The Hacker Who Hunts Hackers

The Hacker Who Hunts Hackers
Inside Huntress with Ben Folland

Better-IT’s Tim Grayson and Michael McHugo recently caught up with Ben Folland, a front-line Security Operations Centre Analyst at Huntress, and Megan Kearney, the company’s EMEA SoC Manager.

Ben spends his days tracking digital footprints, analysing alerts, and stopping attackers before they can cause damage. Essentially, he’s a cyber detective and ethical hacker who hunts those who hunt and hack others online.

Overseeing the wider operation is Megan Kearney, an experienced cybersecurity leader who has spent nearly a decade shaping Security Operations Centre teams and improving threat response workflows across the industry.

Huntress is one of Better-IT’s main cybersecurity partners, delivering Endpoint Detection and Response (EDR) and Identity Threat Detection and Response (ITDR) as part of our Better Secure package. Together, we help small and mid-sized businesses access enterprise-grade protection 24/7.

How would you explain your role there at Huntress?

Huntress (Ben Folland): As a Security Operations Centre Analyst, I investigate and respond to alerts generated by the Huntress platform. The software runs on all client endpoints, capturing telemetry that helps us identify suspicious or malicious activity.

Think of your organisation’s network as a castle. Around the castle walls are hundreds of invisible tripwires, designed to detect anyone trying to sneak in. When one of those tripwires goes off, my job is to check what caused it. Was it a harmless gust of wind, or someone breaking a window? If I find signs of a break-in, I act immediately to contain the threat, lock down access, and stop the intruder from moving through the castle or stealing valuables.

Without that human investigation, we’d never know whether a trigger was something harmless or the start of an attack. That’s where Huntress analysts come in, validating and responding to what our technology detects. When I’m not on the front line responding to threats, I attend industry events to raise greater awareness about our work, and engage with the wider cybersecurity community, which I really enjoy.

Tell us about your background. How did you get started in security?

Huntress (Ben Folland): I came into cybersecurity in a slightly unconventional way. When I was 14, I joined a government programme called Cyber Discovery that introduced teens to the industry through capture-the-flag challenges. I didn’t realise then that it could actually lead to a career.

After school, I planned to study maths, but security pulled me back in. I worked in a SoC at a consultancy for two years before joining Huntress. Initially, I was fascinated by ethical hacking – the idea of legally breaking into systems and reporting vulnerabilities – but once I started responding to real incidents, I found the rush of protecting companies far more rewarding. Every time I help prevent a ransomware attack, I end the day knowing I’ve helped a business stay safe.

What would you say are the biggest challenges right now, and how has that evolved?

Huntress (Ben Folland): Ransomware is still the biggest threat. It hasn’t gone away – it’s evolved.

These attacks are no longer the work of lone hackers; they’re run by organised criminal groups with their own departments – negotiators, developers, even money launderers. They infiltrate networks remotely, often from across the world, steal and encrypt data, then demand payment for its return.

While big-name companies make headlines, most ransomware victims are smaller businesses without in-house security. These attacks happen daily, even though we rarely hear about them. The reality is that no business is too small to be a target.

If someone only had ten minutes today, what could they do to instantly improve their security?

Huntress (Ben Folland): Enable multi-factor authentication (MFA). Even strong passwords can be compromised, but MFA stops attackers in their tracks. Use an authenticator app rather than SMS, and make sure it’s turned on for every account. It’s the quickest, simplest, and most effective improvement anyone can make.

Let’s say a client has been breached. As a Huntress SoC analyst, what’s your immediate checklist for recovery and lockdown?

Huntress (Ben Folland): The first step is containment – stopping the attacker from moving through the network or stealing more data. Then we determine the scope: is it one compromised account, one device, or multiple systems?

If it’s a single account, we lock it down. If it’s widespread, we isolate the environment to stop the threat spreading. Once that’s done, we can slow down and investigate how they got in, what they accessed, and what needs fixing.

We then remediate – changing passwords, patching vulnerabilities, closing access points – and strengthen the environment for the future.

For end users who think they’ve clicked a phishing link, the best step is to contact IT straight away, change their password, and enable MFA. Huntress analysts handle the rest – disabling compromised accounts, revoking sessions, and giving clear steps to get back to a safe state.

Are there any career highlights or experiences you’re particularly proud of?

Huntress (Ben Folland): Every day saving a business feels like an achievement, but a few moments stand out. I presented research at DEF CON – the world’s largest hacker conference in Las Vegas – on intercepting cybercriminal communications. I also reached the finals for the UK Cyber Team qualifiers, which was a great experience. But honestly, helping real businesses avoid disaster still gives me the biggest buzz.

In your own words, how does Huntress stand apart from its competitors?

Huntress (Ben Folland): Huntress stands out for transparency. We don’t keep our intelligence behind closed doors – we share it with the community through blogs, webinars, and open communication. That openness strengthens everyone’s defences.

Huntress (Megan Kearney): Exactly. We focus on small and mid-sized businesses – the ones most often targeted but rarely talked about. Protecting them strengthens the entire supply chain and economy.

We also share education and best practices to empower the wider community. And while good technology is easy to find these days, good people behind that technology are not. At Huntress, we have both.

Better-IT (Michael McHugo): From an MSP’s perspective, Huntress has been an exceptional partner. Our technicians trust their alerts completely – they’re fast, reliable, and actionable. Their people are as dependable as their product, and that’s rare.

Finally, what excites you most about the future of security, and where do you see Huntress contributing?

Huntress (Ben Folland): I’m fascinated by where AI is heading. At first, I was sceptical, but we’re now seeing cybercriminals use AI to write phishing emails or even generate malware. It’s becoming a cat-and-mouse game where both attackers and defenders use AI – and that’s going to shape the next decade of cybersecurity.

Huntress (Megan Kearney): For me, it’s about combining automation with human expertise. Automation can handle the repetitive noise, freeing analysts to focus on complex, high-value threat hunting.

Huntress is helping smaller organisations access enterprise-grade protection without enterprise-level costs. We’re bridging the talent gap for MSPs and staying attacker-focused rather than compliance-focused. 2026 looks like a strong year – for Huntress and for cybersecurity as a whole.

About Huntress and Better-IT
Huntress provides world-class managed detection and response solutions trusted by thousands of MSPs and IT teams.
Better-IT partners with Huntress to deliver Better Secure – a comprehensive cybersecurity package that combines EDR, ITDR, and proactive threat monitoring to protect UK businesses from modern threats.