Powered by real-world threat intelligence across 300,000 organizations and an unrivaled 24/7 AI-centric SOC, new capabilities turn emerging attacker tradecraft into herd immunity across tens of millions of endpoints and identities

COLUMBIA, Md., Nov. 05, 2026 (GLOBE NEWSWIRE) -- Huntress today announced a wave of innovations across the Huntress Agentic Security Platform that transform intelligence from real-world cyberattacks into stronger, proactive defenses for customers and partners. Spanning identity, endpoint, SIEM, and security awareness, these advancements help businesses close security gaps before adversaries can exploit them and disrupt attacks at machine speed.

These new innovations draw on the unique scale and collective intelligence of the Huntress Agentic Security Platform. With visibility across nearly 300,000 businesses, 17 million identities, and 6 million endpoints, Huntress turns real-time threat intelligence into protection at scale. When an attack targets one organization, Huntress applies those insights to strengthen defenses across its entire fleet through automated blocking, earlier detection of hidden compromises, attack disruption, and real-time user interventions. Whether customers use a single Huntress product or the full platform, they benefit from intelligence gathered across the entire ecosystem. Combined with the expertise of Huntress’ 24/7 AI-centric SOC, these new capabilities enable defenders to anticipate and disrupt the adversary’s next move.

“Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack and leveraging our scale and elite security researchers to turn that intelligence into stronger protection,” said Prakash Ramamurthy, Chief Product Officer at Huntress. “These innovations demonstrate how we’re bringing together unrivaled human expertise, AI, and real-world threat intelligence to protect businesses at the speed adversaries operate.”

Expanded innovations for the Huntress Agentic Security Platform include:

  • Adversary Infrastructure (Managed ITDR): The newest capability in Huntress Managed ITDR, Adversary Infrastructure, turns potential fire drills into continuous protection. When Huntress confirms hosting, relay, or proxy infrastructure used in an identity attack, Managed ITDR turns that intelligence into a blocking Conditional Access policy across every eligible, opted-in Microsoft 365 tenant the same day. This blocks identity attacks at sign-in and turns one customer’s incident into protection for the broader Huntress customer fleet, before damage can be done to many.
  • Detection and Shut Down of Suspicious Service Principals (Managed ITDR): Building on intelligence from Huntress’ investigation into the ConnectWise/SkyKick vendor compromise, which exposed how attackers exploited stolen vendor credentials to access Microsoft 365 environments, Huntress rapidly expanded Managed ITDR to detect and shut down malicious service principal activity. The new feature analyzes service principal sign-ins, alerts partners through detailed incident reports, and automatically disables compromised applications, stopping threats without requiring partners to intervene. Available now for tenants with Microsoft Entra ID P1 licensing or higher, the enhancement also provides greater visibility into application permissions and activity to help partners identify and mitigate risks.
  • Lookback (Managed ITDR): For newly onboarded Microsoft 365 tenants, Lookback reviews up to 180 days of login history from before Huntress was deployed to uncover evidence of compromise tied to credential theft, token theft, adversary-in-the-middle attacks, suspicious browsers, and data center logins. If a compromise is still active, Huntress investigates and revokes the affected identity’s active sessions, protecting the tenant from lurking attackers and ensuring customers get immediate value from their Huntress deployment. During early access, Lookback helped an MSP uncover a compromised $2 million real estate wire transfer involving one of its customers, identifying suspicious activity dating back three days before onboarding and enabling the MSP to intervene and strengthen customer trust.
  • Brute Force Sentry (Managed SIEM): Detects and provides insight into brute-force activity across Windows RDP, RD Gateway, RDWeb, and Linux SSH, correlating failed sign-ins and subsequent successes across log sources. This gives customers visibility into exposed surfaces, targeted accounts, and persistent attack sources. The capability, which will be generally available November 18th, activates automatically when the required telemetry is available and clearly reports when coverage is unavailable and why.
  • Defense Drills (Managed SAT): Defense Drills put emerging attacker tradecraft recently detected by the Huntress SOC in front of users through short, hands-on simulations that show how attacks unfold and which warning signs to look for. Integrations with other products within the Huntress platform enable Defense Drills to serve as a real-time intervention to train a learner during an active compromise. For example, when a ClickFix attack is shut down by Managed EDR, it displays a pop-up explaining what it stopped and directing the user to a quick Defense Drill, where they learn what ClickFix is and how the attack works. This allows the user to learn from their mistake in real time rather than risk repeating it. Completion is recorded in the EDR incident report. This EDR-triggered training will be available to all EDR customers, regardless of SAT use, with plans to expand these interventions to other products and detections.
  • Remote Ransomware Attack Disruption (Managed EDR): Nearly 30% of ransomware cases observed by Huntress this year originated from an unprotected system, which attackers use as a foothold to conduct reconnaissance and launch attacks across the network. These remote ransomware attacks are particularly difficult for traditional endpoint security solutions to stop because they leave few conventional indicators of compromise on protected endpoints. Huntress Managed EDR uses Ransomware Canaries to detect these attacks and automatically disrupt them by blocking communication between protected systems and the compromised, unprotected system, stopping ransomware from spreading. The capability will be generally available November 30 and automatically activates on systems protected by Huntress Managed EDR.
  • Identity Posture Assessment (Managed ISPM): On-demand report that provides a clear, shareable snapshot of any Microsoft 365 tenant’s identity security posture, scored against the Huntress Identity Security Framework. The report provides actionable guidance through a prioritized list of identity security gaps and recommended next steps, with many controls Huntress can deploy through automated deployment in Huntress Managed ISPM.

