Cybersecurity firm Huntress uses ‘herd immunity’ approach to protect businesses from hackers
When one business is attacked, Huntress now uses what it learns to protect nearly 300,000 others, often on the same day.
Cyberattacks on businesses rarely happen just once. Criminals reuse the same tools, tricks and servers against target after target, and companies that are hit usually have to deal with the damage alone.
Cybersecurity company Huntress is trying to change that. It has announced a set of new protections built on a simple principle: what hits one business should protect all the others.
Huntress keeps watch over nearly 300,000 organisations, 17 million user accounts and 6 million computers and servers worldwide, supported by a security operations centre that runs 24 hours a day. When its team confirms an attack on one customer, the new features turn that knowledge into automatic protection for the rest of its customer base.
“Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack and leveraging our scale and elite security researchers to turn that intelligence into stronger protection,” said Prakash Ramamurthy, Chief Product Officer at Huntress.
“These innovations demonstrate how we’re bringing together unrivalled human expertise, AI, and real-world threat intelligence to protect businesses at the speed adversaries operate.”
Stopping repeat attacks
One of the most significant additions targets attacks on Microsoft 365 accounts, which many businesses rely on for email and documents. When Huntress confirms that hackers are using particular servers to break into accounts, it can block those servers for every eligible customer who has opted in, on the same day. The next time the attackers try the same approach on a different business, they are stopped at the login screen.
Finding intruders already inside
Hackers are often inside a company’s systems long before anyone notices. A new feature called Lookback checks up to six months of login history when a business first signs up with Huntress, looking for signs that criminals have already gained access.
In one early case, it helped an IT provider discover that a business handling a $2 million property payment had been compromised three days before Huntress was switched on, giving the provider the chance to step in.
Ransomware from the blind spots
Huntress found that nearly 30% of the ransomware attacks it saw this year started on a computer with no security software installed. Criminals use these forgotten or unprotected machines as a launchpad to attack the rest of a company’s network.
From 30 November, Huntress will automatically detect this kind of attack and cut the unprotected machine off from the company’s protected systems, stopping the ransomware from spreading.
Teaching staff in the moment
Employees are often the first target for hackers, so Huntress has also changed how it trains them. Its new Defense Drills are short, hands-on exercises based on real attacks its security team is seeing right now.
They can also be triggered in real time. If an employee falls for a scam known as ClickFix, which tricks people into running harmful commands on their computer, and Huntress stops the attack, the employee sees a pop-up explaining what happened and is directed to a quick lesson on how the scam works. The aim is to help people learn from the mistake straight away rather than repeat it.
“The fact that Managed SAT from Huntress is built on real tradecraft that their SOC is seeing in the wild has helped us demonstrate to school administrators and users how an entire district could be compromised in just a few minutes,” said Michael Codis, Systems & Network Administrator, Hunterdon County Educational Services Commission. “Showing how that risk comes to life is incredibly powerful.”
Big-business protection for smaller firms
Huntress focuses on bringing the kind of security usually reserved for large corporations to businesses of all sizes, many of which rely on outside IT providers rather than in-house security teams.
“At Courser, our goal is to give all businesses access to the same level of cybersecurity protection and expertise that larger enterprises rely on, without the cost or complexity,” said Steven Drew, Chief Technology Officer at Courser.
“Huntress is an important part of that strategy, bringing advanced threat detection, expert threat research, and a 24/7 security operations centre to our broader security offering. Their continued innovation helps us strengthen protection across our network of managed service providers and deliver better security outcomes for the businesses we serve.”
Other new features include alerts on password-guessing attacks against remote access systems, available from 18 November, and an on-demand report showing businesses where their Microsoft 365 security has gaps and how to fix them.
