Huntress ITDR know when someone suspicious is trying to log in as you
Huntress ITDR is a managed identity threat detection and response service for Microsoft 365, provided and supported by Black Swan Cyber Security Solutions. It monitors user accounts, sign-ins, sessions and privileges for signs of account compromise, business email compromise and other suspicious activity, with 24/7 human investigation and practical response guidance when something needs attention.
Huntress ITDR for businesses that rely on Microsoft 365 but do not have a security team
Most Microsoft 365 attacks do not look like someone smashing through the front door. They often start with a real login, a stolen session, a rogue app or a mailbox rule quietly hiding in the background. Huntress ITDR helps spot those warning signs, with human investigation and clear action when something looks wrong.
For the gap Microsoft alerts do not solve on their own
Microsoft 365 can produce useful signals, but smaller organisations rarely have the time or expertise to review identity alerts, sign-in logs and suspicious mailbox behaviour every day.
Managed identity protection, not another dashboard
Huntress ITDR gives you monitored Microsoft 365 identity protection, human validation and practical next steps, without expecting you to build an internal security team.
Glitch & Black Swan explain
Your account. But is it really you?
A familiar email address can hide an unfamiliar visitor. Huntress ITDR helps detect and respond to suspicious activity in your Microsoft 365 accounts, with Black Swan Cyber helping you understand the protection and what happens next.
Glitch
Making himself at home in your account
“I signed in as you. I was hoping nobody would notice.”
With a stolen password or hijacked session, an attacker may read your emails, hide replies or send a convincing payment request from your account. Your laptop can seem perfectly fine while somebody else is using your mailbox.
Black Swan Cyber
Your security partner
“We help you understand the risk and what needs doing next.”
Huntress’s security team monitors and investigates identity threats 24/7, taking response action and providing remediation guidance. Black Swan helps you set up the service, understand findings and coordinate next steps with your existing IT team. We also help you decide where stronger account settings, email protection or other safeguards are needed.
Huntress watches for identity threats. Black Swan helps you turn the findings into practical action.
ITDR works alongside MFA and secure account settings, adding investigation and response when something suspicious happens.
The real question is: who is watching your Microsoft 365 accounts?
For most smaller organisations, the choice is not between different identity security platforms. It is whether to rely on MFA, Microsoft 365 defaults, a stretched IT provider, or hope someone spots the signs of compromise in time.
If you rely on MFA alone
MFA is essential, but it does not mean every risky sign-in, token issue, rogue app or suspicious mailbox change will be investigated quickly.
If you rely on Microsoft alerts alone
The information may exist, but someone still has to review it, understand it and decide what needs doing. That is where smaller teams often struggle.
If you rely on “we’ll notice”
Business email compromise can sit quietly for days or weeks. Attackers may watch conversations, hide replies and wait for the right payment or data request.
What Huntress ITDR actually gives you
Huntress ITDR adds managed identity detection and response on top of Microsoft 365. It is designed to catch account compromise, session abuse, rogue apps and privilege misuse that can happen after an attacker gets or abuses valid access.
If ITDR is about spotting and responding to active identity threats, tools like Huntress ISPM focus on reducing the misconfigurations and gaps that allow those risks to exist in the first place.
Huntress ITDR helps spot the signs of business email compromise inside Microsoft 365
Business email compromise does not always begin with an obviously malicious email. Sometimes the attacker already has access to a real Microsoft 365 account or a valid session. From there, they can watch conversations, create inbox or forwarding rules and wait for the right payment, payroll or sensitive-data request.
This is where ITDR is different from email filtering. Email security tries to stop malicious messages before they reach somebody. Avanan / Check Point Email Security adds that filtering and threat-prevention layer around Microsoft 365. Huntress ITDR watches for suspicious identity and mailbox behaviour after an account, session or application access has been compromised or abused.
What business email compromise can look like
Invoice and payment fraud
An attacker monitors a genuine supplier or customer conversation, then uses the trusted account to send altered bank details or payment instructions at exactly the right moment.
Payroll diversion
A compromised employee, manager or HR account is used to request a change to salary payment details, redirecting the next payment unless the change is independently checked.
