This is still a vendor announcement, so the scale figures, the "herd immunity" framing and the customer stories are Huntress's own claims. Huntress has also published technical detail through its October threat roundup, its ITDR product pages and its support documentation. Those sources make it possible to separate what has shipped from what is only scheduled.
The pitch: one tenant's incident, everyone's block list
According to the announcement, Huntress has visibility across nearly 300,000 businesses, 17 million identities and 6 million endpoints. The idea is that an attack against one customer becomes protection for all of them, through automated blocking, earlier detection, attack disruption and real-time warnings to users. Huntress chief product officer Prakash Ramamurthy said the company wants to protect businesses "at the speed adversaries operate."
The roundup does confirm the endpoint number: Managed EDR passed 6 million protected endpoints in October. Huntress also says Windows is still the vast majority of its fleet, which puts these features squarely in Windows territory.
Section summary: The premise is pooled threat intelligence turned into automated defenses. The figures are Huntress's own, and the features below are where that premise either holds up or doesn't.
Managed ITDR: three new Microsoft 365 identity features
Adversary Infrastructure: Conditional Access blocks across tenants
This is the headline feature. When Huntress confirms that hosting, relay or proxy infrastructure was used in an identity attack, Managed ITDR turns that intelligence into a blocking Conditional Access policy across every eligible, opted-in Microsoft 365 tenant the same day.
Huntress's livestream page for the feature adds a step the press release leaves out. After the SOC confirms the infrastructure, detection engineers validate it against benign traffic. That matters. A shared hosting range blocked carelessly would also lock out legitimate users signing in from it.
The feature began as an emergency fix. Huntress says that in March its SOC watched a phishing-as-a-service operation turn Railway, a developer cloud platform with a spotless IP reputation, into a token-harvesting engine that hit 344 organizations. Huntress then pushed an emergency Conditional Access block to every eligible tenant and claims 305 attack attempts were stopped at the door, and no legitimate logins were affected. Adversary Infrastructure turns that one-off response into a standing process.
What admins should expect to find in their tenants:
- A Huntress-named policy. Saltdata covered the March Railway block and reported that Huntress created a Conditional Access policy called [HUNTRESS] Block - Confirmed Adversary Infrastructure, backed by a Named Location containing the IP ranges, in CIDR notation, associated with this campaign's infrastructure. The new feature may name things differently, so treat that as a reference point.
- Permission to write CA policies. Huntress's permissions documentation lists Policy.ReadWrite.ConditionalAccess among the rights Managed ITDR requests. Change-control teams should know that a third party can write policies in the tenant.
- No alerts for blocked attempts. Huntress's support documentation says attempts blocked by CAPs on their own do not generate ITDR alerts or escalations. A quiet dashboard may mean the block is working, not that nobody tried.
Saltdata also made a fair point: IP-based blocking is a valid short-term measure for confirmed adversary infrastructure, but it's a reactive control by nature. Attackers can rent new IP space far faster than anyone can update a blocklist. Treat this as an extra layer on top of phishing-resistant MFA and device-code restrictions, not a replacement for them.
Shutting down suspicious service principals
The second ITDR feature comes from the ConnectWise/SkyKick vendor compromise. In its October roundup, Huntress said it confirmed that a compromised ConnectWise Cloud Backup credential was used to obtain Graph tokens in Microsoft 365 tenants on October 15. Across unauthorized sign-ins in 162 tenants, it saw a ConnectWise Cloud Management application grant itself Global Administrator and then add secrets to other apps. Huntress also reported that Microsoft attributed the activity to Storm-0940 on October 21.
Managed ITDR now analyzes service principal sign-ins, sends incident reports to partners and automatically disables applications it judges to be compromised. Huntress says this is available now for tenants with Microsoft Entra ID P1 or higher. The roundup says the company began ingesting service principal sign-in logs across its whole fleet on October 16. The pitch for automatic disabling is that containment doesn't depend on someone catching an alert at 2 a.m.
Note the word "disables." Huntress's earlier SkyKick advice was to disable affected applications rather than delete them, which keeps the evidence. If your tenant is on Entra ID Free, this feature doesn't cover you.
Lookback: 180 days of sign-in history
For newly onboarded Microsoft 365 tenants, Lookback reviews up to 180 days of login history from before Huntress was deployed to uncover evidence of compromise tied to credential theft, token theft, adversary-in-the-middle attacks, suspicious browsers, and data center logins. If a compromise is still active, Huntress investigates and revokes the affected identity's active sessions.
The roundup says Lookback is now generally available for newly onboarded tenants, trial tenants included, and that it separates historical findings from active threats.
Huntress's example from early access: Lookback helped an MSP find suspicious activity tied to a compromised $2 million real-estate wire transfer, starting three days before onboarding. It's a strong story, but it's one case reported by the vendor, not a measured result.
The underlying point is sound. In business email compromise cases, attackers often sit in a mailbox for weeks before acting, so a tool that only watches from install day forward misses the part where they settled in.
