Why Microsoft 365 Is the Biggest Cybersecurity Target for MSPs | Jeremy Young

In this episode, Jeremy Young of Huntress joins Rob Scott at IT Nation to discuss how cybersecurity is evolving for MSPs and why Microsoft 365 has become one of the most targeted environments for attackers.

He also shares insights from Huntress’ rapid growth and explains how community, culture, and threat intelligence shape the company’s approach to protecting MSPs and their clients.
___________________________________________________________________________
See how Monjur takes legal off your plate: https://hubs.la/Q042mCxG0

Connect with us:
LinkedIn: https://hubs.la/Q042mDZk0
X (Twitter): https://hubs.la/Q042mGRL0

Transcript

SPEAKER_00 0:03

Welcome to Top Tech with Rob Scott.

SPEAKER_02 0:07

Hello and welcome. I'm your host, Rob Scott, and we're here on location at IT Nation in Orlando. And my next guest is Jeremy from Huntress. Jeremy, welcome to the show. Hi, everybody. Thanks, Rob. So good to have you here. You and I have been friends for many years. And um since we met, you've had some sort of uh a journey professionally. So why don't you start by just telling everybody what you do at Huntress and how you wound up back at Huntress doing what you're doing now?

SPEAKER_01 0:39

Wonderful. Thank you. Yeah, we we met a few years ago. I think I was at Blomira at the time. I uh I started my trick my channel journey with duo. So I helped build the duo MSP program uh 2019 after the Cisco acquisition. Kyle from the CEO of Huntress Labs started recruiting me. Went over there in 2019 as employee number 19, spent a couple years helping that scale up from uh series A through uh just before Series C when they raised. And at that time I got an opportunity. Some some old duo folks called me. Blemira is an Ann Arbor company, Duo is an Ann Arbor Arbor company. They're like, Jeremy, you're the MSP guy. We need an MSP channel. Can you come do that? And so I as an opportunity I couldn't refuse, couldn't pass up. Went over there and for three years helped build the entire MSP channel there. Went from no MSP channel at all to over 60% of the revenue of the company in three years, and installed a whole channel team and kind of got that to a place where it was is built and ready to keep growing. Started kind of thinking about what was next. And I have some longtime friends at Huntress and kind of advisors in both pre professional, professional and personal. I was kind of filling them in and they're like, can the new thing be the old thing? And so in January, I returned on the community team with a mutual good friend of ours, Tracy Arisco, and also Becky Teal, of course. And I've been loving every minute of it since I returned.

SPEAKER_02 2:05

Awesome. And and tell everybody what's entailed in being a uh working on the channel team at a cybersecurity SaaS company.

SPEAKER_01 2:14

So the question behind the question, what the heck is a community growth strategist? Uh, that's a fair question. I I get it all the time. I'm still figuring it out, I think is the right answer. The community team at Huntress is really trying to make sure that uh the messaging and the MSP first mentality and the community first mentality makes its way into all facets of how we do business. We don't want to just be a security vendor that offers a great platform. We also want to help you grow your business. We want to help you mature your business. We want to make sure that we're doing the right things in the channel in the right way. And so we're we're kind of like the tip of the spear and the catch-all. If something goes off the rails, we want to be the ones that get called, but we also want to lead the charge to make sure that we're we're partly the face of the organization in the channel to make sure that we're known, we're known commodity, people we can approach us, and that we uh we're signaling that we are here to do things the right way.

SPEAKER_02 3:13

That's really interesting. Um, it seems to me that community and brand in some ways are synonymous.

SPEAKER_01 3:22

Depending on the company, yes. And you you can't have one without the other. But uh in Huntress specifically, in most companies, I'd say community falls under the marketing business unit. Uh, here in part of that is because MSPs have such a community. Not every channel, not every industry uh has the ability for owners to co-opetition the way that MSPs do. Because in MSP world, we're all kings of our own little kingdom, right? And so you can, if you're two towns away, you're you're not really competition. Even if you're in the same town, oftentimes you don't consider that another MSP competition. So they, more than anybody else that I've found collaborate in ways that other companies and other industries don't because they are fear of, oh, I don't want to share competitive intel. So in that environment where everybody's already sharing that much information, there is a very strong community bond. As you see at events like IT Nation, uh, we see quarterly at ConnectWise Evolve events. And and and peer groups are a big part of that. And that's how we know each other from uh ConnectWise Evolve peer groups, and we're both in peer groups and and under that uh architecture. It's the same way. Uh, community makes a lot of sense when you have like-minded owners in similar positions that grow together as opposed to looking at each other as competition. And other companies where community is under the brand, it's usually more about creating a user community and those users, the this if uh if connecting people in the huntress community, we're wanting to connect everybody uh a little bit more broadly than just the Huntress user group.