Finance or admin account takeover
Access to a senior, finance or administrator account can expose sensitive conversations and give an attacker a trusted identity they can use to target other people inside the organisation.
Quiet mailbox manipulation
Attackers can create inbox or forwarding rules to hide replies, suppress security warnings, monitor conversations or quietly wait for an opportunity to intervene.
Huntress ITDR is not a replacement for good financial controls. Changes to bank details, payroll information or significant payments should still be independently verified using a trusted contact method.
What Huntress ITDR watches for
Suspicious sign-ins
Detect unusual login patterns, location anomalies, risky networks and account behaviour that does not fit what is expected.
Token and session abuse
Look for signs that access may be continuing through hijacked sessions, stolen tokens or authentication activity that needs rapid review.
Inbox and forwarding rules
Spot suspicious mailbox rules that hide replies, move messages, forward mail externally or help an attacker quietly maintain access.
MFA and risky identity changes
Flag suspicious MFA tampering and risky identity or configuration changes that could indicate somebody is weakening security or trying to maintain access.
24/7 human investigation
Suspicious identity activity is reviewed by analysts, helping reduce raw alert noise and giving you clearer, more useful findings.
Clear response
Get practical guidance and response around compromised identities, active sessions, malicious rules and the next steps needed to contain the risk.
Trusted Huntress partner
We help smaller businesses get the benefit of Huntress ITDR without needing to interpret Microsoft 365 logs or build an internal security team.
See how identity attacks actually work
Most attackers do not break in. They log in. This short video shows how identity threats behave inside Microsoft 365 and why ITDR matters.
What you get without building a security team
Smaller businesses do not need more dashboards. They need faster response, lower noise, and protection that works with the Microsoft 365 setup they already have.
What this means in real life
If an attacker logs in using valid credentials, many tools treat them like a normal user. That is why identity attacks are so dangerous. They are quiet, fast, and often happen when nobody is watching.
Before
- A suspicious sign-in shows up, but nobody is sure whether it matters
- Inbox rules change or rogue apps appear without anyone noticing quickly enough
- Internal IT is left trying to interpret Microsoft alerts and sign-in logs
After
- Identity threats are investigated for you
- Human analysts validate suspicious activity before you are dragged into noise
- You get clearer action when accounts, sessions or privileges need attention
Who this is for
This is a good fit if:
- you rely heavily on Microsoft 365 for email, files and collaboration
- you do not have a dedicated identity security team
- you want protection against account takeover and business email compromise
- your IT team is already stretched
- you want real investigation, not just more login alerts
- you are not sure who is actively checking Microsoft 365 identity alerts
- you need clearer evidence for cyber insurance, tenders or client due diligence
This may not be the right fit if:
- you already run a mature internal security team that actively manages identity detections
- you want a fully DIY platform with no managed layer
- you do not use Microsoft 365 enough for identity protection to be a priority
- you are only looking for the cheapest basic alerting option
What we often see
MFA enabled, but no visibility on suspicious behaviour
Many businesses assume MFA solves the problem. It helps, but it does not stop every sign-in risk, session hijack, or rogue app from causing damage.
Microsoft 365 alerts nobody has time to review
The data is there, but smaller teams rarely have the time to investigate every suspicious event properly.
Business email compromise risk hiding in plain sight
Mailbox rules, unusual logins, or silent privilege changes can sit quietly in the background until money, data or trust is already at risk.
No clear response when an account looks compromised
The real pressure starts when no one is sure whether to reset, isolate, revoke sessions, or wait and see.
Security features in place, but not fully configured
Many Microsoft 365 environments already include useful controls, but they are not consistently configured or reviewed. Huntress ISPM helps surface those gaps so you can fix them before they turn into incidents.
Why this matters for smaller businesses in Chesterfield and Sheffield
Most local businesses do not have someone watching Microsoft 365 sign-ins around the clock. Identity risk often sits in the gap between everyday IT support and full-blown security operations.
Huntress ITDR makes sense when you want stronger protection for Microsoft 365, predictable monthly costs, and managed identity monitoring without paying for premium Microsoft licensing or building an internal SOC.
