Huntress has expanded its Agentic Security Platform with new automated identity threat protections, managed SIEM capabilities and security awareness tools designed to help managed service providers detect and respond to attacks across customer environments.
The updates include capabilities that use intelligence from confirmed identity attacks to block malicious infrastructure across eligible Microsoft 365 tenants, identify compromised service principals and investigate historical login activity for newly onboarded customers.
The expansion reflects growing demand for security platforms that can automate threat detection and response while helping MSPs manage increasingly complex customer environments without relying entirely on manual security operations.
Huntress expands automated identity threat protection
A new capability in Huntress Managed ITDR that turns potential fire drills into continuous protection. When Huntress confirms the use of hosting, relay, or proxy infrastructure in an identity attack, Managed ITDR turns that intelligence into a blocking Conditional Access policy across every eligible, opted-in Microsoft 365 tenant the same day.
This blocks identity attacks at sign-in and turns one customer’s incident into protection for the broader Huntress customer fleet before wide-ranging damage can be done.
Building on intelligence from Huntress’ investigation into the ConnectWise/SkyKick vendor compromise, Huntress expanded Managed ITDR to detect and shut down malicious service principle activity.
This new feature analyzes service principal sign-ins, alerts partners through detailed incident reports, and automatically disables compromised applications, stopping threats without requiring partners to intervene. It is available now for tenants with Microsoft Entra ID P1 licensing or higher. The enhancement also provides greater visibility into application permissions and activity, helping partners identify and mitigate risks.
For newly onboarded Microsoft 365 tenants, Lookback reviews up to 180 days of login history from before Huntress was deployed to uncover evidence of compromise, including credential theft, token theft, adversary-in-the-middle attacks, suspicious browser activity, and data center logins.
Huntress investigates and revokes the affected identity’s active sessions if a compromise is still active, and protects the tenant from lurking attackers and ensures customers get immediate value from their Huntress deployment.
New SIEM and security training tools target emerging threats
Huntress’s Brute Force Sentry detects and provides insight into brute-force activity across Windows RDP, RD Gateway, RDWeb, and Linux SSH, correlating failed sign-ins and subsequent successes across log sources.
The capability gives customers visibility into exposed surfaces, targeted accounts, and persistent attack sources. Generally available November 18, the capability activates automatically when the required telemetry is available and clearly reports when coverage is unavailable and why.
Huntress also rolled out Defense Drills, which put emerging attacker tradecraft recently detected by the Huntress SOC in front of users through short, hands-on simulations detailing how the attacks unfolded and which warning signs to look for.
Integrations with other products within the Huntress platform enable Defense Drills to serve as a real-time intervention to train a learner during an active compromise. It allows users to learn from their mistakes in real time rather than risk repeating them. Completion is recorded in the EDR incident report.
The EDR- triggered training will be available to all EDR customers, regardless of SAT use, with plans to expand these interventions to other products and detections.
Identity posture assessments expand Microsoft 365 visibility
An on-demand report providing a clear, shareable snapshot of any Microsoft 365 tenant’s identity security posture, scored against the Huntress Identity Security Framework. The report provides actionable guidance through a prioritized list of identity security gaps and recommended next steps, featuring controls Huntress can deploy through automated deployment in Huntress Managed ISPM.
“Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack and leveraging our scale and elite security researchers to turn that intelligence into stronger protection,” said Prakash Ramamurthy, Chief Product Officer, Huntress.
“These innovations demonstrate how we’re bringing together unrivaled human expertise, AI, and real-world threat intelligence to protect businesses at the speed adversaries operate,” Ramamurthy adds.
What Huntress’s security expansion means for MSPs
Huntress’s latest platform updates reflect a broader shift in managed security services, as vendors increasingly focus on automating threat response rather than simply generating alerts for MSPs to investigate.
“At Courser, our goal is to give small and midsize businesses access to the same level of cybersecurity protection and expertise that larger enterprises rely on, without the cost or complexity,” said Steven Drew, Chief Technology Officer, Courser.
“Huntress is an important part of that strategy, bringing advanced threat detection, expert threat research, and a 24/7 security operations center to our broader security offering. Their continued innovation helps us strengthen protection across our network of managed service providers and deliver better security outcomes for the businesses we serve,” Drew continued.
That transition is becoming more important as providers face growing security workloads. Recent N-able research covered by Channel Insider found that 86.8% of surveyed MSPs reported rising security alert volumes, while only 23.6% fully trusted autonomous remediation.
Huntress’s new Managed ITDR capabilities could address some of those challenges by translating intelligence from confirmed attacks into protections across eligible customer environments, potentially reducing manual investigation and response workloads.
The expansion also builds on Huntress’s broader channel strategy. As Channel Insider previously reported, the company expanded distribution relationships earlier this year to reach more MSPs and resellers.
For partners, the opportunity extends beyond operational efficiency. Identity posture assessments, automated threat containment, and continuous monitoring could support more proactive managed security offerings and demonstrate measurable value to customers.