SPEAKER_02 5:10

That makes good sense to me. You know, one of the things that I've always admired about Huntress is just the way you guys go to market, the way you show up. Uh I'm sure it's very intentional. It must come from the leadership. But you were employing 19, you guys now have over 600 employees. And just for those of you who are doing the math, that's a six-year time period. Um, over a billion-dollar company, uh, an amazing story at Huntress. Um, how do you continue that? And what are you looking forward to for next year?

SPEAKER_01 5:43

We're so we raised Series D last year, which makes this a really fun time to be at the company. And it's not very easy to scale that fast and keep the culture intact. So uh a big part of that is hiring, maintaining, and enabling culture warriors, people that are policing behavior that isn't of the company, right? And so we have been able to retain a lot of like huntress OGs that stick around. And when we see something that's too bro ish, too left of field, to not belonging to what the principles that we hold dear, we we internally police it. And a lot of that uh comes from one of our core uh competies, but one of our core mission uh tie-ins is transparency. And that really does come from our CEO. Uh he he is an oversharer in the best of ways, and and so he shares transparently internally, and that allows and he openly encourages dissent. So when we see something, we say something. And that's not a lot of companies say that. A lot of like a lot of companies say we make decisions based on data, and then they don't, right? Same sort of thing. Like we value transparency, and then you speak up and then you get punished for it. It's not that way, so it really that enables us to keep the culture intact at scale.

SPEAKER_02 7:08

That's amazing. Um the landscape for cybersecurity solutions is uh crowded. How does Huntress stand out in such a crowded market?

SPEAKER_01 7:25

When you're selling security tools to companies without security teams, the security expertise has to be baked in and not bolted on. And most security vendors here are software, and they are wanting to sell their software to people who run security tools. And what they're gonna find over time is in this market and in the majority of markets, because security expertise is very expensive. So the Fortune 500 can afford it, big banks can afford it, uh, three-letter government agencies can afford them, but not every mom and pop across the country and across the globe has a security uh person in-house to run security tools. So, what makes Huntress very different is our global SOC of now. I mean, it's always been this way. We've always had a ThreatOps team, but now at this scale, we have more than 100 people in our global SOC and North America, uh, Ireland and UK, and Australia. So follow the sun model. And with those security experts, like a hundred over a hundred of them, that's more than some of our competitors have employees in their entire company. And their entire job is making sure that keeping every one of our customers and partners safe, and that is baked into the platform. It's not an add-in, there's no skew for it. It just comes along because what we're trying to do is take a complex, a set of complex security tools and make it so that any IT team can get value for. That's a big differentiator.

SPEAKER_02 8:58

And as you think about the risk landscape from a cybersecurity perspective, what are some of the things that we learned this year about emerging threats? And what do you think might be around the corner as we head into next year regarding threats?

SPEAKER_01 9:16

So 84% roughly of our higher critical alerts that we set this year were in our ITDR service, that's identity threat detection response, and that is protecting mainly Microsoft 365. So Microsoft 365 right now is the perimeter. It's the attack surface. That's where the focus is. Of course, there's still threats in endpoint, there's still threats elsewhere, but it's the low-hanging fruit because so many people, both before, but especially during COVID, moved just immediately to M365 with security as an afterthought. And the the thought was well, it's it's Microsoft, it's in the cloud, it's going to be natively secure. Just like anything, it's as secure as you make it. And you have to have the settings in place and you have to have tools in place. And attackers have much quicker uh like cycles of development than defenders do. So they saw this mass migration as a giant opportunity, and they've been chasing it time and time again, and we have been defending it time and time again. So I would say right now, if you're listening to this, if you're watching this and you haven't done anything to protect your M365 environment, that is the opportunity. And whether it's Huntress or something else, please put something in place because that's where the attacker focus is. Uh, I think part what we do, detection and response on M365. I think the precursor to that is partners and customers learning how to use their conditional access policies well. If you don't have the licensing in place to do conditional access policy, there's still security settings you can put in place. And I think making sure, uh putting having tools to manage drift and policy drift and putting golden configs in place and making sure those stay there, uh, I think that's gonna be a big focus in 2026.