Why identity threats are different
Traditional tools often focus on files, devices and perimeter events. Identity attacks go after the accounts your staff use every day. Once an attacker logs in with a valid account, they can look like a legitimate user unless someone is watching for the warning signs.
Traditional tooling
- Strong at device and file-based threats
- Limited visibility once an attacker is already signed in
- Often leaves identity monitoring as a gap
Native Microsoft alerts alone
- Useful signals, but can be noisy
- Requires time and expertise to investigate
- Often depends on internal capacity you do not have
Huntress ITDR
- Focused on accounts, sessions and privilege abuse
- Human-validated identity threat investigation
- Fast guidance and response when something needs action
How Huntress ITDR fits alongside Huntress EDR
Huntress EDR and Huntress ITDR protect different parts of the attack path. EDR watches the devices your staff use. ITDR watches the identities and Microsoft 365 accounts attackers often target first.
Huntress EDR
- Protects laptops, desktops and servers.
- Looks for suspicious activity on endpoints.
- Helps detect malware, persistence and attacker behaviour on devices.
- Useful when the risk sits on the machine itself.
Huntress ITDR
- Protects Microsoft 365 identities and accounts.
- Looks for suspicious sign-ins, rogue apps and privilege abuse.
- Helps detect account compromise and business email compromise.
- Useful when the attacker logs in rather than breaks in.
For many small businesses, the strongest setup is not EDR or ITDR. It is both: device protection and identity protection working together.
Common questions
No. Huntress ITDR works with your existing Microsoft 365 environment and does not require premium Microsoft licensing.
Huntress states a typical 3-minute mean time to respond, with 24/7 human monitoring of the Microsoft 365 environment.
Alerts are human-validated before they reach you, which helps keep noise down and makes the alerts you do receive more useful.
Yes. It is especially useful for smaller organisations using Microsoft 365 that want stronger protection against account compromise without needing a full internal security team.
Any business that relies heavily on Microsoft 365 email, cloud files, finance approvals or client communication should consider it.
Huntress ITDR supports stronger identity security, helps with incident response documentation, and aligns well with the kinds of controls businesses need for GDPR, Cyber Essentials and insurance conversations.
No. MFA is still important. Huntress ITDR sits alongside MFA by helping detect suspicious identity behaviour, rogue apps, session abuse, mailbox rule changes and other signs that an account may already be under attacker control.
Not sure whether Huntress ITDR is the right fit?
We can take a quick look at how exposed your Microsoft 365 setup is and where identity risks are most likely to sit. We’ll also highlight any obvious Microsoft 365 configuration gaps that could be increasing your risk and help you decide whether Huntress ITDR or ISPM makes sense for your business.
No hard sell. We’ll explain what looks risky, what can wait and what is worth fixing first.
What most businesses look at next
Identity protection works best as part of a wider cyber security plan. These pages help you look at the other gaps that tend to sit around Microsoft 365, endpoint security and staff behaviour.
Huntress Managed ISPM
Identify and fix Microsoft 365 configuration gaps that attackers rely on before they become incidents.
Huntress Managed EDR
Add 24/7 endpoint monitoring and human threat hunting to the devices your staff use every day.
Avanan / Check Point Email Security
Filter phishing, impersonation, malicious links and suspicious attachments before they become an identity problem.
Managed Security Awareness Training
Help staff spot suspicious emails and reduce the risky clicks that often lead to account compromise.
Microsoft 365 Security in Chesterfield
Strengthen the accounts, identities and collaboration tools attackers often target first.
Cyber Security in Chesterfield
Explore wider local support for visibility, response and recovery across your business.
Microsoft 365 Security in Sheffield
Strengthen Microsoft 365 identities, email security and access controls to reduce the risk of account compromise.
Cyber Security in Sheffield
Practical cyber security support for Sheffield businesses, covering identity threats, detection, response and recovery.
Cyber Security in North East Derbyshire
Cyber security support for organisations across North East Derbyshire, focused on visibility, response and reducing identity risk.
Want to know if your Microsoft 365 accounts are being watched properly?
We’ll help you understand where the identity risks sit and whether Huntress ITDR is the right fit.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!