On managed plans, every Windows computer we look after gets the Huntress agent. This page explains what it does, how incidents are handled and how fast we respond. If you ordered Huntress Managed EDR on our website, the guide to installing and checking it is listed on Start here for self-serve clients.
¶ What it is
The Huntress agent is a small program that runs in the background. Huntress is a security company with a team of analysts who work around the clock. The agent watches for the kinds of activity attackers use and sends what it sees to that team for review.
This is called EDR: endpoint detection and response. It is a second layer behind your antivirus. Antivirus blocks known threats automatically; EDR catches the ones that get past it.
¶ What it does
- It watches each computer: running programs, startup items, unusual PowerShell, hidden scheduled tasks, and the file activity that ransomware causes.
- It sends what it sees to the Huntress security operations centre (SOC), where people investigate the alerts.
- A person reviews every alert, so you don't get noisy "you might have a virus" pop-ups. When Huntress writes up an incident, an analyst has confirmed there is something real.
- Huntress usually prepares the fix with the incident: quarantine a file, stop a process, or remove what the attacker left behind to survive a restart. We approve it, Huntress carries it out, and it takes seconds.
¶ What it does not do
- It does not replace antivirus. Microsoft Defender, hardened and with tamper protection on, still stops known malware before it runs. Huntress catches what Defender misses.
- It is not a keylogger. It does not record what you type, read your email or look at your browsing history.
- It is not a remote-control tool and cannot share your screen. Remote help uses a separate tool, and we connect only with your permission. See Remote support sessions (sign-in required).
¶ What happens when Huntress finds something
- A Huntress analyst confirms the alert is real.
- Huntress opens an incident: a written report naming the computer, what was seen, and the recommended fix.
- We are notified straight away, by email and in our operations chat.
- For critical and high incidents, we call or email your main contact before we act. The exception is when the fix is to isolate the computer from the network to stop an attack spreading. Then we isolate first and phone you within a few minutes.
- We carry out the fix, confirm the computer is clean, and close a ticket with a short summary of what we saw and what we did.
¶ Response times
| Severity | First response | What we do |
|---|---|---|
| Critical: an active attack or ransomware | Within minutes, day or night | Isolate the computer straight away, and call you |
| High: confirmed malicious software, or a foothold an attacker left behind | Within 1 business hour | Fix it and email you a summary |
| Low: suspicious but not confirmed | Within 1 business day | Investigate. Usually it is closed as a false alarm |
Huntress staffs its SOC 24 hours a day, 7 days a week, and reports an average of about 8 minutes from an alert to a verified incident report or closure. Our team handles incidents during business hours; for critical incidents outside business hours we respond on the same clock as Huntress.
¶ What you see on the computer
Usually nothing.
- The agent uses very little processor or memory.
- It shows no messages.
- It appears as
HuntressAgentin Services, with aHuntressfolder underProgram Files. That is all. - It has no system tray icon, no sign-in screen and nothing to click.
If we need to ask someone about an incident, for example "we saw something malicious while you were using Chrome; did you accept a download?", we phone or email them. We never contact users through the agent.
¶ What we do with what Huntress sees
- Huntress's findings belong to us as your IT provider, and through us to you. We don't publish them. We share the incident summary with you whenever there is one. We don't share the raw data, because it is noisy and mostly useful only to a security analyst.
- Huntress keeps incident data under its own retention policy. If you need a historical record, for compliance or cyber insurance, we can pull it for you.
- Huntress publishes its security and compliance reports, including SOC 2, in its trust center.
¶ Monthly security summary from Huntress
Each month Huntress writes a one-page summary of what its team checked and stopped on your computers, in plain English. We send it to you along with your monthly report. Want an extra copy, or one for an earlier month? Just ask.
¶ Related pages
- What we access (sign-in required): everything our tools can see on your systems.
- Security baseline: everything we turn on when a computer joins a managed plan.
- Remote-access lockdown: how we block remote-control programs nobody approved.
- I think my computer is infected: what to do if you think something is wrong right now.
¶ Get help
Email [email protected] or call (206) 593-8072.
¶ Sources
- Huntress Managed EDR, huntress.com
- Managed host isolation overview, Huntress Support
- Huntress trust center, Huntress
- Huntress Managed EDR: average SOC response time, figures published by Huntress, quoted on Rainier IT's security services page
Last reviewed: November 2026