You just had a user fall for a ClickFix attack, but thankfully, Attack Disruption from Managed EDR shut it down before the attacker could launch an infostealer. Now, you'd think this means the threat has been mitigated and you can move on. But there's just one problem…a few minutes later, the same user falls for the exact same ClickFix attack again.
This is something our Security Operations Center (SOC) has seen happen over and over again since we launched the Attack Disruption Engine in April 2026. In fact, of the over 25,000 hosts we've seen with a ClickFix signal, 29% made more than one attempt. That's thousands of people falling for a real-world ClickFix attack without any lessons learned.
This isn't some malicious user trying to take down your organization; they just don't know any better, which presents a great opportunity to lower the security awareness gap and address human risk as it happens.
That's why Huntress is introducing a new way to address real-world risky behaviors as they happen, with contextually relevant, just-in-time training. You'll turn what could've been an incident into a learning opportunity that helps you understand what happened and how to avoid it in the future.
Defense Drills: from incident to awareness even faster
Defense Drills are a new type of training content that's short, hands-on, and built on prominent or emerging tradecraft that the Huntress SOC is actively observing. With Defense Drills, the user experiences being compromised by different types of emerging tradecraft in a safe environment, all while their Defense Coach points out indicators to look for to identify whether it's malicious rather than legitimate. The goal of Defense Drills is to build awareness of these threats even faster than our production-quality episodes and to ensure they reach as many users as possible by making them directly assignable from the portal.
Figure 2: Defense Drills cover the newest types of threats our SOC and research teams are seeing in the wild.
Huntress has a proven track record of being the first to respond to major incidents across the industry and of turning our findings into educational resources that benefit the cybersecurity and IT community as a whole. But when those major incidents impact your end users, it's not as easy to build awareness in a way that's accessible to all users.
Defense Drills closes that gap, while supercharging the incident-to-awareness pipeline. When the Huntress SOC observes a new threat in the wild, they can spin up a Defense Drill quickly to put it in front of users in a controlled environment, helping them understand how it works and what to avoid.
Demo it yourself: Railway Device Code Phishing Incident
Experience this Defense Drill demo for yourself.
Figure 3: The Huntress SOC saw a 1,380% increase in device code phishing after the Railway incident. Try our Defense Drill demo of this attack for free.
Demo it yourself: Custom ChatGPT -> ClickFix RAT
Experience this Defense Drill demo for yourself.
Figure 4: ClickFix incidents grew 2,048% between 2025 and 2026. This ChatGPT example highlights how convincing it can be. Try our Defense Drill demo for free.
Another benefit of Defense Drills is their versatility. You can assign them yourself to become the trusted security advisor for your learners. And coming soon, you'll be able to enroll in Managed Defense Drills, where Huntress takes care of assigning them for you. Plus, you'll get Breaking News, where Huntress sends Defense Drills out as necessary for breaking threats that need extra attention. Finally, you can actively address real-world human risk as it happens with Defense Drill Interventions.
Defense Drill Interventions: address human risk in real-time
Security awareness training has historically been preventive. You train users to spot threats, you test them with phishing scenarios, and report on it for compliance. And that was it. Most SAT admins didn't even expect an outcome from it aside from satisfying compliance requirements and maybe better cyber insurance premiums if they were lucky. But when a real user-based threat found its way through, there was no course of action to address the behavior that caused it, aside from an awkward conversation with the user after the fact. And even that was too little too late, as the best time to train on an incident is in the moment, while it's still fresh.
Defense Drill Interventions is changing that. The combination of Managed SAT with detections from the Huntress Platform is like adding 1+1 and getting 3. It's not bad math; it's added value. It's better security outcomes because you not only shut down the attack, but also address the risky user behavior that caused it in real time, with contextually relevant training based on the specific behavior that triggered the incident. The best part is it's all managed for you. No responding to alerts, no building assignments after the fact, and no need for that awkward conversation with the user. Defense Drill Interventions has it handled.
So what does this look like to date?
We're starting with a threat that we're seeing most often: ClickFix. In 2025, ClickFix was responsible for more than half of all malware loader activity. It's a nasty threat that's tricky for untrained users to spot. So we're coming at ClickFix from all angles. With Defense Drill Interventions, ClickFix attacks are shut down by Managed EDR Attack Disruption, and in that same moment, the user will see a pop-up with a Defense Drill covering ClickFix attacks. This not only stops the threat in its tracks but helps the user understand how the threat happened and what to look out for in the future. It's shutting down threats while reducing future human risk
Figure 5: When Attack Disruption shuts down a ClickFix attack, the user sees a just-in-time Defense Drill.
This is just the beginning for Defense Drills and Defense Drill Interventions, and we'll continue to build out more interventions within the Huntress Agentic Platform to keep your users and your organization more secure.
Want to see how it works?
Join us on November 17 for the livestream "Training at SOC Speed: How New Threats Lead to New Defense Drills," as we'll give you the first look at Defense Drills and Attack Disruption in action.
Or try it for yourself with a free trial.
