Huntress Unveils Innovations to Enhance Proactive Cybersecurity Defenses

COLUMBIA, Md., Nov. 05, 2026 /CourierPR/ -- Huntress, a global cybersecurity company, has unveiled a series of innovations designed to enhance its Agentic Security Platform, aiming to provide businesses with proactive defenses against cyberattacks. These advancements, which span identity, endpoint, SIEM, and security awareness, are intended to close security gaps before adversaries can exploit them.

The new capabilities leverage the unique scale and collective intelligence of the Huntress Agentic Security Platform, which currently offers visibility into nearly 300,000 businesses, 17 million identities, and 6 million endpoints. When an attack targets one organization, Huntress applies insights to strengthen defenses across its entire fleet through automated blocking, earlier detection of hidden compromises, attack disruption, and real-time user interventions.

One of the key innovations is Adversary Infrastructure, a feature in Huntress Managed ITDR. When Huntress confirms hosting, relay, or proxy infrastructure used in an identity attack, Managed ITDR turns that intelligence into a blocking Conditional Access policy across every eligible, opted-in Microsoft 365 tenant the same day. This blocks identity attacks at sign-in and turns one customer’s incident into protection for the broader Huntress customer fleet, before damage can be done to many.

Another significant update is the Detection and Shut Down of Suspicious Service Principals, which builds on the company’s investigation into the ConnectWise/SkyKick vendor compromise. This feature analyzes service principal sign-ins, alerts partners through detailed incident reports, and automatically disables compromised applications, stopping threats without requiring partners to intervene. The enhancement is now available for tenants with Microsoft Entra ID P1 licensing or higher, providing greater visibility into application permissions and activity to help partners identify and mitigate risks.

Lookback, a feature for newly onboarded Microsoft 365 tenants, reviews up to 180 days of login history from before Huntress was deployed to uncover evidence of compromise tied to credential theft, token theft, adversary-in-the-middle attacks, suspicious browsers, and data center logins. If a compromise is still active, Huntress investigates and revokes the affected identity’s active sessions, protecting the tenant from lurking attackers and ensuring customers get immediate value from their Huntress deployment. During early access, Lookback helped an MSP uncover a compromised $2 million real estate wire transfer involving one of its customers, identifying suspicious activity dating back three days before onboarding and enabling the MSP to intervene and strengthen customer trust.

Brute Force Sentry, a feature in Managed SIEM, detects and provides insight into brute-force activity across Windows RDP, RD Gateway, RDWeb, and Linux SSH, correlating failed sign-ins and subsequent successes across log sources. This gives customers visibility into exposed surfaces, targeted accounts, and persistent attack sources. The capability, which will be generally available November 18th, activates automatically when the required telemetry is available and clearly reports when coverage is unavailable and why.

Defense Drills, a feature in Managed SAT, put emerging attacker tradecraft recently detected by the Huntress SOC in front of users through short, hands-on simulations that show how attacks unfold and which warning signs to look for. Integrations with other products within the Huntress platform enable Defense Drills to serve as a real-time intervention to train a learner during an active compromise. For example, when a ClickFix attack is shut down by Managed EDR, it displays a pop-up explaining what it stopped and directing the user to a quick Defense Drill, where they learn what ClickFix is and how the attack works. This allows the user to learn from their mistake in real time rather than risk repeating it. Completion is recorded in the EDR incident report. This EDR-triggered training will be available to all EDR customers, regardless of SAT use, with plans to expand these interventions to other products and detections.

Remote Ransomware Attack Disruption, a feature in Managed EDR, targets nearly 30% of ransomware cases observed by Huntress this year. These remote ransomware attacks are particularly difficult for traditional endpoint security solutions to stop because they leave few conventional indicators of compromise on protected endpoints. Huntress Managed EDR uses Ransomware Canaries to detect these attacks and automatically disrupt them by blocking communication between protected systems and the compromised, unprotected system, stopping ransomware from spreading. The capability will be generally available November 30 and automatically activates on systems protected by Huntress Managed EDR.

Identity Posture Assessment, a feature in Managed ISPM, provides an on-demand report that gives a clear, shareable snapshot of any Microsoft 365 tenant’s identity security posture, scored against the Huntress Identity Security Framework. The report provides actionable guidance through a prioritized list of identity security gaps and recommended next steps, with many controls Huntress can deploy through automated deployment in Huntress Managed ISPM.

Huntress combines innovative technology with unrivaled security expertise to help internal security teams and MSPs strengthen their defenses, respond faster, and stay ahead of emerging threats without adding operational complexity.