The same managed-security stack we run for our flat-rate clients — EDR, identity protection, automated patching, remote monitoring — sold per device, per month. No contracts. No bundles you don't need. Cancel anytime.
Pick the products you want and how many of each. Each product is priced on its own quantity — one product's volume never changes another's rate.
Card on file, billed monthly. Your invoice tracks what's actually installed — add a laptop mid-month and it just shows up on the next cycle.
One installer with your products baked in. Run it on each machine — a few minutes per machine, no on-site visit, no reimaging.
From that point on it's a 24/7 SOC on your endpoints, automated patching on your schedule, and monitoring that flags problems before they're outages.
See every step before you buy: the help center walks through ordering, installing and getting support. No sign-in needed.
Authorized Partner
Huntress EDR isn't just software — behind the lightweight agent (Windows, macOS, and Linux) sits a 24/7/365 human Security Operations Center with an average response time of about 8 minutes from alert to verified incident report or closure. The agent continuously hunts for persistence footholds — the mechanisms attackers use to survive reboots and stay hidden — and plants ransomware canary files on every protected endpoint, so the moment anything starts encrypting, a SOC investigation opens immediately.
SOC analysts review alerts before they ever reach you. Huntress's incident reports carry a false-positive rate under 1% — you act on signal, not noise.
On a confirmed threat, Huntress' analysts can isolate the host — or the whole organization — so it can only talk to Huntress. A human validates first, so a false positive never locks up your server.
Every incident report arrives with step-by-step remediation. We work it with you — you're never handed a raw alert stream to triage alone.
Huntress manages and monitors Microsoft Defender — AV health, scan status, signature updates — across every protected endpoint, at no extra charge.
average SOC response time — from alert received to incident report sent or alert closed
false-positive rate on incident reports — human-verified before you ever see them
endpoints protected by the Huntress platform worldwide
Authorized Partner
Modern business compromise increasingly starts with a Microsoft 365 account, not a machine — 67% of organizations report a rise in identity-related incidents over the past three years. Huntress Managed ITDR connects directly to your M365 tenant — set up in minutes, no endpoint agent required — and puts the same 24/7 SOC behind every licensed identity. It works without expensive premium Microsoft licensing tiers, and it correlates signals (a new inbox rule plus a login from unexpected infrastructure) before anyone gets alarmed.
Detects attackers who steal session tokens — the digital keys that keep users logged in — and import them into their own browsers. No password needed, which is exactly why passwords alone can't catch it.
Flags malicious inbox rules attackers plant to hide their tracks — auto-forwarding or deleting mail, watching for keywords like "invoice," or shunting messages into folders nobody reads.
Catches malicious or abused OAuth applications that have been granted access to your tenant — an attack vector Huntress measured more than doubling year over year in its 2026 threat report.
Spots logins from suspicious locations and unauthorized VPN or proxy infrastructure — and the SOC confirms real compromise before waking anyone up.
Nothing to install. ITDR isn't an endpoint agent — it connects straight to your Microsoft 365 tenant, and as a Microsoft Cloud Solution Provider (CSP) we handle the onboarding and admin consent for you. That one-time tenant setup is a flat $195 per tenant; after that you're billed per identity, volume-tiered exactly like the endpoint agents.
Microsoft 365 identities protected by Huntress ITDR
organizations protected across the Huntress platform
to deploy — a direct M365 tenant connection starts streaming identity events almost immediately. No agent, no reboot, no user disruption.
MSP Partner
Stolen logins are behind more than a third of breaches. We give every employee a Bitwarden vault, enforce two-step login, and set up recovery so nobody gets locked out — then hand you the controls in your Client Portal, where you add and remove people and see who can open what.
Bitwarden generates and fills strong passwords in the browser and on phones, so nobody reuses one — and nothing lives in spreadsheets or sticky notes.
We turn on two-step login for everyone and enroll them in account recovery, so a forgotten master password is a quick fix instead of a lost vault.
Teams share logins through folders you control. Everything is encrypted on the device — Rainier IT can't see what's stored.
Add or remove people in one click, see who has two-step on and who can be recovered, check "who sees what", and export the activity log.
of breaches involved the use of stolen credentials
of identity attacks are password attacks
of identity-based attacks can be blocked by multifactor authentication
Bitwarden is a trademark of Bitwarden, Inc.
Unpatched software is an open door for opportunistic attacks. We run Action1 to automate Windows updates and third-party application patching from one console — with a live, per-device view of every known vulnerability in your fleet, prioritized by CVSS score, CVE, and whether CISA has flagged it as actively exploited. You see exactly what's exposed and watch it close.
Browsers, Adobe, collaboration tools, and more — patched from a repository built and maintained by Action1's own patch team, not a community feed.
Vulnerabilities identified in real time and prioritized by CVSS score, CVE, and CISA Known Exploited Vulnerabilities status — with audit-ready reports your cyber-insurer will actually accept.
Patching runs in windows you approve; reboots get scheduled for when nobody is logged in. Security updates auto-approve while feature updates wait for review.
