The Attacker Got There First. ITDR Lookback Hits Rewind.

All newly onboarded Microsoft 365 tenants are a blank slate, right? Wrong. Somewhere in the last six months, an attacker may have already phished a login, planted a rogue device, or been persisting quietly. Until now, it was difficult to find out "was this tenant already compromised?" until the attacker made their next move.

Meet Lookback: the moment a tenant finishes onboarding, Huntress automatically replays up to 180 days of Microsoft 365 login history through the full Unwanted Access detection stack. No action required on your part. During early access, we found 259 identities across 246 tenants with qualifying compromise activity in the first 30 days, and a validation hunt confirmed 35% of the fastest-firing cases were compromised before Huntress ever connected.

To-date, Managed ITDR’s Lookback surfaced (and helped contain) active compromises involving an attacker watching a $2 million real estate wire, a school district’s Global Admin account compromised 27 days before onboarding, and an architecture firm’s account turned into a phishing launchpad. All three tenants arrived with unwelcome company.

Join Dray Agha, Senior Manager, Tactical Response, Rich Mozeleski, Staff Product Manager, ITDR, and Erin Meyers, Principal Product Marketing Manager, to unpack these cases and meet Lookback.

Any could come with an attacker. See how looking back helps you act before their next move.

What You'll Learn:

• The attacks already in progress: Go inside recent Lookback wins to see what attackers were doing before Huntress connected and how those footholds were contained.

• From historical evidence to action: Learn how Lookback separates active compromises requiring SOC response from past incidents that have already been cleaned up, with findings delivered within 48 hours of onboarding.

• A stronger start for every new tenant: See how automatic Lookback and the enriched Identity Security Assessment can help you get a glimpse of what’s going on with your tenant or help you onboard an existing or new client using their own tenant’s history.