AI has given attackers speed, and that speed is changing what it takes to catch an attack before it's too late for your business.
That's the shift Aimee Simpson, Director of Product Marketing at Huntress, Bryson Byrd, Cybersecurity Advisor at Huntress, and Robert Knapp, Director of the Huntress Security Operations Center (SOC), dug into during the "Inside the Agentic Huntress Platform: Beating Adversaries at Machine Speed" livestream. They covered how attackers are using AI to move faster, and what Huntress has built into our platform to close the gap.
The attacker who got caught by running Huntress' own EDR
An attacker installed a Huntress EDR agent on their own attack machine. Our SOC noticed the install, thought it looked odd, and started digging. That one thread unraveled into an operation that had already compromised over 2,000 accounts, with the attacker using Google Translate to draft phishing emails aimed at victims outside their native language.
It's a good snapshot of where the industry actually stands with AI-driven crime. Attackers aren't actually inventing anything new. They're just running the same plays faster and at a much higher volume.
AI changed the speed, not the playbook
A year ago, AI was mostly a force multiplier for social engineering. Phishing emails got more convincing and started reading like something a real colleague would send instead of something a filter would catch. That trend has gained momentum. North Korean IT worker scams now use AI to alter faces on video interviews, helping operatives land legitimate remote jobs in the US and route the pay back to the regime.
Where AI has really sped things up is in the phases most people don't picture when they hear the word "AI attack." Reconnaissance moves faster. Enumeration after an attacker lands inside an environment moves faster too. And on the back end, some ransomware groups now use AI to comb through stolen data and flag Personally Identifiable Information (PII), Protected Health Information (PHI), or intellectual property, so they can walk into an extortion conversation already knowing exactly what they're holding and what it's worth.
There's a lot of noise right now about frontier model vulnerabilities turning decades-old software into open season for attackers. But that framing may be overhyped, closer to fear, uncertainty, and doubt (FUD) than reality. Not every vulnerability is exploitable, and plenty of these systems still need to be reachable before anyone can touch them. What is real, and worth watching, is that attackers have started targeting API keys and session tokens tied to frontier AI models themselves, a trend Anthropic documented in their own recent misuse report.
The simplest point might be the most useful one. AI agents running on a compromised endpoint are still doing lateral movement and credential dumping the same way attackers have done it for over a decade. Nothing about the underlying technique is new or sneaking past EDR detection. It shows us that the tradecraft hasn't changed, but the speed has.
Athena joins the agentic SOC, with humans still in the lead
That same speed problem is exactly what Athena is built to address. Athena is an agentic orchestrator working alongside human SOC analysts. It's a "humans in the lead" model, a step further than the more common "human in the loop" framing.
The work splits into two lanes. The first is cutting the time it takes to investigate a threat. When a signal fires, Athena gathers the relevant artifacts and telemetry, then enriches everything with threat intelligence before an analyst ever looks at it. Analysts have said the hardest part of the job was never knowing what to do next. It was getting the right data in front of them fast enough to do it. Athena closes that gap.
The second lane is automating away entire categories of low-complexity, high-volume investigations that don't need a senior analyst's judgment call. The SOC picked ITDR as the first candidate and ran Athena's workflows in parallel with human analysts for about a month. Human analysts landed on the correct outcome 95% of the time. Athena hit 97% on the same bounded set of signals.
Some calls will always need a person, not an algorithm. Anything involving hands-on-keyboard activity, live lateral movement, or a real-time attacker in the environment goes straight to a human. Those calls are too high-stakes to hand off.
Athena frees up analysts to spend less time triaging routine, repeatable cases and more time on the complex, and novel threats that actually need a person's judgment.
Turning the black box into a glass box
Trust has been a recurring theme in our customers' feedback. Partners have said they trust the outcomes but still feel like they're working with a black box. If we never send a report because a threat didn't reach the bar for escalation, it can be hard to tell what we actually did on your behalf that day.
The new Investigations View is the answer. It lays out a reverse chronological timeline for every investigation, not just the ones that got reported, showing the signal that triggered it alongside what the attacker did and how the SOC responded. Partners can now see when an investigation started, what logs and files got pulled, and what containment steps were taken, even for cases that closed as benign. They no longer have to take our word for it. They can look at the work directly.
More ways to plug into Huntress data
Developer-facing tools have come a long way too. The Huntress API, once read-only, now supports both reading and writing data. Partners are already using that to track impossible travel across VPNs and geolocations, and to pull custom reports for their own stakeholders. Others use it to automatically close ticketing system escalations once an alert resolves.
Webhooks fill a different gap. Instead of polling the API for updates, a webhook pushes the update the moment something changes. And the MCP server, intentionally kept read-only for now, lets non-technical users, like an account manager or a stakeholder who just wants a quick number, pull Huntress data straight through a chat interface without writing a query. The read-only limit is deliberate. Hallucinations are still a real risk, and nobody wants a chatbot making changes it shouldn't.
Adoption backs up the demand. Daily API traffic has roughly tripled year over year, which tracks with how many partners are building their own automation and reporting layers on top of Huntress data instead of working entirely inside the dashboard.
The case for stacking products
Two examples show what changes when products work together instead of running on their own.
The first is credential theft. When EDR flags credential-stealing activity on an endpoint, that signal can be correlated against identity data in ITDR, so the SOC isn't just cleaning up the endpoint. It's also restricting the identity itself, cutting off the attacker's ability to reuse those credentials elsewhere.
The second example, and the one the agentic SOC called out as the most impactful combination they've seen, pairs SIEM with EDR. The most damaging incidents, the ones that turn into ransomware, tend to start with a compromised network appliance, whether that's a vulnerable firewall or a VPN running without MFA.
The problem with VPN-based intrusions is that the SOC often can't see anything wrong until the attacker actually touches an endpoint, which puts defenders minutes behind the attacker. Feeding VPN logs into a SIEM changes that. Huntress' own threat intelligence can flag an anomalous VPN authentication, and correlating it against the endpoint activity that follows minutes later gives the SOC a real shot at stopping the intrusion before it becomes a ransomware case.
What's next
If you're in EMEA, we're hosting a second live session on September 29 at 2:00pm BST / 3:00pm CEST, made just for your time zone. Bring your tough questions and save your spot to catch our security experts break down Athena, the investigations view, and the new MCP server.