SPEAKER_02 11:08

Very cool. Um as you think about changes to the industry as a result of AI, uh, what does your crystal ball tell you about where we're going and the impact of AI?

SPEAKER_01 11:22

AI is going to infiltrate everything of our day-to-day. I know I, I'm sure you are using it on your phones, using it on your computer to make us more effective in everything that we do. That's no different than what people are gonna be using at work. But what it's not going to do, that I think uh is a little bit too far left afield, is replace us, replace this. And so uh there's a lot of talk about how there's gonna be mass layoffs, and I think people will get more productive, which will have impacts on the job market for sure, but there's still gonna be humans that are necessary to run the AI, to double check the AI. Uh, we are definitely using AI inside of Huntress, but we're doing so in a very thoughtful way because our false positive rate in EDR it's under 1%, in ITDR, it's under 5%. We can't just turn AI on and say, you're the sock now and have those numbers explode. It would kill our brand. That's that's not the point. So we are making using AI to make our threat hunters, our researchers, our analysts more effective, but it's a tool to get more productivity and go faster, further. Uh, but it is not something that's going to wholesale replace all human jobs. That's just gonna definitely increase the productivity. But we also see attackers are using it. So this is not the uh the the phishing emails and the smishing, the SMS phishing attempts. Uh 10 years ago. They're gonna be typos and poorly worded. Exactly, not bribe you're incredible. Please send money. It is uh very anybody in the world is lowered the playing field or leveled the playing field for attackers that are non-English first to be able to send a very realistic attempt uh and make it and then dupe voices and dupe videos. So, what I think that will do is erode trust even further in some of the the day-to-day communications things that we use. So if I get a call from Rob Scott and you're asking me to do something weird, I'm gonna say, oh, hey, buddy, let me let me call you right back. I'm gonna hang up and I'm gonna text you and be like, Did you just call me? Yeah. Because we can't trust communication that isn't sitting right in front of you. So it's actually gonna make human interaction more uh important than it has been when we can rely on believing in a video in front of us, believing in the email we got. I think it's gonna make human interaction even more uh important than it has been.

SPEAKER_02 13:54

I happen to agree with you. I think that as we get more and more down this path of an agentic enterprise, uh being human is going to be premium. Talking to humans, uh hanging with humans, reaching over and like touching you're real. You're a real person, right? I don't know what to expect from you. You have emotions, you may be tired, you may be hungry, you may be sad. That's an intrinsically human um characteristics to be emotional. These systems are not emotional, right?

SPEAKER_01 14:30

I wanted a late checkout, moving hotels, so I call the the front desk and it's the oh hey, um, hello, how are you today? It's the AI chatbot trying to be pretending to be human and putting pauses in speech, and I'm like, oh, just get on with it.

SPEAKER_02 14:49

I love the clicking keyboards. You know, our AI agents originally shipped with these clicking keyboards, like you're talking in a call center. I said, if you call my law office, it wouldn't sound like a call center. So turn that off, right? Um, but all of this is coming, we're working the bugs out of it, but all of it's gonna do is create a premium to be human. And and it manger, at the same time that we launched our AI legal assistants, we launched dedicated account managers for the same reason. Because there's gonna be that old school guy that maybe doesn't want to fool with AI and wants a real person to talk to. And then there's gonna be maybe the Gen Z person who's socially maybe doesn't want to talk to somebody, feels a little socially uncomfortable on the phone. Maybe their preference is to work with a bot or an agent or an online, you know, solution. And so I think for companies, it's going to mean omni-channon. You know, pretty soon, uh, for Manger, you'll be able to be onboarded completely with AI or not. You'll be able to be onboarded completely with humans or not. Or you have a hybrid. But the goal for us is to deliver it in the manner that's comfortable for you and in the in the way that you want to uh experience it. And it's almost like we're going through that age where the cashier lines at the grocery stores, right? Where you had some like two self-checkouts and a hundred, you know, person aren't manned ones, and now you walk in and there's two with a person and everything else is automated. And I think that's where we are a little bit with AI.

