Services
Security that runs quietly in the background
Everyone needs good security now — the trick is having it handled properly, without it becoming your problem. We set up a complete, managed layer of protection and then look after it for you.
That means a fully managed EDR solution backed by a 24/7 human-led Security Operations Center, with the accuracy to keep false positives under 1%. It means immutable, ransomware-resistant cloud backups we monitor and test. It means any information we hold about your business is encrypted, always. And it means isolating threats before they reach your devices. All of it managed, so you don’t have to think about it.
Specialized services
Last 30 days
262M
security events analyzed across the devices, identities, and servers we protect — watched around the clock so threats are caught and contained before they reach you.
24/7 managed detection & response
From our security desk
Recent observations from our security team
What our 24/7 monitoring is seeing across the systems we protect.
This month, across everything we protect
This month, trial-licensed remote monitoring and management (RMM) installs drove our alert volume. Attackers registered ScreenConnect services on endpoints, launched binaries staged in temp folders, and aimed service commands at relay domains outside any hosted instance. Antivirus flagged trojans being dropped on those same hosts. We'd suggest confirming which remote access tools are approved and alerting when new service installations occur.
Threat landscape
Exploitation of unpatched React Server Components is increasing, making React2Shell a top trending vulnerability. After confirmation that foreign state-linked groups and cybercriminals ran remote code through it, CISA added it to the list of Known Exploited Vulnerabilities. Many domains are still at risk. Fortinet and Ivanti released advisories about the exploitation of input handling and authentication bypass flaws as access pathways for ransomware groups. The Shai- Hulud worm has resurfaced, spreading through NPM and BUN packages, infecting pipelines. Overall, there’s a rise in attackers abusing vulnerabilities in browsers, repositories, and CI/CD platforms to gain initial access across many industries. Microsoft released a PowerShell update in December to reduce attacks that use malicious download stagers and Fake CAPTCHAs. CISA strongly urges rapid patching, as the time between vulnerability disclosures and when attackers abuse those exploits is quickly shrinking.
A new ransomware variant called Settra is being spotted in the wild. First reported in June 2026, Settra employs notable defense evasion techniques such as deleting Windows Event Logs and disabling the Windows Recovery Environment. Public reporting points to compromised VPNs and/or stolen credentials as potential initial access points. In two incidents Huntress investigated, the threat actor installed the MeshAgent RMM tool, and the later attack employed the Bring Your Own Vulnerable Driver (BYOVD) technique to disable certain security controls. Indicators of compromise include a ransom note named RESTORE_FILES.txt and an executable named after the victim’s organization with _win64.exe appended.
Let's start a conversation
No contracts, no pressure — just a conversation about your technology and how we can help. We'd love to hear from you.