Applies to organisations protected by Huntress, on any plan

Huntress has added several new protections this month.

Blocking attackers everywhere at once

Adversary Infrastructure: when Huntress spots an attacker in one organisation, it now blocks that attacker’s infrastructure at Microsoft 365 sign-in for everyone it protects. One attack anywhere means better protection everywhere.

Checking the past, not just the present

ITDR Lookback: when a Microsoft 365 tenant is first connected, Huntress reviews the previous 180 days of sign-ins, to catch anyone who got in before monitoring started.

A score for your sign-in security

Identity Posture Assessment: an on-demand report that scores how well your Microsoft 365 sign-in security is set up, with a prioritised list of fixes. New checks this month look for laptops that quietly give users local admin rights when they’re set up, and for users with an unusually high number of registered devices.

Some of the recommended fixes, such as Conditional Access policies, need Business Premium, so Standard and Basic organisations may see items they can’t fully resolve without upgrading.

Training that targets real attacks

When someone falls for a fake “prove you’re human” page (known as ClickFix) or a sign-in code scam, Huntress can now assign them a short hands-on drill that walks through that exact attack.

Passkeys are a big step up from text codes, but Huntress makes a good point: attackers now target the set-up and recovery steps instead. If you’re moving people off SMS sign-in codes, make sure password-reset and recovery options are locked down too.

Questions, or want a hand with this? Just get in touch.

Source: Huntress (Adversary Infrastructure, ITDR Lookback, Identity Posture Assessment, passkeys, release notes).