SPEAKER_01 16:27

That's a great analogy. The the key takeaway there is meet your consumers where they are and treat them how they want to be treated and make those options available. Yeah, don't put too many barriers in between what the action, the outcome that they want, and your sales process or your customer service process. They want to use a mock, let them use a mock. Yeah. If they want to talk to a human, let them talk to a human. Yeah.

SPEAKER_02 16:52

And make an easy, you know, the way I look at it is talk to a human when we're open and talk to our bots at four in the morning. Yeah, I talked to a client the other day. He says he wakes up at four, he does some paperwork. He can very well be working on contract stuff at four in the morning. I'm not waking up to do that. But now with our AI legal assistance through Montra Pilot, he can just wake up in the morning and do that. And I think companies that learn that AI is not an end in itself, it's not a replacement for humans, it's not, it doesn't have to be grandiose and super complicated, but starts with a conversation and it's just a tool to solve problems. Uh, but it's also going to create a lot of new problems, particularly in the world of cybersecurity. For sure. So, how are you guys preparing for the unique challenges of AI as relates to cybersecurity?

SPEAKER_01 17:46

A big portion of our SOC are threat researchers who all they do is study attack attacker TTPs, uh, techniques, tactics, and procedures. And our founders come from NSA background. They won uh DEF CON's world hacking competition. They like they are kind of cybersecurities in the or celebrities in the cybersecurity space. So we are able to attract top talent that otherwise we would have no business together. So all socks are not created equal. And a big like you can have uh a third-party sock that, hey, we got an outsource sock. Cool, who's in it? Like, were they working at Applebee's last week? Is it really an SOP standard operating procedure? Are they really just following a list of to-dos and then sending an alert over the fence? We actually have true security talent that globally renowned, known names in this community, that makes a difference. So that was that's what keeps us on the cutting edge of knowing where these techniques are coming from. And we will we will continue to bring out products where and and sometimes we'll partner and sometimes we'll innovate and sometimes we'll purchase. So a good app a good idea of the or a good illustration of the partnerships. We integrate Microsoft Defender into our EDR. Our ITDR is based on data out of M365. Microsoft has does a lot of this stuff already. They just don't make it super user-friendly for a lot of partners to consume. So for things that are kind of check the box, we'll we'll partner and we'll integrate there. For things that like ITDR, I said 84% of the high critical alerts are coming into that product. We're gonna innovate there because that's where the tax are focused. That's where we need to have most of our focus on stopping that. And then on the what's next, staying ahead of all the uh attacker techniques so that we know where the puck is going and we can either innovate and choose to uh build or buy to make sure that we are covering where the attacks are going and then to kind of partner where there's some check the box, insurance says NIST says we need to do this thing. Cool, let's check the box, let's get it in there, but let's innovate where the new attacks are actually focused on.

SPEAKER_02 20:01

Yeah, that's that's interesting. I I I'm wondering if um as we move forward, um the people with the deep domain expertise will be the leaders in AI. Um, I think that you know, my in my world, AI for legal, like I'm in a strong position. I have 900 customers, I have deep expertise in law. I graduated law school in 96. Coming up on my 30th anniversary of doing nothing with this every day, day after 10,000 hours long past. Right? Yeah, you start your 10,000 hours a little time ago. Yeah, long time ago. And so now I think that it's like the domain experts that open that expertise up using AI in a responsible and safe way, are the ones that'll be in the position to serve the most people in the best way. And so that's what that we're focusing on. I also recognize that there's some uh risks and concerns and some evil, like with social media, uh, any technology. There's the propensity for good and bad, and the more powerful the technology, the the scarier the potential for bad is. Where do you fit in this scale of being hopeful, being fearful, being cautious when it comes to the the societal impact of AI?

