Managed ESPM

As part of ESPM, it would be great to be able to lock down USB ports on devices. It's a feature that many MSP's have asked me about

Many security and compliance frameworks require organizations to enable and enforce some form of Application Control and to maintain a list of organization-approved applications that can be installed and run. In the many conversations we've had with our partners and prospects, we've found that managing Application Control and maintaining a list of approved applications is a significant burden even for larger teams and nearly impossible for small teams. The journey of starting in audit mode and building a list of approved applications and eventually getting to enforced mode is one that many folks never finish. Our intention is to build a fully managed Application Control capability into the Huntress portal that will allow the Huntress SOC to manage and maintain lists of legitimate applications and will enable our partners to add those applications to approved lists, while maintaining a short feedback loop for end users so they don't get stuck waiting days for security approval. This feature request will act as an umbrella for this functionality. If you are interested in helping us build this out by joining a Private Beta group, please upvote this feature request and we will email members of this group as we open up more spots in the beta.

Please implement a workflow for Managed ESPM that allows end-users to request approval when they encounter an execution block while in "Enforce" mode. Users should be prompted to provide a justification for their request, which should then trigger a ticket in our PSA to review and approve.

There are many programs that customers will use that give remote access to actual vendors. It would be nice if they do need to run one of those programs it pops up an alert for them to call x phone number for approval. Then us as techs get a text with the customer account name. Name of the program and an access key we can give them to give them the ability to run the program for 1 hr (or this is a threshold we set within huntress as a default) So once they call we do some investigating into what its for before giving them the access key.

OK. This looks like it has the bones to bold on a PAM. Since you guys are working on a phone app and you have ESPM in the works. Can we have this be full blown PAM? That would awesome!!!

Can we get rustdesk added to the catalog please?

Currently ESPM is not dropping tickets. It would be good to have notification at least when a new RMM is found that needs a decision made.

Wouldn't it make more sense to approve tooling based on hash vs "approved installation paths"? For example, a common method for TA is using a trojanized installer from a valid (compromised) source, and installing to a standard location on endpoint. If I approve the install location, then doesn't that open up a potential method for TA to drop into an "approved" location to bypass this tool?

We host a bunch of webapps internally and externally and we have to juggle multiple tools and systems for vulnerability scanning. Would be good to see this as a feature in Huntress

A valuable enhancement to Huntress Managed ESPM would be the ability to deploy and update approved software through a Huntress-managed repository. By limiting endpoints to software packages that have been validated, digitally signed, and distributed through a trusted source, organizations could reduce exposure to malicious or compromised third-party updates and strengthen protection against software supply-chain attacks. Endpoints could be configured to permit installations and updates only from the Huntress-managed repository, with exceptions controlled through policy. Additional safeguards—such as package integrity verification, application allowlisting, staged deployments, audit logging, rollback capabilities, and administrative approval workflows—would provide greater control while reducing operational risk. This capability would align well with Managed ESPM’s stated focus on endpoint configurations, applications, vulnerabilities, and attack-surface reduction. It would not eliminate supply-chain risk entirely, but it would establish a more controlled and verifiable software-update process.