At the center of this innovation is Huntress’ security DNA, bringing together its 24/7 AI-centric Security Operations Center (SOC), threat researchers, tactical response teams, and detection engineers to investigate attacks, uncover emerging adversary techniques, and turn those findings into new protections. This continuous feedback between Huntress’ frontline security experts and telemetry from the nearly 300,000 businesses across the platform enables the rapid development and deployment of capabilities informed by threats observed in the wild, creating herd immunity.

“At Courser, our goal is to give all businesses access to the same level of cybersecurity protection and expertise that larger enterprises rely on, without the cost or complexity,” said Steven Drew, Chief Technology Officer at Courser. “Huntress is an important part of that strategy, bringing advanced threat detection, expert threat research, and a 24/7 security operations center to our broader security offering. Their continued innovation helps us strengthen protection across our network of managed service providers and deliver better security outcomes for the businesses we serve.”

That same threat intelligence extends beyond technical defenses, powering informed security awareness training that helps organizations turn emerging attacker tactics into stronger human defenses.

"The fact that Managed SAT from Huntress is built on real tradecraft that their SOC is seeing in the wild has helped us demonstrate to school administrators and users how an entire district could be compromised in just a few minutes,” said Michael Codis, Systems & Network Administrator, Hunterdon County Educational Services Commission. “Showing how that risk comes to life is incredibly powerful. It helps administration of the districts we support understand just how quickly an attack can unfold and equips our users with the knowledge and skills to stay vigilant and protect themselves and our school systems against whatever kind of threat they may face."

Huntress combines innovative technology with unrivaled security expertise to help internal security teams and MSPs strengthen their defenses, respond faster, and stay ahead of emerging threats without adding operational complexity. To learn more about the Huntress Agentic Security Platform, visit: https://www.huntress.com/platform.

Additional Resources:

About Huntress
Huntress is a global cybersecurity company on a mission to make enterprise-grade products accessible to all businesses. Purpose-built from the ground up, the Huntress Agentic Security Platform unleashes end‑to‑end protection in the age of AI. From Endpoint Detection and Response (EDR) and Identity Threat Detection and Response (ITDR) to Security Information and Event Management (SIEM), Security Awareness Training (SAT), and Security Posture Management, the Huntress Agentic Security Platform is targeted protection for endpoints, identities, data, and employees, delivering trusted outcomes and valuable peace of mind.

Its 24/7 AI-centric Security Operations Center (SOC) is powered by a team of world-renowned engineers, researchers, and security analysts dedicated to stopping cyber threats before they cause harm. Huntress is often the first to respond to major hacks and incidents, with its expert security team sharing real-time tradecraft analysis and actionable advisories with the community.

Currently safeguarding more than 6 million endpoints and 17 million identities, Huntress empowers internal security and IT teams and Managed Service Providers (MSPs) worldwide to protect their businesses with enterprise-grade, accessible security products.
As long as hackers keep hacking, Huntress keeps hunting. Learn more at www.huntress.com, and follow Huntress on X, Instagram, Facebook, and LinkedIn.

‍Contact:
press@huntresslabs.com
+1 (650) 400-7833