24/7 threat detection and response from Huntress, managed by us. When something goes wrong at 2am, we take the call and handle it so you don't have to wake up. Built for businesses under 50 employees that already have IT help.
Your IT person keeps the lights on. They set up laptops, fix email, and get the printer talking again. That's a full-time job.
Security is a different job. Attackers don't break in at 2pm on a Tuesday while someone's watching. They log in with a stolen password at 3am, set up an email forwarding rule, and wait for an invoice to come through. Catching that takes people watching around the clock and knowing what "normal" looks like.
Most small businesses don't have that. And the ones who try to buy enterprise security tools directly run into a wall pretty fast.
of breaches at small and mid-sized businesses involved ransomware, compared with 39% at large organizations.
Source: Verizon 2025 DBIR SMB snapshot (PDF) →hacking-related breaches at small businesses came down to stolen credentials, making it one of the top ways in.
Source: Verizon 2025 DBIR SMB snapshot (PDF) →year-over-year jump in attackers abusing remote access tools, the same ones IT people use every day.
Source: Huntress 2026 Cyber Threat Report →Huntress is one of the best-regarded security platforms for small businesses. But if you buy it directly, Huntress requires at least 50 seats per product. A 15-person office can't get in the door.
And the software is only part of the job. Huntress's own pricing page is upfront about it: buy direct, and your team handles deployment, integration and acting on what their security team sends over. Their analysts are excellent, and their assisted remediation handles a lot of the cleanup in a click. But when they find something at 3am, the report still lands in someone's inbox, and if there are manual actions beyond the assisted remediations, somebody has to do them.
That's the gap we fill. Through us, there's no seat minimum, and we're the somebody. We take the 3am call so you don't have to wake up, approve the fixes Huntress can make, and do the hands-on work a report can't: undoing an attacker's changes on a computer through our remote management agent, or locking down and cleaning up a compromised Microsoft 365 or Google Workspace account.
Source: Huntress pricing, seat minimums and what's not included →Co-managed Huntress through us. No minimums. We run it, we take the alerts, we handle the response.
Contact UsYou're big enough to go straight to Huntress. Start with their free trial.
Start a Huntress trial ↗Want to run Huntress in-house but buy it through a partner? We resell Huntress too.
Ask Us to Be Your ResellerEvery computer and server gets a lightweight agent that watches for how attackers actually behave: hiding tools that survive a reboot, moving between machines, or starting to encrypt files. Huntress analysts investigate around the clock. If a machine is compromised, it gets cut off the network in minutes, and we handle the cleanup, day or night. Microsoft Defender antivirus is managed too, at no extra cost.
Most breaches now start with a stolen login, not a virus. This watches your Microsoft 365 or Google Workspace accounts for logins from places your people have never been, stolen sessions that skip past MFA, sneaky inbox forwarding rules, and shady apps someone clicked "Allow" on. When it finds a compromised account, the attacker gets kicked out and the account gets locked, fast. Then we sort out what they touched.
Microsoft 365 ships with a lot of security settings turned off. Huntress ISPM checks your settings against the CIS benchmark (things like blocking old login methods and requiring MFA everywhere), flags what's missing, and spots when settings drift. We review its suggestions with you and make the changes, testing first so nothing breaks. That review and implementation work is billed at our hourly rate. Microsoft 365 only, and it works best on Business Premium.
Short, animated episodes your team will actually finish, plus practice phishing emails so they learn what the real ones look like. People who click get quick coaching on the spot. Completion and phishing-test results get tracked, so there's something to show your insurance carrier or auditor when they ask.
Your computers, firewall, and cloud accounts all keep logs. Most businesses never look at them until something goes wrong, and by then they're gone. This pulls the security-relevant logs into one place, keeps them for a year or longer, and has analysts watching them for signs of an attack. When an auditor, insurance carrier, or investigation asks for records, they're there.
If your IT provider is a company, we'll work with them directly. We're not trying to take their job. If you'd rather hand off everything, our managed IT support covers the day-to-day too.
Free download
A two-page PDF with our prices, what's included and what costs extra, plus who does what and what happens at 2am. Handy for sharing with your IT person or business partner.
We'll email you the link, and we'll send you marketing emails about our services (unsubscribe any time). The newsletter only starts once you confirm by email. See our privacy statement.
Their analysts confirm it's real and flag it.
Day or night, 2am included. Our team picks up the phone, not you.
We isolate the affected computer or lock the compromised account and stop the attacker's access.
You choose up front. Most clients have us clean up right away: password resets, MFA re-registration, removing what the attacker left behind, and checking who else got hit. Some want us to wait for their OK, and some have their IT person do it.
What happened, what we did, and anything you need to decide. Not a ticket number and a to-do list.
