Huntress raised a $150M Series D in June 2024 at a $1.55B valuation, more than double its prior valuation. Kleiner Perkins, Meritech Capital and existing investor Sapphire Ventures led the round. The company was approaching $100M ARR at the time and crossed that milestone in September 2024.

The Series D funded endpoint, identity, cloud and software-as-a-service security research, along with acquisitions and distribution. By July 2026, Huntress had more than 800 employees, following 191% workforce growth over two years.

Kyle Hanslovan, Chris Bisnett and John Ferrell founded Huntress, originally Huntress Labs, in 2015 to bring security expertise to businesses without large internal security teams. Huntress crossed $1M ARR in 2018, when it protected nearly 80,000 businesses. The company is based in Columbia, Maryland.

Huntress sells managed security to small and mid-sized businesses, combining software that monitors computers and Microsoft 365 or Google Workspace accounts with a 24/7 security operations center (SOC) whose analysts investigate suspicious activity. Most customers get Huntress through a managed service provider (MSP), an outsourced IT firm that runs their technology.

An MSP technician installs a lightweight Huntress agent on a client's laptops and servers and connects the client's Microsoft 365 environment. The agent reports suspicious processes, such as malware set to relaunch at startup, while the Microsoft 365 connection reports unusual logins and new mailbox forwarding rules.

Huntress's AI assistant, Athena, pulls related records into a timeline and closes some clear-cut cases, while human analysts handle complex ones. The SOC then isolates the infected machine or locks the compromised account and sends the MSP an incident report listing the remaining cleanup steps.

Managed SIEM brings firewall and cloud logs into this monitoring workflow, while ISPM continuously enforces Microsoft 365 security settings. Endpoint posture management, which checks computers' security configurations, is in early access. Huntress also offers security training with phishing simulations, which has reached 1.1M learners.

Huntress charges monthly per protected unit: per endpoint for Managed EDR, which detects and responds to threats on devices; per identity for ITDR and ISPM, its identity protection products; per data source for SIEM, its security log analysis service; and per learner for training. List prices are $8.99 per endpoint per month for Managed EDR, $4 per data source for SIEM and $2.08 per learner for training, with lower rates at higher volume. Security operations center (SOC) coverage is included in every product rather than sold as an upgrade.

Huntress sells primarily through partners. An MSP signs a 12-month term, pays Huntress monthly in arrears for deployed units with no Huntress seat minimum, and incorporates Huntress into the managed-service price it charges each client. Resellers pay annually, and purchases through resellers carry a 50-seat minimum per product.

In a hypothetical example, an MSP covering a 100-endpoint client with EDR and training at the 100-unit rates would pay Huntress about $974 a month and set its own markup. Adding identity or SIEM coverage increases spending per client without acquiring a new client.

Huntress must pay for round-the-clock analysts, cloud storage for ingested logs, R&D and partner support before keeping a profit. Because SIEM is priced per source with pooled storage, heavier log volumes increase Huntress's costs without a corresponding per-volume charge. Profitability depends on keeping storage and analyst costs per account below the fees collected, while covering R&D and partner support.

Huntress's most direct rivals are Blackpoint Cyber, which sells a human-led security operations center (SOC) service through the same managed service provider (MSP) channel, and Sophos, whose managed detection and response (MDR) service runs on its own endpoint and firewall products. MSPs choosing who monitors their clients overnight must weigh a standalone security partner against coverage bundled with software they already use.

Blackpoint offers a 24/7 SOC covering endpoints and Microsoft 365 accounts through its CompassOne platform, using human analysts and AI. Both companies sell through MSP partners, making detection quality, partner support and per-seat cost the basis of competition. Huntress combines endpoint and identity response with security training, log monitoring and identity hardening; it must turn that breadth into better outcomes or simpler operations for an MSP deciding between the two services.

Sophos combines MDR with its endpoint, firewall, email and network products, while more than 500 integrations let customers retain existing tools. This gives Sophos broader data sources and an installed customer base to sell into. Huntress offers a narrower per-unit package for MSPs that want managed coverage without standardizing on one vendor's hardware.

Kaseya, ConnectWise through Asio and N-able through Adlumin bundle detection and response into the management software MSPs already use. Kaseya 365 Endpoint packages management, security, backup and managed response. These bundles require Huntress to justify a separate line item through detection quality and Microsoft integration rather than price alone.

Huntress's expansion beyond small businesses served by managed service providers (MSPs) spans internal security teams, international channels and regulated industries. These paths use the same software agent and security operations center (SOC) to serve new buyers. Its largest accounts already cover more than 100,000 employees, distributors carry it into 100+ countries, and SIEM connects it to compliance budgets as well as breach prevention.

Mid-sized companies with their own IT departments can buy Huntress through resellers, the Azure Marketplace or directly, giving it a route to buyers outside outsourced IT relationships. These buyers draw on security budgets that might otherwise go to Arctic Wolf or a CrowdStrike deployment. Without an MSP handling deployment and cleanup, Huntress would need stronger procurement support, deeper integrations and SOC coverage for more complex environments.

Huntress expanded across EMEA, APAC and Latin America through distributors including Ingram Micro, Dicker Data, QBS Software, MSP Nordics and Giacom, and grew EMEA headcount 378% in two years. Each distributor brings local MSPs that already buy software through it, letting Huntress enter new countries without building a direct sales team in each. Language support and regional analyst coverage would need to keep pace.

Since 2024, Huntress has targeted healthcare, state and local government, and financial services, where buyers need log retention and audit evidence as well as breach protection. Its managed security information and event management (SIEM) product, with extended retention, could capture spending that previously went to separate log tools.

One MSP partner used Huntress telemetry to contain an account compromise at a city without taking public services offline. This provides an example of incident response in a public-sector environment, though capturing compliance budgets also requires meeting buyers' retention and audit requirements.

Partner dependence: Huntress reaches most businesses through managed service providers (MSPs) that own the client relationship and set the end price. If large partners switch to managed detection and response bundled with their management software, Huntress could lose many clients at once without a direct relationship to defend.

Analyst costs: Every new endpoint, identity and log source adds work for Huntress's 24/7 security operations center, which is included in a low per-unit price. If AI triage does not keep analyst time per account falling, costs rise with revenue, while a missed breach could damage trust across a partner's entire client base.

Platform bundling: Microsoft, Sophos and management software vendors can add managed response to products customers already pay for. Huntress's dependence on Microsoft environments leaves it exposed if a platform owner offers comparable coverage at little extra cost.