Huntress has introduced a set of new security tools across its platform, spanning identity, endpoint, SIEM and security awareness products.
The cyber security company said the releases are based on threat intelligence gathered across nearly 300,000 businesses, 17 million identities and 6 million endpoints. The new functions are intended to turn signs of active attacks into broader protections for customers using different parts of the Huntress platform.
One of the new features is Adversary Infrastructure within Huntress Managed ITDR. The tool applies blocking policies across eligible Microsoft 365 tenants when Huntress identifies hosting, relay or proxy infrastructure used in an identity attack.
Huntress has also updated Managed ITDR to focus on suspicious service principals. The company said it expanded the product following its investigation into the ConnectWise and SkyKick compromise, in which attackers used stolen vendor credentials to access Microsoft 365 environments.
The feature analyses service principal sign-ins, alerts partners through incident reports and can automatically disable compromised applications. It is available for tenants with Microsoft Entra ID P1 licensing or higher.
A separate function called Lookback reviews up to 180 days of login history for newly onboarded Microsoft 365 tenants. It is designed to identify signs of earlier compromise linked to credential theft, token theft, adversary-in-the-middle attacks, suspicious browsers and data centre logins.
If Huntress determines a compromise remains active, it can revoke active sessions for the affected identity. An early-access use case helped a managed service provider identify suspicious activity tied to a compromised US$2 million real estate wire transfer.
Attack monitoring
In Managed SIEM, Huntress has added Brute Force Sentry, a tool that detects brute-force activity across Windows RDP, RD Gateway, RDWeb and Linux SSH. It correlates failed and successful sign-ins across multiple log sources to show targeted accounts, exposed services and persistent attack sources.
Huntress has also added a user training feature called Defence Drills to Managed SAT. It presents staff with short simulations based on attacker behaviour recently seen by Huntress security operations teams.
The training can also be triggered during an active incident. For example, if Managed EDR stops a ClickFix attack, the user receives a pop-up explaining what was blocked and directing them to a short training exercise on how the attack works.
Remote ransomware attack disruption is another new function in Managed EDR. Huntress said it uses ransomware canaries to detect attacks that begin on an unprotected machine and then spread across a network by communicating with protected systems.
According to the company, nearly 30% of the ransomware cases it observed this year began on an unprotected system. The new control is intended to block communication between a protected machine and the compromised unprotected system to stop the spread.
The final addition in the announcement is Identity Posture Assessment within Managed ISPM. Huntress described it as an on-demand report that scores a Microsoft 365 tenant against its identity security framework and produces a prioritised list of security gaps and suggested next steps.
Prakash Ramamurthy, Chief Product Officer at Huntress, said the releases reflect the company's effort to turn operational threat intelligence into defensive measures across its customer base.
"Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack and leveraging our scale and elite security researchers to turn that intelligence into stronger protection," said Prakash Ramamurthy, Chief Product Officer, Huntress.
"These innovations demonstrate how we're bringing together unrivalled human expertise, AI, and real-world threat intelligence to protect businesses at the speed adversaries operate," Ramamurthy said.
Customer response
Huntress said the platform is used by internal security teams and managed service providers. Customer comments included in the announcement focused on the value of the company's research and round-the-clock operations support.
"At Courser, our goal is to give all businesses access to the same level of cybersecurity protection and expertise that larger enterprises rely on, without the cost or complexity," said Steven Drew, Chief Technology Officer, Courser.
"Huntress is an important part of that strategy, bringing advanced threat detection, expert threat research, and a 24/7 security operations centre to our broader security offering. Their continued innovation helps us strengthen protection across our network of managed service providers and deliver better security outcomes for the businesses we serve," Drew said.
Huntress also said the same threat intelligence informs its employee awareness training products, with examples drawn from tactics observed by its security operations centre.
"The fact that Managed SAT from Huntress is built on real tradecraft that their SOC is seeing in the wild has helped us demonstrate to school administrators and users how an entire district could be compromised in just a few minutes," said Michael Codis, Systems & Network Administrator, Hunterdon County Educational Services Commission.
"Showing how that risk comes to life is incredibly powerful. It helps administration of the districts we support understand just how quickly an attack can unfold and equips our users with the knowledge and skills to stay vigilant and protect themselves and our school systems against whatever kind of threat they may face," Codis said.