmenting a 24/7 human SOC. This hybrid approach is critical when dealing with complex, destructive events like ransomware. According to Huntress's internal telemetry, nearly 30% of ransomware cases observed this year originated from an unprotected, unmanaged system - such as a personal device or shadow IT - which attackers use as a beachhead to launch attacks across the corporate network. To combat this, the new Remote Ransomware Attack Disruption capability within Managed EDR utilizes Ransomware Canaries. When these decoy files detect encryption activity stemming from an unmanaged device, the platform automatically disrupts the attack by blocking network communication between the protected systems and the compromised endpoint. It is a decisive, automated action that stops lateral movement dead in its tracks. Similarly, Huntress has expanded its Managed ITDR to detect and shut down suspicious service principals. Born out of the company's investigation into the ConnectWise/SkyKick vendor compromise - where attackers exploited stolen vendor credentials to access Microsoft 365 environments - this feature automatically disables compromised applications. It stops supply chain threats without requiring the MSP to manually intervene, proving that agentic automation is most valuable when applied to highly specific, high-risk behaviors. Training at the point of failure. While automated network isolation and fleet-wide conditional access policies address the technical mechanics of a breach, Huntress is also targeting the human element through its new Defense Drills. Traditionally, Security Awareness Training (SAT) has been a compliance-driven, scheduled exercise disconnected from real-world events. Defense Drills integrate directly with the platform's EDR. If an employee triggers a ClickFix attack and the EDR shuts it down, the user is immediately served a pop-up explaining what was stopped, directing them to a short, hands-on simulation of the exact tradecraft they just encountered. "The fact that Managed SAT from Huntress is built on real tradecraft that their SOC is seeing in the wild has helped us demonstrate to school administrators and users how an entire district could be compromised in just a few minutes," said Michael Codis, Systems & Network Administrator for the Hunterdon County Educational Services Commission. "Showing how that risk comes to life is incredibly powerful." By intervening at the exact moment of failure, Huntress transforms a near-miss into a high-retention learning event. It is a microcosm of the company's broader strategy: taking the reality of the threat landscape and engineering a system that learns, adapts, and hardens itself in real time. "At Courser, our goal is to give all businesses access to the same level of cybersecurity protection and expertise that larger enterprises rely on, without the cost or complexity," said Steven Drew, Chief Technology Officer at Courser. "Their continued innovation helps us strengthen protection across our network of managed service providers and deliver better security outcomes for the businesses we serve." In an era where the velocity of cyber threats continues to accelerate, the identifying mark of a winner is no longer just the ability to detect an anomaly, but the capacity to structurally inoculate the broader ecosystem against it. With this latest wave of platform innovations, Huntress is proving that true resilience is not achieved in isolation, but through the mechanics of collective, automated defense. Topics & related. Product Launch Agentic AI Ransomware Identity & Access Management Cybersecurity Are you a relevant expert who could contribute your opinion or insights to this article? BriefGlance'd love to hear from you. BriefGlance will give you full credit for your contribution. UAID: 54188

Huntress adds endpoint Security Controls to disrupt ClickFix attacks before malware executes. - Huntress announced additional attack-reduction capabilities within its managed endpoint security offering, focusing on techniques associated with ClickFix social engineering attacks. - ClickFix Threats: Attackers use deceptive instructions to persuade employees to execute malicious commands, often disguising the activity as troubleshooting or verification procedures. - Windows Run Dialog Protection: Huntress introduced the ability to block access to the Windows Run dialog for users who do not require it, reducing opportunities for this attack technique. - Additional Restrictions: Planned capabilities include Command Prompt restrictions, providing organizations with more options for limiting unnecessary access to system execution tools. - Layered Security: Controls complement endpoint detection and response by attempting to prevent malicious activity before attackers successfully execute commands. - Operational Considerations: MSPs must balance tighter endpoint restrictions with legitimate user requirements, particularly in environments where employees rely on administrative utilities or specialized applications. - MSSP takeaway: Review endpoint security policies and identify users who do not require Windows command execution tools. Preventive controls, security awareness training and managed detection services can work together to reduce exposure to social engineering attacks.