SPEAKER_01 21:33

The societal impact, that's an interesting question. Uh I so when Google started Googling, right? Uh there were similar questions around like uh people aren't gonna use books anymore. And uh what what is the world, what's gonna happen to the world? And uh this is another societal shift of uh when the internet Became a thing where every piece of information is at your fingertips. Oh, colleges and universities are gonna fold, we're not gonna need this anymore. I I I do believe AI will make it into everybody's everyday life who has access. And access will be an issue for in certain areas of the world. I d don't believe it's especially in the near term, it's going to change too much. I think there will be just like social media when I mean I was in college when Facebook first became a thing, and then it opened up to the world, and then now we have the law of unattended consequences. But I won't go we don't won't go down that rabbit hole, but I think we all know like what we're talking about. Uh people will definitely use it for the wrong reasons. We definitely need to have uh some global initiatives to put guardrails because what well I'll tell you what does scare me. Uh there's a vendor here that has one of the uh robots running around. When you take the intelligence of what we've seen with Chat GT or Anthropic or or Google Gemini, put that into a humoroid robot, that that kind of scares you. And I don't I don't know where that's gonna go. And I I sincerely hope that we're putting guardrails around that. Because then I've kind of some days I feel like uh this is not a big deal, then some days I feel like Wally and the Matrix are actually documentaries. And so I'm not sure which, but uh it opens up some interesting questions for sure.

SPEAKER_02 23:39

Yeah, it really does. And I think there's some important ethical questions that need to be confronted. Uh, I agree with you, I'm an optimist about AI, but a pessimist about people. And what I mean by that is that uh I fear what bad people will do with powerful tools in the same way that I fear what they'll do with nuclear weapons. Yeah. I don't want powerful tools in the wrong hands, and that's what scares me about uh any technology, not just AI. Um, but what I wanted to get you to weigh in on is slightly shifting gears here to, you know, Huntress Forever has sold direct. And I was so proud to see Mondra's logo next to Huntress's logo at the to at the Sureweb at the top of the phase there, uh, at the SureWeb booth, because uh we're both uh first time uh in distribution, both selected SureWeb as our first you know distributors in North America. And so I just want to talk to you about like um wide distribution at this time, what what made you think that it was the right time? And uh what do you think about distribution as a model for brands like Mondrin Huntress and other SaaS companies as we move forward?

SPEAKER_01 24:59

Huntress has always been multi-channel. We have sold direct through resellers, through MSPs, uh, but had direct relationships with those partners. So depending on your verbiage, yes, we we we sell directly quite a bit. Uh this is so we're 10 years in as a company, and we have always had a really good momentum through MSPs and reaching them, working with them directly, partnering with them directly to sell to their end clients. We're at the stage, so Series D 100, I think we announced it is around 120 million at uh in ARR at Series D to meet goals that we're gonna meet, uh to meet expectations of the industry for 26 and 27. You have to really juice up a full omni-channel strategy and that scale, when you're going from basically North America only to a global scale, it takes a lot of humans and a lot of effort to do that and a lot of localization to do that if if you're just gonna go and start a new uh whole go-to-market in every country on the planet. That doesn't scale very rarely. What does scale is working with the distributors that are known locally and are some of which are known globally. And we're not reinventing the wheel here. Uh distribution has been in place since uh the technology hardware started shipping uh 40, 50 years ago.

SPEAKER_02 26:32

Yeah.

SPEAKER_01 26:33

And we are now uh understanding that we're what got us here won't get us there. And so we're kind of we're it's all it's still the same Huntress, but we need Huntress to be known in more places. And earlier this year, we did a big deal with Microsoft. We're moving our back end from AWS to Microsoft to uh to open up a lot of doors in a lot of ways because we have Microsoft embedded in our product, and so when they see, they have data that sees when when Huntress is deployed, Defender is deployed in very outlandish numbers. So they they want to introduce us to more places. Well, the places they want to introduce us to are distributors, that's their big lever. And so it all makes sense when you're when you look at it, take a step back and see, well, how are we gonna get there from here? We need to be in a global fashion and more channels than we are today to give more resellers. If we wanted to go from 100 to 5,000 resellers, we're not gonna go meet them and shake hands individually. We it's going to be through distribution. So we wanted to start with Sureweb uh because relationships matter. And we uh you and I both have good relationships with people there and have a high degree of trust, and and culture matters, and their culture aligns with our mission. We are an MSP first company, we are going to become more omnichannel, but MSPs will always be an MSP first company, as are they, and their focus being uh being a Canadian company of having the home base of uh Canadian uh MSPs, and they bought microwarehouse in Ireland uh last year, I believe. That allows us to scale out globally with them. It made perfect sense to be our first step in that right direction.

