Introducing ITDR Lookback: Find Out Who Was in Your Microsoft 365 Tenant Before You Were

Huntress has introduced "Lookback," a feature within its Managed ITDR service designed to identify existing compromises in Microsoft 365 tenants during the onboarding process. By analyzing up to 180 days of historical login data, the system seeks to eliminate the "blind spot" that occurs when a security tool is deployed after an attacker has already established a foothold. The service distinguishes between active threats, which are immediately contained by a Security Operations Center (SOC), and historical breaches that have already been remediated, which are documented for contextual awareness.
The utility of this approach is illustrated through three case studies involving a title company, a school district, and an architecture firm, where attackers had persisted for periods ranging from three to twenty-seven days prior to onboarding. For Managed Service Providers (MSPs) and internal IT teams, the tool provides a documented audit trail of the environment's state upon inheritance. This historical analysis is paired with a broader suite of identity tools, including an Executive Summary for business leadership and a Rapid Identity Triage dashboard.

* Huntress released a Lookback feature for Managed ITDR.
* The feature is available for newly onboarded Microsoft 365 tenants, including trial accounts.
* Lookback analyzes up to 180 days of Microsoft 365 login history.
* The tool scans for credential theft, token theft, adversary-in-the-middle attacks, suspicious browsers, and datacenter logins.
* Active compromises trigger a critical Incident Report and session revocation by the Huntress SOC.
* Remediated compromises are listed in an Identity Security Assessment.
* Lookback runs automatically once during the onboarding process.
* Early testing involved 400 tenants over two weeks.
* Three specific cases of active compromise were identified: a title company, a school district, and an architecture firm.
* The feature is integrated with a new ITDR dashboard and Executive Summary.

The strongest version of this narrative is that security is not a "day one" event but a continuous state; therefore, knowing the historical health of an identity environment is a prerequisite for effective protection. By automating the audit of the previous six months, the service reduces the manual burden on IT staff to become forensic specialists.
However, the presentation follows a classic vendor-led persuasion model. It leverages high-stakes anecdotes—such as a $2 million wire transfer and a compromised school district—to create a sense of urgency. This framing positions the tool not merely as a convenience, but as the only barrier between a "lousy security strategy" and a catastrophic loss. By citing its own internal testing of 400 tenants to validate its efficacy, the narrative creates a closed loop where the vendor provides the problem, the evidence, and the solution simultaneously.
Patterns detected: ARC-0043 Authority Game, ARC-0001 Fear Appeal
The driving paradigm is the "Inherited Risk" model, which assumes that any environment not previously monitored by this specific tool is potentially compromised. This echoes a broader industry trend of shifting from "perimeter defense" to "assumed breach," where the goal is no longer to keep attackers out, but to find them faster.
The second-order consequence is an increased reliance on proprietary black-box forensics. When the "proof" of a compromise is delivered via a vendor's proprietary assessment, the user's agency is shifted from investigation to consumption of a report.
Bridge Questions:
1. What alternative methods exist for auditing M365 login history without third-party proprietary tools?
2. How does the "active vs. remediated" distinction handle sophisticated attackers who intentionally mimic remediation patterns?
Counterstrike Scan: A coordinated campaign would use "fear-ware" tactics—highlighting specific, terrifying industry failures to compel immediate subscription. While this content uses these tropes, it remains a standard product announcement rather than a deceptive influence operation.