NetSmart streamlined its security stack, stopped a ransomware attack in its tracks and demonstrated the value of security awareness training by standardizing on the Huntress Security Platform.
The challenge: tool sprawl and a skeptical client
NetSmart was managing too many security tools and dealing with constant alert noise. It wanted a simpler view of client environments without adding staff, while one customer remained unconvinced that security awareness training was worthwhile.
One platform, a fast response
Standardizing on the Huntress Security Platform gave NetSmart a unified view of its environment. At 2:30 a.m., ransomware hit a co-managed client’s externally hosted servers. The 24/7 Huntress Security Operations Center detected the threat and isolated affected systems.
Of the 375 endpoints protected by Huntress, none were infected. The incident showed the value of having overnight monitoring and response available when NetSmart’s own team was off duty.
Making security awareness measurable
A phishing test through Huntress Managed Security Awareness Training recorded a 20% click rate for the skeptical client. That result made the training gap visible, helped the client understand the risk and secured their buy-in for improving awareness.
- Simplified the security stack with a unified view.
- Contained a ransomware incident; none of the 375 protected endpoints were infected.
- Used a 20% phishing-test click rate to demonstrate the need for stronger security training.
“Out of the 375 endpoints that we managed, none of them got infected. And now we’ve got a client for life.”
Ken George, President and Founder, NetSmart, Inc.
Security results customers can see
NetSmart’s story connects operational simplicity with concrete outcomes: a rapid overnight response, protected endpoints and a clear way to show a customer where training needed improvement.
What the NetSmart incident demonstrates
The reported ransomware incident happened at 2:30 a.m. on a co-managed client’s externally hosted servers, when NetSmart’s own team was not on duty. A 24/7 security operations center detected the activity and isolated the affected systems. NetSmart reports that none of the 375 endpoints protected by Huntress were infected. The case shows the practical value of overnight monitoring and response when threats do not wait for office hours.
The phishing test provided a separate lesson. A 20% click rate gave the skeptical client a measurable indication that existing awareness efforts were not working as intended. Rather than relying on assumptions, NetSmart could use a test result to begin a more concrete conversation about training and risk.
Takeaways for IT providers
- Plan for incident detection and escalation outside normal business hours.
- Know which systems can be isolated and who authorizes containment actions.
- Use phishing simulations to identify coaching needs, not to shame employees.
- Show customers measurable outcomes and agree on follow-up actions.
These outcomes belong to NetSmart’s specific deployment. They are not a promise that every incident will have the same result, but they demonstrate how managed detection and measurable training can support a more informed security program.