SPEAKER_02 28:22

Well, I I I totally agree with everything you said and um made the re decisions for the exact same reasons as you. And I also agree that localization is hard. We just finished our first translation of our legal agreements into French for the Quebec market. And it's uh that was just one relatively small market, and uh it was a lot of work. It's not easy to do, and so I recognize what you're saying there. Um as you think about um 2026 from a personal perspective, not just for Huntress, but for Jeremy, um, what are your big per personal goals for next year?

SPEAKER_01 29:02

My personal goals for next year, uh I just got married last month. Thank you, sir. And I have a two and a half and a five-year-old. So uh I would like to probably travel a little less for Huntress and spend a little more time uh with making sure I'm at all the big milestone events for for my daughters and and for my wife. Uh uh so I think probably traveling a little less, fishing a little more, getting back to when you're when you're in startup world for as long as we've been, you tend to lose track of some of your hobbies. And losing track of some of the hobbies means you're losing track of some of yourself. And so I would like to regain some of that ground lost uh to startup world into making sure I'm taking time to be in nature and be fishing and and sharing that with my family.

SPEAKER_02 29:51

That makes a lot of sense to me. I I I think it's funny that you're 120 million ARO. Uh you're a global company with a great reputation and you still refer to yourself as a startup. So I consider that to be a positive thing, reflective of your culture and your mindset. So kudos to you. Um as you think about traveling less next year, now you have to prioritize. So, how will you prioritize where you go and when uh so that you can uh be strategic in the time that you spend on the road?

SPEAKER_01 30:31

Some of that is gonna might be decided for us or decided for. I mean, so I guess the real answer is whatever Tracy tells me to do. Yeah, but uh honestly, where I have the biggest community impact, and so I I've done the most of the exchange events this year, I've done most of the peer group events this year, and peer groups are a very powerful tool in the MSP space. And making sure, because we are in peer groups ourselves in these organizations, and so that those are honestly my favorite events of the year. Going and seeing you and seeing all the people in my peer group, that's uh it's work, but that part kind of is now at this point a personal thing. I put that in the category of personal because these people we've I've been at for four years, you've been about that long, yeah. So these I see some of these people quarterly more than I see some of my good friends back home.

SPEAKER_02 31:25

So be you know, when you're in the channel, the channel becomes your new family. I I'm I think on show 47 this year personally, and Monja will do a hundred shows this year. And um, I just think back to when my kids were home. My baby's 21, my son is 25, and when they were home, I could never take 47 work trips. Um, for the first time in my career, I'm executive platinum on American, but I can't touch my toes. My back hurts like hell. I went to my trainer, and my trainer said that I can't play golf because I'm I've failed my screening. Oh, jeez. So now I'm I got a little three weeks of corrective exercises I have to do just to be able to get back to playing golf.

SPEAKER_01 32:16

But Rob, what are you talking about? Traveling for work is fun. You you have the easiest job in the world. You get to stay in hotels all the time, right? Uh yeah.

SPEAKER_02 32:24

Yeah, the problem with that is this I have a sleep number in bed at home. My sleep number is 40. Do you know how many times in those 47 trips that I take this year? The sleep the bed in the hotel was close to a sleep number 40?

SPEAKER_01 32:40

Zero. Zero. Because my sleep number is 35. So you get it. Yeah, I'm a side sleeper, and so I have to travel with a little massage gun because I wake up and my shoulders are errors.

SPEAKER_02 32:50

It's like hell, like my neck mobility is worse than it's ever been. Uh, so it does take a toll on you. Uh, being in this industry is a blessing, but it's not um a glamorous lifestyle. Uh the people who who do this work work very hard at tremendous sacrifice of their time uh with their families and their personal lives to create this community, to create this energy. Absolutely. Um, I can walk there's thousands of people here. I can't take 10 steps without seeing a client, a friend, a colleague. And that's the IT nation.

SPEAKER_01 33:26

Yep. This event is a family reunion. Yeah.

SPEAKER_02 33:29

Well, ladies and gentlemen, there you have it, my good friend Jeremy from Huntress. Jeremy, thank you so much. Thanks very great, man. Thank you all for watching.

SPEAKER_00 33:38

You've been listening to Talk Tech with Rob Scott, brought to you by Monger. Monger is the first mover in providing contract as a service solution that's specifically designed for IT managed service providers.