businesses protected
identities protected
endpoints protected
customer satisfaction
Source: Huntress, July 2026
Licensed doesn't mean monitored.
Most SMEs licensed the right tools long ago. What's missing is someone who watches around the clock and steps in — and a team that spots phishing before anyone clicks.
Microsoft 365YOUR TOOLS
Defender, Entra ID and Conditional Access are included in Business Premium. They flag anomalies and fix some things automatically — someone else has to investigate alerts around the clock and act when it counts.
MONITORING & TRAINING
Huntress's 24/7 SOC, where AI and security analysts work together, investigates alerts and steps in itself. On top of that, Huntress trains your team to spot phishing every month.
OPERATIONS
Theia sets everything up, coordinates the next steps with you when something happens, delivers the reporting and is your point of contact in Zurich during business hours. We run Huntress ourselves and operate it for several Swiss organisations.
Microsoft 365 supplies the tools, Huntress the monitoring and training, Theia the operations.
Three modules, one platform.
Accounts, devices and people: all three modules run on the Huntress platform and are set up and run by Theia.
Huntress ITDR
Identity protection for Microsoft 365 and Entra ID
run by Theia
- Detects stolen session tokens that attackers use to bypass MFA, and stolen credentials
- Flags sign-ins from malicious data centres, via residential proxies, from unexpected countries or via anonymous VPN services
- Uncovers malicious OAuth apps (rogue apps), suspicious automations (shadow workflows) and tampered inbox rules
- When it counts, the SOC revokes the sessions and disables the account — AD-synced accounts too, when the Huntress agent runs on the domain controller
According to Huntress: identity threats answered in under 3 minutes.
Huntress EDR
Device protection for laptops, PCs and servers
run by Theia
- Finds persistent footholds, malicious process behaviour and lateral movement across the network — not just known viruses
- Ransomware canaries raise the alarm early; external recon checks which ports are open to the internet
- For ransomware or fast-spreading malware, the SOC isolates the device and remediates the infection
- Works with Microsoft Defender: uses its telemetry and manages Defender Antivirus on Windows at no extra cost
According to Huntress: 8-minute MTTR, under 1% false positives, deployed in under 20 minutes.
Huntress SAT
Security awareness training for your team
run by Theia
- One simulated phishing email per person each month — Huntress picks the scenarios
- Anyone who clicks gets a short coaching walk-through of exactly that email
- Short story-based episodes, typically 7–10 minutes — chosen by Huntress, monthly or quarterly
- Learners synced daily from Entra ID, “Report phish” in Outlook, notifications in Teams, reports for management
Switzerland's Federal Office for Cybersecurity (BACS) considers awareness training for all employees to be of central importance.
According to Huntress: 1M+ learners, 98% completion rate for learners who start an assignment.
The learner portal and episodes come with German text and subtitles (French and Italian too); the narration is in English. Phishing simulations come from Huntress's global scenario set and are in English.
Also available on request: Huntress Managed SIEM and Managed ISPM.
Clear pricing, fully managed.
Included in the price: Huntress's 24/7 SOC plus setup, support and reporting by Theia.
All-round protection from CHF 10 per user per month = one identity, one device and one employee in training. Not a bundle, simply the sum of the three modules.
CHF 2 per protected Microsoft 365 identity
CHF 5 per monitored device (laptop, PC, server)
CHF 3 per employee in training (active learners)
German text and subtitles; narration and phishing simulations in English.
excl. VAT · 12-month minimum term, then cancellable monthly
Order directly
Send your configuration as an order request — we get back to you within one business day.
Non-binding order request — we confirm scope and start date before anything is charged.
We confirm scope and start date and answer open questions, including on data protection.
ITDR via global-admin consent, the EDR agent through your device management, SAT learners synced automatically from Entra ID.
As soon as everything is connected, Huntress monitors around the clock, and Theia looks after you from Zurich and delivers the reporting.
Prefer to talk it through first? Book an intro call
What is ITDR — and why isn't MFA enough?
ITDR stands for identity threat detection and response: user accounts are monitored continuously for signs of takeover, and confirmed attacks are stopped.
MFA remains a must; Switzerland's Federal Office for Cybersecurity (BACS) recommends it for business-critical access. But an attacker who steals a valid session token is already signed in. ITDR detects what happens next: the sign-in from a malicious data centre, the new inbox rule, the malicious OAuth app. MFA protects the sign-in, EDR the device — ITDR the account itself.
The situation in Switzerland
Source: Swiss Federal Office for Cybersecurity (BACS), bacs.admin.ch
A typical case, step by step
An attacker steals a signed-in session through phishing and signs in via a residential proxy. At that point MFA no longer helps — the session already counts as verified.
ITDRHuntress ITDR flags the unusual sign-in. In the SOC, the AI system Athena investigates the alert; ambiguous cases go to security analysts.
SOCThe SOC revokes the sessions and disables the account, around the clock. A device hit by ransomware would be isolated.
Theia gets in touch with you, coordinates the next steps, such as a password reset and a review of inbox rules, and records the incident in the reporting.
SATWith Huntress SAT, the affected person gets the matching training episode.
Huntress acts around the clock. Theia is there for you in Zurich during business hours. Talk to us about your environment →
Frequently asked questions
Microsoft 365 backup in the Swiss Fort Knox
Huntress protects accounts and devices — an independent, immutable backup protects your data. Daily, encrypted, in Switzerland.
Setting up Microsoft 365 from scratch? Have Microsoft 365 set up
Who's watching when it matters?
In 30 minutes we work out which accounts, devices and employees you should protect and what it costs — and go through your questions on data protection and the contract. No obligation.
Huntress is a trademark of Huntress Labs Inc. Product information and figures as stated by Huntress; company figures from the press release of 30 July 2026. Microsoft 365, Microsoft Defender and Microsoft Entra are trademarks of the Microsoft group of companies. Theia Solutions sets up and operates the Huntress solutions as a managed service for its clients.