Summary
- Huntress offers participating incident response firms 60 days of no-cost managed protection for affected clients.
- The programme initially focuses on business email compromise and identity attacks, including hijacked sessions and misconfigured permissions.
- Responders retain control of remediation and the customer relationship, while Huntress supplies monitoring and security posture assessments.
Cybersecurity company Huntress has introduced a global programme allowing incident response firms to deploy managed security services for affected customers during and after a cyberattack, seeking to reduce the gap between initial containment and sustained protection.
Under the Incident Response Engagement Programme, participating firms can provide clients with 60 days of Huntress protection at no cost. The arrangement is intended to make managed monitoring available while organisations investigate a compromise, restore services and correct weaknesses associated with the initial intrusion.
The programme was announced on 10 November and initially concentrates on business email compromise and identity-based attacks.
Participating incident response firms retain responsibility for leading remediation work and managing the customer relationship. Huntress contributes monitoring, detection and security assessment capabilities through its platform and security operations centre.
The announcement establishes the commercial and operational terms of the programme, but does not provide independent evidence that it reduces recovery times or prevents a defined proportion of repeat intrusions.
Identity access can survive initial containment
Business email compromise frequently involves unauthorised use of legitimate accounts rather than malware operating continuously on an endpoint. Attackers may obtain credentials, hijack existing sessions or exploit application permissions to retain access to mailboxes and connected systems.
Removing the initial access mechanism does not necessarily invalidate every credential or session that an attacker has acquired.
For example, a compromised account may retain active authentication sessions, while an application authorised through OAuth can continue interacting with services after the original phishing message has been removed.
Those conditions can complicate investigations because a restored endpoint or newly issued password does not always demonstrate that the broader identity environment is secure.
Huntress says its managed Identity Threat Detection and Response service monitors suspicious sign-ins, session misuse, credential theft and OAuth abuse. Its identity security posture management capability examines weaknesses such as excessive privileges, authentication configuration problems and other conditions that may enable renewed access.
The programme also offers access to historical identity activity. Huntress says its Lookback feature can examine up to six months of previous records, potentially allowing incident responders to identify suspicious behaviour predating the first confirmed alert.
The extent of historical visibility will depend on the records available from the affected environment and the supported services. The ability to search previous activity does not guarantee that every earlier unauthorised action has been logged or can be reconstructed.
Recovery depends on coordinated responsibilities
Incident response firms are normally engaged to determine how an attack occurred, identify the systems affected, remove unauthorised access and support the restoration of operations.
Ongoing monitoring may be delivered by a separate managed security provider or by the customer’s internal security team. Where these activities are handed between different organisations, the transfer can introduce delays in establishing baselines, maintaining visibility and acting on newly observed suspicious behaviour.
Huntress is seeking to connect those functions by giving responders access to security services during the investigation rather than requiring customers to complete a conventional procurement process first.
The company says its security operations centre can establish dedicated communications with participating incident response partners, allowing monitoring findings and remediation activity to be coordinated during an engagement.
That arrangement does not remove the need for clear decisions about who has authority to isolate an account, disable an application connection or make changes to production systems.
Responsibilities may also differ between the incident response firm, the managed security platform provider and the customer’s own administrators. The programme’s effectiveness will depend partly on how those responsibilities are agreed and exercised.
The initial concentration on identity compromise reflects the persistence of attacks involving valid credentials. Such intrusions can affect cloud applications and business communications without requiring extensive malware deployment or a continuing foothold on a traditional server.
They also create uncertainty during recovery. Investigators may identify the original compromised account while still assessing whether attackers established additional access through application permissions, secondary identities or previously unrecognised sessions.
Commercial offer extends beyond containment
Huntress describes the 60-day period as a way for organisations to maintain monitoring while remediation is completed and longer-term security arrangements are considered.
The programme is available globally to participating response firms. The company has not published a complete participant directory, the precise eligibility conditions for every customer or a schedule of charges that may apply after the initial period.
Its launch follows other partnerships intended to connect security services with incident recovery and cyber insurance, although those arrangements do not establish the effectiveness of this particular programme.
The announcement represents a new delivery model for Huntress services rather than a newly discovered threat or security vulnerability. It remains to be seen how extensively incident response firms adopt the arrangement and whether it materially changes the speed or consistency of post-incident protection.
The company says participating firms will retain control of customer remediation while Huntress provides the monitoring and security assessment functions during the initial 60-day period.