Does your cyber insurance need to be notified? Do you need an outside forensics firm? Are there notification obligations for customer data? We help you figure out who to call and in what order. (We're not attorneys, so anything with a legal deadline gets confirmed with your counsel.)
Whatever let them in gets fixed so it doesn't happen twice.
Nobody plans for a breach. But you can plan who picks up the phone at 2am. That's us.
The person on the other end of the phone is Matt Chapman, our Director of IT. Matt has spent more than 15 years keeping IT running for government, university and nonprofit organizations, including Army European Medical Command. When an alert comes in after hours, his team triages it, contains it, and hands your IT person a plain-English summary.
Managed Nerds was founded by a team with backgrounds in Army cyber operations and government IT. We resell and co-manage Huntress, and we work alongside your IT person, never instead of them.
Want a second set of eyes on what's already in place? We run Huntress every day and check Microsoft 365 against the CIS benchmark, so we can tell your IT person what's solid and what's worth fixing.
Co-managed clients can also buy their other business software licenses through us, so it's one less vendor and one less bill to track. (Your IT person keeps managing them.)
You keep whoever handles your everyday IT. We take ownership of your security tools and incident response. We work alongside your IT person or provider, not instead of them.
No. It's month-to-month.
It's month to month with no seat minimums, and up to one incident response a month is included. Our prices are in the free pricing guide, along with what's included and what costs extra. Every business gets a custom quote, and per-seat prices step down as you add computers and users.
If you have 50 or more seats per product, yes. You can start a free trial directly with Huntress, or buy through us as your Huntress reseller. Either way, your team deploys it and acts on what their security team sends. Under 50 seats, Huntress requires going through a partner like us, and we do that work for you.
Yes. Co-managed clients can buy Microsoft 365, Google Workspace, Adobe, and NinjaOne backups through us. We sell the licenses; your IT person keeps managing those tools. Our co-management covers Huntress only. Handy if you need a Microsoft 365 Business Premium upgrade to get the full Microsoft 365 hardening.
Yes. We connect your log sources, act on anything the security team flags, and pull records when an auditor or insurance carrier asks.
No. That's the point. If you ever want full managed IT support too, we offer that, but it's not required.
Two things.
On your computers and servers: we install two small agents, the Huntress agent and our remote management agent. Huntress can spot an attack and cut a computer off the network, but some cleanup has to be done hands-on, like undoing changes the attacker made, removing software, or restarting the machine. Our remote management agent lets us do that right away, at 2am if needed, without anyone at your office touching the computer.
In your Microsoft 365 or Google Workspace: we need our own admin account. For Microsoft 365 that's a dedicated global admin "break-glass" account; for Google Workspace it's a super admin account. It's reserved for security work, so when an account gets compromised we can lock it down, reset it, and clean up after the attacker without waiting on anyone. It's also how we apply the Microsoft 365 hardening settings.
We'll coordinate the setup with your IT person.
Huntress finds and contains the threat. Fully cleaning it up sometimes takes hands-on work on the machine. Our agent is how we do that remotely and fast, so a compromised laptop doesn't sit isolated until someone's in the office.
Both agents are lightweight. Most people never notice they're there.
Login monitoring works on any Microsoft 365 or Google Workspace plan. For the full Microsoft 365 hardening, Business Premium (or a plan with Entra ID P1) is recommended, because some of the most important security settings require it. We'll tell you if an upgrade is worth it.
Yes for login and email monitoring, endpoint protection, and training. Microsoft 365 hardening comes from Huntress ISPM, which is Microsoft 365 only. We can harden Google Workspace as a separate consulting project, quoted on its own.
It works with Microsoft Defender, which is built into Windows, and Huntress manages Defender for you at no extra cost. If you're paying for a separate antivirus, we'll talk about whether you still need it.
We take the call. When Huntress flags something after hours, our team triages it and contains it: isolating the computer or locking the compromised account. Cleanup is your choice, agreed up front: most clients have us do it right away, some want us to wait for their OK, and some have their IT person do it. Either way, you'll have a plain-English rundown of what happened and what we did waiting for you in the morning. Up to one incident response a month is included in the price; additional incidents in the same month are billed at our hourly rate.
Many cyber insurance applications ask about endpoint detection and response, MFA, and security training. This covers all three, and we can give you documentation for your application. Your carrier makes the final call on coverage.
Yes. When a customer, partner or insurance carrier sends a security questionnaire, we help you answer it accurately, using the monitoring, MFA, training and incident response records this service keeps. If a question shows a gap, we'll tell you what it would take to close it. Questionnaire help is billed at our hourly rate.
It's month-to-month, so you can stop anytime. We'll remove the agents and disconnect your accounts. Microsoft 365 hardening settings stay in place, so you keep the protection.
Send us a message through the form. We'll look at what you have, tell you where the gaps are, and give you a straight answer on whether this makes sense for you.
Contact Us →