Section summary: Adversary Infrastructure requires eligibility and opt-in. Service principal protection is live but needs Entra ID P1 or higher. Lookback is generally available for new tenants.
Managed SIEM: Brute Force Sentry for RDP and SSH
Brute Force Sentry looks for brute-force activity against Windows RDP, RD Gateway, RDWeb and Linux SSH. It links failed sign-ins to any successful sign-in that follows, across log sources, so customers can see exposed services, targeted accounts and repeat attack sources.
It becomes generally available November 18, and the roundup says it's coming to all SIEM customers. It turns on automatically when the required telemetry exists, and it reports when coverage is unavailable and why.
That last part is the useful detail. "Automatic" doesn't mean you're covered if RD Gateway logs never reach the SIEM. Check the coverage report once it ships.
Exposed RDP is still a common way in. Huntress's October roundup describes an Akira ransomware case in which the attacker got in through RDP, disabled Bitdefender services and used Rclone to copy data out before encrypting.
Managed SAT and EDR: Defense Drills during an incident
Defense Drills are short, hands-on simulations based on techniques Huntress's SOC has recently seen. The roundup says they are now generally available in Security Awareness Training.
The more interesting part is the link to EDR. When Managed EDR stops a ClickFix attack, a pop-up tells the user what was blocked and points them to a short drill explaining how ClickFix works. Completion is recorded in the EDR incident report. Huntress says this EDR-triggered training will be available to all EDR customers, whether or not they use SAT, and plans to extend it to other products and detections.
ClickFix works by convincing users to paste a command into the Windows Run box, so catching someone right after they made that mistake is good timing. Michael Codis, a systems administrator at the Hunterdon County Educational Services Commission, said Huntress's training helped show school administrators how a district could be compromised in a few minutes.
The obvious question is whether users will read the pop-up or just click past it. Huntress hasn't published completion data. Separately, the roundup mentions an early-access endpoint posture feature that can block Win + R for users who don't need it, which closes the same hole from the configuration side.
Managed EDR: stopping ransomware from unprotected machines
Huntress says nearly 30% of the ransomware cases it saw this year started on an unprotected system. The attacker uses that machine to scout the network and then encrypts files on protected endpoints over network shares. The protected machines show few of the usual signs of compromise.
The announcement gives no total case count or methodology behind that figure. Still, the pattern matches what anyone who has cleaned up after an attack launched from a forgotten server will recognize.
The fix uses Huntress's existing Ransomware Canaries. When they detect this kind of attack, Managed EDR blocks communication between protected systems and the compromised, unprotected one. Huntress says it will be generally available November 30 and will turn on automatically on systems running Managed EDR. That date is still ahead, so it's a plan, not a shipped feature.
Managed ISPM: Identity Posture Assessment
The last feature is an on-demand, shareable report on a Microsoft 365 tenant's identity security, scored against the Huntress Identity Security Framework. It lists gaps in priority order with recommended next steps, and Huntress says Managed ISPM can deploy many of the fixes automatically.
The roundup adds that the report shows which gaps Huntress can fix and which need manual action, and that it can be co-branded for customers. That's a feature aimed at MSPs who need something to show their clients. Huntress hasn't published the scoring rubric.
Release status at a glance
| Capability | Product | Status / requirement |
|---|---|---|
| Adversary Infrastructure | Managed ITDR | Eligible, opted-in M365 tenants |
| Service principal shutdown | Managed ITDR | Available now; Entra ID P1+ |
| Lookback (180 days) | Managed ITDR | GA for newly onboarded and trial tenants |
| Brute Force Sentry | Managed SIEM | GA November 18; needs telemetry |
| Defense Drills (EDR-triggered) | SAT / EDR | Drills GA in SAT; EDR trigger for all EDR customers |
| Remote ransomware disruption | Managed EDR | GA November 30; automatic |
| Identity Posture Assessment | Managed ISPM | On-demand report |
What to do if you run Huntress
- Check your Entra license tier. Service principal protection needs Entra ID P1 or higher.
- Decide on Adversary Infrastructure opt-in and record any Huntress-managed Conditional Access policies in your change log.
- Check SIEM log coverage for RDP, RD Gateway, RDWeb and SSH before November 18.
- List machines without an agent. The November 30 ransomware feature helps, but deploying an agent everywhere is still the better fix.
- Tell users the ClickFix pop-up is real, so they don't dismiss it as a phishing attempt.
The verdict
Strip away "machine speed" and "herd immunity," and these are sensible features aimed at real Microsoft 365 and Windows attack paths. The October SkyKick incident shows what happens when an app's credentials are left unwatched, and RDP brute-forcing isn't going away either.
The caveats are the fine print: opt-in rules, license tiers, telemetry requirements and two release dates that haven't arrived yet. Huntress has shown its work in places, including the Railway block numbers and the SkyKick timeline. Even so, the results are the company's own reporting, and no independent test has confirmed them.
Have Huntress-managed Conditional Access policies shown up in your tenants yet, and do you plan to opt in? Tell us in the forum.