As attackers use automation and AI to scale their campaigns, defenders are under pressure to respond just as quickly. Cybersecurity company Huntress believes the answer is to combine AI with human expertise rather than replace one with the other, and to make sure every attack it sees strengthens defences everywhere else.
The company has announced a wave of new capabilities across its Agentic Security Platform, spanning identity, endpoint, SIEM and security awareness. They are powered by real-world threat intelligence from nearly 300,000 businesses, 17 million identities and 6 million endpoints, and by Huntress’ 24/7 AI-centric Security Operations Center (SOC).
“Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack and leveraging our scale and elite security researchers to turn that intelligence into stronger protection,” said Prakash Ramamurthy, Chief Product Officer at Huntress. “These innovations demonstrate how we’re bringing together unrivaled human expertise, AI, and real-world threat intelligence to protect businesses at the speed adversaries operate.”
A feedback loop between people and machines
At the centre of the launch is what Huntress calls its security DNA: a continuous feedback loop between its SOC analysts, threat researchers, tactical response teams and detection engineers, and telemetry from across its customer base. Human experts investigate attacks and uncover emerging techniques. The platform then turns those findings into automated protections deployed at scale.
Huntress describes the result as herd immunity. When an attack targets one organisation, the insights are applied across the entire fleet through automated blocking, earlier detection of hidden compromises, attack disruption and real-time user interventions.
From one confirmed attack to fleet-wide protection
The clearest example is Adversary Infrastructure, a new capability in Huntress Managed ITDR. Once Huntress confirms hosting, relay or proxy infrastructure being used in an identity attack, it turns that intelligence into a blocking Conditional Access policy across every eligible, opted-in Microsoft 365 tenant on the same day. Attackers are stopped at sign-in before they can reach the next victim.
Managed ITDR can also now detect and automatically disable compromised service principals, an addition shaped by Huntress’ investigation into the ConnectWise/SkyKick vendor compromise, in which attackers used stolen vendor credentials to access Microsoft 365 environments.
Analysis at scale, in both directions
Several of the new features rely on automated analysis of large volumes of data. Lookback reviews up to 180 days of login history for newly onboarded Microsoft 365 tenants, looking for evidence of credential theft, token theft, adversary-in-the-middle attacks and suspicious logins that predate deployment. During early access, it helped a managed service provider uncover a compromised $2 million real estate wire transfer, with suspicious activity dating back three days before onboarding.
Brute Force Sentry, a new Managed SIEM capability, correlates failed and successful sign-ins across Windows RDP, RD Gateway, RDWeb and Linux SSH logs to expose targeted accounts and persistent attack sources. It becomes generally available on 18 November.
Meanwhile, Managed EDR will automatically disrupt remote ransomware attacks launched from unprotected systems, which Huntress says accounted for nearly 30% of the ransomware cases it observed this year. Using Ransomware Canaries, it detects the activity and blocks communication between protected systems and the compromised machine. The capability becomes generally available on 30 November.
Training at the speed of the SOC
Huntress is applying the same approach to the human layer. Defense Drills are short, hands-on simulations built from attacker tradecraft recently detected by its SOC, so training keeps pace with the techniques being used in the wild. Integrated with Managed EDR, they can also act as a real-time intervention. When a ClickFix attack is shut down, the user sees a pop-up explaining what was stopped and is directed to a quick drill on how the attack works.
“The fact that Managed SAT from Huntress is built on real tradecraft that their SOC is seeing in the wild has helped us demonstrate to school administrators and users how an entire district could be compromised in just a few minutes,” said Michael Codis, Systems & Network Administrator, Hunterdon County Educational Services Commission. “Showing how that risk comes to life is incredibly powerful.”
Huntress says the approach is designed to help internal security teams and managed service providers strengthen their defences and respond faster without adding operational complexity.
