Huntress

Huntress is a managed security platform for SMBs and MSPs, pairing EDR, identity threat detection, SIEM and awareness training with its own 24/7 SOC.

Huntress puts human threat analysts behind the security tools a small business installs. An attack is investigated and answered even when nobody in the office is watching. The Huntress Managed Security Platform belongs to Huntress Labs Incorporated, an independent company based in Columbia, Maryland, that started in 2015. One login, one help center and one trial cover every part of it. The security operations center (SOC) reviewing the alerts is staffed by Huntress itself, around the clock. Managed EDR is the core. The Huntress agent reports to the SOC, analysts confirm each threat, and the fix arrives as an incident report with remediation steps. Managed Response can carry out pre-approved actions, such as removing malicious files and persistence, once the SOC confirms a threat. A suspect machine can be cut off from the network while it keeps its link to the Huntress portal. Managed Antivirus brings Microsoft Defender under the same watch. Managed ITDR follows Microsoft 365 and Google identities for privilege escalation, login events and mail flow manipulation. Managed SIEM collects and correlates logs from endpoints, firewalls and cloud services. Managed SAT runs phishing simulations and training, and Managed ISPM hardens Microsoft 365 with expert-managed policies. The platform is aimed at small and mid-sized businesses that need threats handled around the clock but have no security team of their own. Managed service providers are the other half of its audience, running Huntress for many client organizations. They can manage Microsoft 365 hardening across tenants from a single dashboard. Each part is licensed on its own, counted by endpoints, identities, log sources or learners. Purchases go directly to Huntress or through the MSP or reseller that already supports the business. A common job begins with a laptop showing signs of an intrusion. Huntress analysts investigate, isolate the machine if needed and send the steps to finish the cleanup. On the identity side, the same SOC watches Microsoft 365 and Google Workspace accounts for takeover attempts and suspicious mail rules. Logs from tools a business already runs, such as Cisco Secure Endpoint, can be sent to Managed SIEM for investigations and compliance records. Awareness training covers the staff who receive the phishing emails in the first place. For a small business, that puts endpoints, identities, logs and people under one SOC and one login.