Huntress

Huntress owns a market the enterprise-security giants have never bothered to serve well: the small and mid-sized businesses and the managed service providers (MSPs) that run their IT, a segment that has become the single most-targeted victim class for ransomware operators. That focus is producing enterprise-grade numbers — Huntress crossed $100M ARR in September 2024 and reached roughly $120M by 2025, protecting more than 120,000 businesses across 3 million-plus endpoints and a million-plus identities. The June 2024 $150M Series D (Kleiner Perkins and Meritech, existing backer Sapphire) valued it above $1.5B against roughly $350M raised, capital that funded expansion beyond managed EDR into identity threat detection for Microsoft 365, security-awareness training, and SIEM-style logging — a genuine platform for buyers who can never staff a security operations center of their own. The moat is the combination the SMB channel cannot replicate: a lightweight agent priced for the mid-market paired with a 24/7 human-staffed SOC that triages and hunts, delivered through the MSP partner motion that gives Huntress distribution leverage rivals spend years building. Founded by three former NSA operators, the company sells credibility as much as software. If the down-market threat curve keeps steepening — and every ransomware trend says it will — Huntress is the default consolidator of security spend for the millions of organizations CrowdStrike and Palo Alto price out.

Huntress monetizes the least affluent buyers in cybersecurity, and that ceiling is structural: SMB seats carry small absolute dollars, tolerate little price elasticity, and churn hard in any downturn because security is the first line SMBs cut when cash tightens. Growing from $120M ARR to a venture-scale outcome above a $1.5B mark means adding hundreds of thousands more of the industry's thinnest accounts, and the human-staffed SOC that differentiates the product also caps its margins — every new customer cohort demands more analysts, the opposite of the software leverage investors underwrote. The competitive walls are closing in from above and below: CrowdStrike's Falcon Go and SentinelOne target the same mid-market with brand and platform breadth Huntress cannot match, Microsoft bundles Defender into the very M365 subscriptions Huntress's identity product monitors, and every MSP-focused RMM vendor is racing to attach native security. Channel dependence is a double edge — MSP partners own the customer relationship and can swap the underlying vendor, so Huntress's distribution advantage is also a distribution liability. At a $1.5B-plus private valuation with an IPO widely expected, the company must prove that the underserved-SMB thesis scales into durable, high-margin recurring revenue before the majors decide the segment is finally worth taking seriously.