Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Cyber Threat Hunting Maturity Model
Transcript
- Lucas: So, I was reading through a CISO survey from early this year, and one stat jumped out: about seventy percent of enterprise security teams say they do threat hunting, but when you dig into what they actually mean, most of them are just running automated queries on a schedule. Luna: Right, that's not really hunting. That's more like automated detection with a fancy label. Lucas: Exactly. And that's where the Threat Hunting Maturity Model comes in — it gives teams a way to honestly assess where they are. It was originally developed by a company called Sqrrl, which was acquired by AWS back in 2018. The model has five levels, from zero to four. Luna: I've seen references to it, but I don't think many teams actually use it. Why do you think that is? Lucas: Partly because it forces a kind of self-awareness that can be uncomfortable. Level zero is 'initial' — basically, you don't hunt at all. You rely entirely on automated alerts from your SIEM or EDR. Level one is 'minimal' — you do some hunting, but it's ad hoc, driven by individual analysts' curiosity, and there's no repeatable process. Lucas: Most enterprise teams I talk to are somewhere between level zero and level one. They have the tools, but they haven't institutionalized the practice. Luna: So what does level two look like? That's where it gets interesting, right? Lucas: Level two is 'procedural' — you have documented hunting procedures, you follow a formal process, and you're generating hypotheses based on threat intelligence. You're not just reacting to alerts; you're proactively looking for signs of compromise that your automated tools might miss. Luna: And level three? Lucas: Level three is 'innovative' — at that point, your hunters are creating new data sources, building custom analytics, and automating parts of the hunt. They're not just following playbooks; they're writing new ones. Level four is 'leading' — the hunt is largely automated, with the machine handling the bulk of the hypothesis generation and testing, and humans focusing on the most complex edge cases. Luna: That sounds aspirational. Does any organization actually reach level four? Lucas: Very few. I know of maybe a handful of large tech companies and some government agencies that claim to be at level four. But most mature enterprises are aiming for level three. I want to talk about a specific example — a Fortune 500 financial services firm that I had a chance to study. Luna: Oh, this is the one that reduced mean dwell time by sixty percent? I've heard whispers about that case. Lucas: That's the one. They started at level one — they had a couple of sharp analysts who did great work, but it was all tribal knowledge. If those analysts left, the capability walked out the door. Their mean dwell time — the time between initial compromise and detection — was around one hundred and fifty days, which is actually below the industry average of about two hundred days, but still way too high. Lucas: They committed to an eighteen-month program to reach level three. They hired a dedicated threat hunting lead, invested in a data lake to store telemetry for longer periods, and built out a formal hypothesis library based on the MITRE ATT&CK framework. Luna: I love that they used ATT&CK as the backbone. It gives you a common language. Lucas: Exactly. And they also started conducting regular 'hunt weekends' where the entire SOC would focus on a specific technique, like credential dumping or lateral movement. After eighteen months, they were operating at solid level three. Their mean dwell time dropped to sixty days — a sixty percent reduction. They went from reactive to proactive. Luna: Sixty days is still a long time. But compared to one hundred and fifty, it's a huge improvement. Lucas: And the cost savings were significant. Each incident that they caught earlier saved them an estimated five hundred thousand dollars in remediation and legal fees. The program basically paid for itself in the first year. Luna: That's a compelling ROI story. But I imagine most teams don't have that kind of budget or executive buy-in. What advice would you give to a team that's stuck at level zero or one? Lucas: Start small. You don't need a dedicated team right away. Pick one technique that's relevant to your industry — for a bank, maybe credential access or privilege escalation. Write a simple hypothesis, like 'I think attackers are using PowerShell to stage credentials.' Then run a targeted search across your endpoint logs for the next two weeks. Document what you find. That's level one. Luna: And that documentation becomes the seed for level two. Lucas: Right. Once you have one or two documented hunts, you can formalize them into a playbook. Then you repeat with a new hypothesis. The key is to build a feedback loop — each hunt should inform your detection rules, your threat intelligence priorities, and your next hunt. Luna: You know, this conversation is exactly why we do this show — because these practical frameworks can actually change how teams operate. Lucas: And that's why we keep it ad-free. No sponsors, no interruptions. We want these episodes to be useful for people who are building and running security programs, not a commercial break. Luna: If you find value in that approach, and you want to support it, there's a simple way. You can buy us a coffee — literally, at buy me a coffee dot com slash fexingo. That helps cover hosting and keeps the show independent. Lucas: No pressure, no perks, just the satisfaction of knowing you're helping keep this resource free and ad-free. And now back to the model. Lucas: One thing I didn't mention: the HMM also has a dimension for data sources. A team can't reach level three unless they have broad, long-term telemetry. That means network logs, endpoint logs, cloud logs, and ideally some form of DNS or proxy data. Luna: So data exhaust is a prerequisite for maturity. That's a big barrier for smaller organizations. Lucas: It is. But even with limited data, you can still improve. For example, if all you have is endpoint telemetry, you can still hunt for fileless malware using memory scanning or for persistence mechanisms using registry audits. It's not ideal, but it's better than nothing. Luna: And the model itself is flexible. It doesn't prescribe specific tools, just capabilities. Lucas: Exactly. That's why it's become a standard reference in the industry. The SANS Institute has even incorporated it into their training courses. If you're a CISO looking to benchmark your program, it's one of the most practical frameworks out there. Luna: I want to go back to the role of AI in all this. You mentioned that level four relies on automation. How are teams using AI to accelerate maturity? Lucas: The most common application is in hypothesis generation. Instead of an analyst spending hours reading threat intel reports to come up with a hunt idea, some teams are using large language models to scan recent intel and suggest hypotheses in minutes. It's not perfect, but it's a force multiplier. Lucas: Another use case is in automating the hunt itself. For example, if you have a hypothesis like 'attackers are using scheduled tasks for persistence,' an AI agent can craft and execute the query across your environment, then summarize the results for human review. Luna: That sounds like it could move a team from level two to level three faster. Lucas: It can, but there's a risk. If you automate too early, you might miss the nuance that a human hunter would catch. The model actually warns against skipping levels. You need the procedural foundation before you can innovate effectively. Luna: So the framework is as much about organizational maturity as technical capability. Lucas: Exactly. It's a people, process, and technology model. Most teams focus on the technology and ignore the process and people aspects. That's why they plateau at level one. Luna: One last question: where do you see the model evolving? Are there talks of a level five? Lucas: I've seen some informal discussions about adding a level five for 'autonomous hunting' where the machine handles the entire cycle without human intervention. But I think that's a long way off. For now, level four is ambitious enough for most organizations. Luna: It's a good reminder that even in a field as fast-moving as cybersecurity, some things take time to build. Lucas: And the HMM gives you a roadmap. If you're a security leader, I'd encourage you to honestly assess where you are today and pick one concrete step toward the next level. Maybe it's documenting one hunt. Maybe it's expanding your data retention. That one step compounds over time. Luna: Great advice. And a solid framework to take back to your team. Lucas: That's all for today. We'll be back next week with another deep dive into how security teams are actually getting things done.