Huntress Managed ITDR

The Attack Moved to the Login Screen

For a decade, breaking into a business meant getting malware onto a machine. Endpoint detection got good enough at catching that, so attackers changed target. Today the fastest way into most small businesses is not the laptop — it is the Microsoft 365 or Google Workspace account, reached with a stolen password, a phished session token, or a malicious app the user was tricked into approving.

The reason this works is that it never touches an endpoint. An attacker who steals a live session token does not need your password, and does not trip your antivirus, because from the cloud’s point of view they are you. They read mail, set up quiet forwarding rules, approve their own OAuth app for permanent access, and wait. The endpoint tools you already pay for — including the Huntress Managed EDR on your machines — simply cannot see any of it, because none of it happens on a machine they watch.

Identity Threat Detection and Response (ITDR) is the category built to close that specific gap. It watches the identity layer — sign-ins, tokens, app grants, mailbox rules — the way EDR watches the endpoint.

What Huntress ITDR Watches

Huntress groups its identity detections into three areas, each mapped to a real attacker move rather than an abstract risk score.

Why It Belongs Next to Your Endpoint Coverage

EDR and ITDR are not competing products; they cover two halves of the same environment. One watches the machines, the other watches the accounts, and a serious attack usually crosses between them. A phished token leads to a mailbox rule; a compromised laptop leads to a harvested credential. Running one without the other leaves a blind spot exactly where attackers have learned to operate.

• Microsoft 365 and Google Workspace — ITDR protects both identity platforms from one console and one SOC, so a business on either (or migrating between them) is covered.
• Read-only OAuth connection — there is no agent to deploy on the identity side. Huntress connects to your tenant through a secure, read-only Microsoft or Google integration, and onboarding takes a matter of days.
• Every alert is human-validated — the same 24/7 Huntress SOC that reviews endpoint alerts reviews identity alerts, so your team hears about confirmed takeovers, not a stream of login noise.
• Automated containment — for a confirmed account takeover, the response can disable the compromised account automatically, with a stated mean time to respond of about three minutes rather than the hours a human-only process takes.

How Tomotechi Runs It for You

Huntress supplies the detections and the SOC. We supply the part that turns an alert into a resolved incident for a business that does not have a security analyst on staff.

ITDR is available on its own, but most businesses run it alongside endpoint coverage as the Endpoint + Identity tier, which is the configuration that matches where attacks actually land today. See the full breakdown on our Huntress offerings page, or the mechanics on our implementation page.

Is Identity Your Real Exposure?

A few questions worth sitting with. If the answer to any is yes, the identity layer is where your next incident is most likely to start:

• Do you run Microsoft 365 or Google Workspace for company email? (Almost certainly yes.)
• Does anyone with the authority to move money, or approve an invoice, use it?
• Could a member of staff be phished into approving a login or an app on a convincing-looking page?
• Would you currently know if a hidden forwarding rule were quietly copying an executive’s mail to an outside address?

The uncomfortable part of identity attacks is that everything keeps working normally while they happen. There is no ransom note and no locked screen — just an attacker reading along, until the day an invoice gets paid to the wrong account.