Work-from-home machines patch exactly like office machines — no VPN required — and peer-to-peer distribution lets agents on the same network share downloads, limiting bandwidth per subnet.
third-party Windows applications in Action1's vendor-maintained patch repository
active-exploitation flags on every vulnerability — so the patches that matter most go first
patch distribution — agents share package segments on the local network instead of each pulling from the cloud
Our remote monitoring agent runs on infrastructure we host and administer ourselves — not a third-party multi-tenant cloud — watching disk space, Windows services, event logs, CPU, and memory on every enrolled machine, and alerting us when thresholds are crossed. It's the difference between "the server ran out of disk Saturday night" being a Monday-morning disaster and a ticket we already closed. And because the agent is on the machine, when something does break we can fix it hands-on, remotely, the same day.
Automated checks on disk space, services, event logs, CPU, memory, and custom script output — problems get flagged before they become outages.
Cleanup jobs, service restarts, and routine fixes run in the background on a schedule — without interrupting whoever's at the keyboard.
Secure attended remote control — your user is notified or asked for consent before a technician connects. No silent screen-watching.
The monitoring platform runs on Rainier IT-controlled infrastructure. Monitoring data and remote-access pathways stay under our administration — not a vendor's.
With the agent installed, you skip the "can someone come out?" wait entirely. Something's broken? We remote in — with your permission — and fix it hands-on at $95/hr, billed in 15-minute increments. No site visit, no travel charge, no hour minimum.
billing increments on remote support — a quick fix costs like a quick fix
A security stack you can't see is a security stack you have to take on faith. The Security Posture Report is a PDF in your inbox — weekly or monthly — showing exactly what's protecting your business right now: which machines are covered, which aren't, and what's still exposed. It covers the services in your plan, so add it alongside EDR, Remote Monitoring or Patch Management. Hand it to your cyber-insurance carrier, your board, or your biggest client's vendor-risk questionnaire.
Monthly $15/mo · Weekly $25/mo — flat fee, any fleet size.
This tour shows the full managed portal. Order here and your portal shows the services you bought, with your installers, billing and your own help page.
Example company, sample data. Watch on YouTube
Each product is priced on its own quantity — Huntress EDR and ITDR earn volume discounts as you scale; patching and monitoring stay flat per device. You're never locked in — billing follows what's actually installed.
A 24/7 human SOC behind a lightweight agent on every Windows, macOS and Linux machine.
A 24/7/365 human Security Operations Center watching every endpoint, behind a lightweight agent for Windows, macOS and Linux.
Huntress ITDR for Microsoft 365 — set up with you · Ask about ITDR →
Windows and 200+ third-party apps patched on your schedule, with live CVE tracking per device.
Windows and third-party patching from one console, with a live per-device view of every known vulnerability.
Rainier IT Monitoring
Our self-hosted agent watches disk, services, logs, CPU and memory, and alerts us first.
Our self-hosted monitoring agent watches disk, services, event logs, CPU and memory, and alerts us before small problems become outages.
A business password vault for every employee, set up and managed by us — and run by you from your Client Portal.
A business password vault for every employee, set up and managed by us — and run by you from your Client Portal.
Bitwarden Enterprise
In your Client Portal
Proof, not promises: a PDF showing exactly what is protecting your business right now.
A PDF in your inbox — weekly or monthly — showing exactly what is protecting your business right now. It covers the services in your plan, so it needs EDR, Remote Monitoring or Patch Management.
Included with every plan: Threat Watch alerts. We watch the software on your computers and email you when something you run is being exploited, plus a weekly Wednesday brief.
With our Remote Monitoring & Support agent on a machine, we usually see the problem before you do. When you need hands-on help, we connect with your permission and fix it on the spot — at the office, at home, or on the road.
Needs our monitoring agent on the device · $2.50 per endpoint/mo
Add Remote Monitoring →Your invoice follows what's actually installed. We bill against live agent counts — add three laptops mid-month and they appear on the next cycle; retire a machine and it drops off. The configurator above is a quote, not a commitment to a fixed count.
The endpoint products (EDR, patching, monitoring) self-install from one agent — there's nothing to set up by hand, so there's no setup fee. ITDR is different: it's a direct connection to your Microsoft 365 tenant, not an agent. We onboard it for you — establishing the integration, granting admin consent as your Microsoft Cloud Solution Provider (CSP), enabling the audit logging Huntress needs, and verifying it's healthy. That's a flat $195 one-time fee per Microsoft 365 tenant, regardless of how many identities you protect. Ongoing protection is then billed per identity per month.
An endpoint is a physical or virtual machine with an agent on it — a workstation, laptop, or server. An identity is a licensed Microsoft 365 user. EDR, patching, and monitoring are billed per endpoint; ITDR is billed per identity and needs no endpoint agent at all — it connects directly to your M365 tenant.
Anytime, effective at the next billing cycle. No early-termination fee, no contract to buy out. We uninstall the agents cleanly and hand you an exit summary of what was covered.
Each product is priced on its own quantity. Huntress EDR and ITDR get cheaper as you add more (tiers at 11, 26, 51 and 101+); patching and monitoring stay flat per device. Buying more of one product never changes another product's rate.
No — that's the point of à la carte. That said, they're designed to layer: EDR watches for intruders, ITDR watches your M365 accounts, patching closes the holes they come through, and monitoring catches the ordinary failures in between. Most clients start with EDR and add from there.
That's our managed plans. Flat per-user pricing that includes this entire security stack plus unlimited remote support, a hardened security baseline, backups, and onboarding. Compare managed plans →
Every managed plan includes this entire security stack — plus unlimited remote support, a hardened Windows security baseline, encrypted daily backups, free onboarding, and a monthly health report. If you'd rather never think about any of this again, that's the plan to pick.
