Huntress Managed EDR
Huntress Managed EDR and SOC
GCIT deploys and manages Huntress across 41 organisations, protecting about 600 endpoints and monitoring 850+ Microsoft 365 identities. 24/7 human-led threat detection, endpoint isolation, identity threat detection, and security awareness training, all managed by our team and backed by the Huntress SOC.
Huntress Partner. ISO 27001 certified.
Featured by Huntress
GCIT detects Evilginx phishing attack with 24/7 SOC monitoring
Huntress published a case study on GCIT after our team used the platform to detect a sophisticated Evilginx phishing attack that bypassed MFA. The attacker used a reverse-proxy technique to capture both the user’s credentials and their MFA token in real time.
The Huntress SOC detected the unusual sign-in behaviour, alerted our team, and we contained the compromise before any data was accessed. This is the kind of attack that traditional antivirus and basic MFA won’t catch. It requires behavioural detection and human analysts who know what to look for.
Read the case study
What Huntress caught
1
Evilginx reverse-proxy phishing
Attacker captured live MFA tokens using a man-in-the-middle technique
2
SOC detected unusual sign-in
Huntress 24/7 analysts identified the compromised session
3
GCIT contained the compromise
Sessions revoked, credentials rotated, forwarding rules checked
4
No data accessed
Early detection prevented the attacker from reaching sensitive data
YouTube
How hackers break into MFA-enabled M365 accounts
The Huntress Platform
What Huntress does across your environment
Huntress is not just an antivirus. It’s a managed detection and response platform with a 24/7 human SOC that investigates every alert. GCIT deploys and manages it as part of every service plan.
Managed EDR
Endpoint detection and response
Behavioural threat detection on every managed device. When something suspicious happens, the Huntress SOC investigates it, not just an algorithm. Real analysts write real incident reports.
24/7 SOC
Human-led security operations
Around-the-clock monitoring by trained security analysts. They triage alerts, eliminate false positives, and escalate confirmed threats to GCIT for immediate response. No alert fatigue for your team.
ITDR
Identity threat detection
Monitors Microsoft 365 and Entra ID for identity-based attacks: impossible travel, suspicious sign-ins, consent phishing, and token theft. Catches attacks that endpoint-only tools miss entirely.
SAT
Security awareness training
Phishing simulations, interactive training modules, and user risk scoring, all integrated into the same platform. Training data informs threat detection and vice versa. Learn more
Isolation
Automated device containment
When a confirmed threat is detected, Huntress can isolate the device from the network within seconds, preventing lateral movement while GCIT investigates and remediates.
Reporting
Threat intelligence and insights
Monthly reports on threats detected, alerts investigated, incidents resolved, and risk trends across your environment. Evidence for compliance audits and cyber insurance renewals.
Why Not Just Use Defender?
Huntress and Defender work together, not as alternatives
Microsoft Defender for Business is included in every Business Premium licence and provides solid antivirus, threat detection, and automated investigation. But Defender is a tool. It generates alerts. Someone still has to investigate them.
Huntress adds the human layer. The 24/7 SOC investigates every alert, separates real threats from noise, and escalates confirmed incidents to our team with context. Without that, alert fatigue sets in and real threats get missed.
GCIT deploys both. Defender handles the endpoint protection baseline. Huntress provides the behavioural detection, identity monitoring, and managed SOC that makes the whole stack operational.
“Until you have a managed service where you have expert eyes triaging the alerts and looking at what’s noise and what should be looked at, AI is not at the point yet where it can replace that.”
Elliot Munro
CISO, GCIT
What does Defender do?+
Microsoft Defender for Business provides antivirus, endpoint detection, automated investigation, and threat analytics. It’s included in Microsoft 365 Business Premium. GCIT configures attack surface reduction rules, security baselines, and monitoring policies through Intune.
What does Huntress add?+
Huntress adds 24/7 human-led SOC monitoring, behavioural threat detection, identity threat detection (M365 and Entra ID), automated device isolation, security awareness training, and analyst-written incident reports. It catches what Defender alerts on but nobody investigates.
Can I use Huntress without Defender?+
Technically yes, but we recommend both. Defender provides the antivirus baseline and integrates with Microsoft 365 security policies. Huntress provides the detection depth and human investigation layer. They complement each other.
