Huntress launches global cyber recovery partner programme

Huntress has launched a global incident response partner programme for cyberattack recovery, offering participating firms 60 days of no-cost protection for client systems during and after an attack.

The programme targets businesses that remain exposed after an initial breach has been contained, particularly where compromised credentials, identity weaknesses or security misconfigurations could allow attackers to return.

Under the arrangement, incident response firms can deploy Huntress tools for affected clients without going through a standard procurement or sales process. The aim is to shorten the time between breach response and ongoing protection.

The initial focus is on business email compromise and identity-based attacks, which remain common entry points for criminal groups. Participating partners will be able to monitor suspicious logins, compromised sessions, credential theft and OAuth abuse, while reviewing up to six months of historical identity activity.

Huntress is also making available identity security posture management tools designed to identify excessive privileges, authentication policy weaknesses and other configuration issues that may have contributed to an incident. Its security operations team will open dedicated communication channels with incident response partners during engagements.

Tuan Nguyen, Vice President of Channels and Alliances at Huntress, said the programme was designed for the period when businesses are trying to regain control of systems and reduce the risk of a repeat compromise.

"Recovery and protection must go hand in hand, and when a business is under attack, every minute without protection matters," said Nguyen. "By putting the Huntress Agentic Security Platform in the hands of incident responders to immediately contain threats and prevent further damage, we're helping businesses fight back, recover stronger, and stay protected. It's another step in our mission to protect all businesses, especially when they need us most."

Recovery gap

The launch reflects a wider problem for organisations dealing with cyber incidents: removing an attacker does not always eliminate the conditions that enabled the intrusion. Identity systems, email accounts and access controls can remain vulnerable after the main incident has been addressed, leaving room for another compromise.

The issue has become more pressing as attacks increasingly centre on account takeover and abuse of legitimate access rather than malware alone. In such cases, investigators may need to reconstruct months of login and identity activity to determine whether an attacker had earlier access or maintained a route back into the network.

The new programme allows incident response firms to retain control of remediation work and customer relationships while using Huntress's platform during the recovery phase. The offer is global, and the company is seeking to work across regions through specialist response partners.

Gene Yu, Chief Executive Officer of Blackpanda, said the challenge for many businesses extends beyond the immediate response to an attack.

"Across Asia, businesses are increasingly recognising that cyber resilience requires more than responding to an attack or covering its financial fallout," said Yu. "Incident response and cyber insurance are two critical pieces of the puzzle, but neither can prevent an attacker from striking again. By integrating continuous protection directly into the recovery process, we can help businesses contain threats, recover with confidence, and emerge from an incident better protected against the next attack."

Broader strategy

The incident response programme follows Huntress's move into cyber insurance-related partnerships in the US and reflects a broader effort to position its services across the full incident lifecycle, rather than only prevention or detection. For response firms, Huntress is pitching the service as a way to add managed monitoring and identity investigation during a crisis without waiting for a separate commercial agreement.

Businesses can move from short-term incident remediation to ongoing managed protection after the 60-day period if needed. Huntress said it currently safeguards more than 6 million endpoints and 17 million identities.

The early emphasis on business email compromise and identity attacks suggests Huntress is targeting one of the fastest-growing parts of the cyber market, where attackers often use stolen credentials, social engineering and cloud application access to evade traditional endpoint-focused controls.

For incident response firms, the practical attraction may be speed. In many breach situations, investigators need immediate visibility into whether threat actors still have access to email, cloud identities or privileged accounts, and procurement delays can leave businesses in a fragile state.

The programme is intended to remove that delay while giving responders tools to test whether weaknesses have been fully addressed before closing an engagement.