Is Huntress included in GCIT managed plans?+
Yes. Huntress EDR, SOC, and security awareness training are included in every GCIT managed service plan. You don’t need to buy, configure, or manage Huntress separately. Our team handles deployment, configuration, alert triage, and reporting.
Why doesn’t GCIT monitor threats 24/7 in-house?+
We do actively monitor and respond during business hours. But running a genuine 24/7 in-house SOC requires a team of 8-10 dedicated security analysts, which would make the service cost-prohibitive for small and medium businesses. Huntress solves this by providing a purpose-built 24/7 SOC at a price point designed for the SMB market. Their analysts investigate alerts around the clock, and escalate confirmed threats to our team for immediate action. It’s the right balance of coverage and cost.
What types of threats does Huntress detect that Defender misses?+
Huntress specialises in post-compromise detection, the threats that get past your initial defences. This includes persistent footholds (attackers hiding in scheduled tasks, registry keys, or WMI), living-off-the-land attacks (using legitimate tools like PowerShell to move laterally), identity-based attacks (token theft, consent phishing, OAuth app abuse), and fileless malware that never touches disk. Defender catches known threats well, but Huntress catches the ones that are designed to evade detection.
How quickly does the Huntress SOC respond?+
Huntress SOC analysts typically investigate and triage alerts within minutes. For confirmed threats, automated containment actions like device isolation happen in seconds without waiting for human intervention. Escalations to GCIT come with full context, analyst notes, and recommended actions, so our response is immediate and informed.
Scale & Experience
41 organisations. About 600 endpoints. One team.
GCIT manages IT for more than 300 organisations and runs Huntress for 41 of them, covering about 600 endpoints. That scale means we see patterns across environments, respond to threats faster, and bring operational maturity that smaller providers can’t match.
If your business already runs Huntress, switching to GCIT means zero migration risk on your EDR platform. We take over management, integrate it with your broader security stack, and start delivering value immediately. If you don’t have Huntress yet, we deploy it as part of your onboarding.
41
Organisations protected
~600
Endpoints monitored
850+
M365 identities monitored
24/7
SOC monitoring
Zero
Migration risk
Included
In every new managed plan
Certified Management Systems
Microsoft Certifications
Security Assessors
Common Questions
Frequently asked questions
What is Huntress?+
Huntress is a managed detection and response platform purpose-built for managed service providers. It combines endpoint detection, identity threat detection, a 24/7 human SOC, and security awareness training into a single platform. Unlike standalone antivirus, Huntress has human analysts investigating every alert.
How does Huntress integrate with Microsoft 365?+
Huntress monitors Microsoft 365 and Microsoft Entra ID for identity-based attacks including impossible travel, suspicious sign-ins, consent phishing, and OAuth app abuse. This catches cloud-based attacks that endpoint-only tools miss because the attacker never touches a device.
We already use Huntress. Can GCIT take over management?+
Yes. If your organisation already runs Huntress, transitioning to GCIT as your managed service provider means zero disruption to your EDR coverage. We take over the Huntress management, integrate it with your Microsoft 365 environment, and begin active monitoring and response immediately.
How does Huntress handle false positives?+
The Huntress SOC investigates every alert before it reaches GCIT. Only confirmed or high-confidence threats are escalated. This dramatically reduces false positives and alert fatigue. When GCIT does receive an escalation, it comes with full context and analyst notes, so our response is immediate and informed.
Is Huntress suitable for small businesses?+
Yes. Huntress was designed specifically for the SMB market. It provides enterprise-grade detection and response at a price point that works for businesses with 10 to 500 users. Through GCIT, it’s included in your managed service plan at no extra cost.
How does this relate to your incident response service?+
Huntress is the detection engine. GCIT’s incident response is the action we take when Huntress finds something. Detection, containment, eradication, recovery, and lessons learned. They’re connected: Huntress detects, GCIT responds.
Reviewed by Elliot Munro, CISO at GCIT
Already using Huntress? We manage it for 41 organisations.
Whether you’re looking to deploy Huntress for the first time or want a partner who already manages it at scale, talk to us. Zero migration risk, immediate value.