Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Companies Use Cyber Threat Hunting Teams
Transcript
- Lucas: So here's a scenario that keeps CISOs up at night. Your EDR alerts are green. Your SIEM isn't screaming. But something feels off — maybe an anomalous DNS lookup, or a service account that logged in from an unusual geography. You don't have a confirmed incident, but you don't have peace of mind either. Luna: Right, that gray zone where you're not sure if you're being paranoid or if you're missing something. Lucas: Exactly. And that gray zone is the whole reason cyber threat hunting exists as a discipline. Instead of waiting for an alert to trigger a response, threat hunting is proactively searching networks, endpoints, and logs for signs of compromise that automated tools might miss. It's a shift from reactive to proactive defense. Luna: And it's been growing fast. I remember when it was something only big banks and intelligence agencies did. Now it's becoming a standard practice across industries. Lucas: Yeah, the numbers back that up. A 2025 SANS survey found that 42 percent of organizations now have a formal threat hunting program. That's up from about 30 percent just three years earlier. And among large enterprises with over ten thousand employees, it's over 60 percent. Luna: So what does a typical hunt actually look like? I think a lot of listeners hear 'threat hunting' and imagine something almost cinematic. Lucas: It's less cinematic and more systematic. Most hunters start with a hypothesis — something like 'an attacker might be using PowerShell to move laterally' or 'we suspect someone exfiltrated data via DNS tunneling.' Then they pull relevant data sources — endpoint logs, network flows, authentication events — and look for patterns that confirm or refute that hypothesis. Luna: And the MITRE ATT&CK framework has become the playbook for that, right? It maps out the tactics and techniques adversaries use. Lucas: Absolutely. MITRE ATT&CK is basically the hunting roadmap. Hunters use it to decide which techniques to look for and what data sources can detect them. For example, if you're hunting for credential dumping, ATT&CK tells you to check security event logs and process creation events. It standardises the whole approach. Luna: Who actually does the hunting? Is it a dedicated role or something analysts do between incidents? Lucas: It varies. In larger shops, you'll see dedicated hunting teams — sometimes called a 'hunt cell' within the SOC. In smaller organizations, it's often senior analysts who carve out time for it, but they're frequently pulled back into incident response. That's a real tension. Luna: And that's where managed hunting services come in. Companies like CrowdStrike and SentinelOne offer hunting as part of their managed detection and response offerings. Lucas: Right. CrowdStrike's Falcon OverWatch is probably the best-known example. They have human analysts who proactively hunt across their entire customer base, using the telemetry collected by the Falcon agent. SentinelOne's Vigilance Respond does something similar. It gives mid-market companies access to hunting expertise they couldn't afford in-house. Luna: Is it as effective as having your own team? I've heard arguments that internal hunters know the environment better. Lucas: There's definitely a trade-off. Internal hunters know the baseline — what normal looks like in your specific environment. But external services see patterns across hundreds or thousands of customers. They might spot a technique that's novel to you but familiar to them from another breach. A lot of organizations use both: an internal team for deep dives and a managed service for broad coverage. Luna: What about the skills piece? I hear from security leaders that good hunters are incredibly hard to hire. Lucas: One of the hardest roles to fill in security. A good hunter needs deep knowledge of operating systems, networking, common attack tools, and data analysis. They also need creativity — the ability to think like an adversary. The SANS survey found that 68 percent of organizations cite lack of skilled staff as a major barrier to starting or expanding a hunting program. Luna: So if you're a listener thinking about standing up a hunting capability, where do you even start? Lucas: I'd say start small. Pick one technique from MITRE ATT&CK that's relevant to your industry — maybe credential access if you're in finance, or initial access via phishing if you're in healthcare. Write a simple hypothesis, collect the data you already have, and see what you find. Even a one-hour hunt per week builds muscle. Luna: And don't forget to document what you learn, even if you find nothing. 'Nothing found' is still valuable — it tells you that technique probably isn't being used against you right now. Lucas: Exactly. And over time, those negative findings build a baseline of confidence. You start to know which techniques are actually risky in your environment versus which are theoretical. Luna: It reminds me of something a CISO once told me: 'Threat hunting is the security equivalent of preventive medicine. It's harder to measure than emergency surgery, but it keeps you out of the ICU.' Lucas: That's a great framing. And like preventive medicine, it's about consistency. A hunt a week, a hypothesis a month, gradually you build a picture of your environment that no alert-driven tool can give you. Luna: I want to come back to something you said earlier — about hunting being a way to validate that your detection tools are actually working. Can you unpack that? Lucas: Sure. One of the underappreciated benefits of hunting is that it tests your detection stack. If you hunt for a technique that your EDR should have caught, and you find evidence of it in the logs, that tells you your tool missed it. That's incredibly useful feedback for tuning rules and improving coverage. Luna: So it's not just finding bad guys. It's also finding gaps in your own defenses. Lucas: Exactly. And that's why hunting programs often report two metrics: 'threats found' and 'detection gaps identified.' Both are valuable outputs. Luna: I've also seen hunting used in a more adversarial way — like red-team style simulations. Is that the same thing? Lucas: Related, but not the same. Adversary emulation is typically a structured test — you know it's coming, you have a specific scenario. Hunting is more open-ended. You might emulate an adversary technique as part of a hunt, but the goal isn't to test a particular control. It's to find real unknown threats. Luna: Got it. So hunting is about the unknown unknowns, while emulation is about known unknowns. Lucas: That's a perfect way to put it. And as the threat landscape gets more complex — ransomware groups using commodity tools, nation-state actors blending in with normal admin activity — the unknown unknowns are exactly what you need to worry about. Luna: If today's conversation was useful for how you think about your own security operations — or if you're building a product in this space — these episodes stay ad-free thanks to listener support. You can find us at buy me a coffee dot com slash fexingo. It's a small way to keep the conversations going. Lucas: Yeah, and we really appreciate that. It's what lets us drill into topics like this without any sponsors or ads. So thank you if you've ever chipped in. Luna: Alright, back to the hunt. One thing I'm curious about — are there any common mistakes you see when teams start hunting for the first time? Lucas: The biggest one is trying to hunt everything at once. Teams get the MITRE matrix and think they need to cover all techniques. That's not sustainable. Start with three techniques that map to your biggest risks. Master those. Then expand. Luna: And the second mistake? Lucas: Not having a clear way to document and escalate findings. If a hunter finds something suspicious, there needs to be a clear path to turning that into an incident ticket. Otherwise, the hunt becomes an academic exercise. The best hunting programs have a tight feedback loop with the incident response team. Luna: That makes sense. What tools do hunters typically use? Is there a standard hunting toolkit? Lucas: There's no single toolkit, but some common ones. Splunk and Elastic are popular for log analysis. Many hunters use Python or PowerShell to automate data collection. And there are purpose-built hunting platforms like Sqrrl — which was acquired by AWS — and Devo. But honestly, a lot of hunting starts with a terminal and grep. Luna: Low tech, high skill. I like that. Lucas: Exactly. The tool matters less than the methodology. A hunter with grep and a solid hypothesis can find things that an ai driven tool with no context will miss. Luna: One last question — do you see threat hunting becoming fully automated at some point? Will we still need human hunters in five years? Lucas: I think automation will handle the first pass — the low-hanging fruit, the known patterns. But the creative, hypothesis-driven part? That's human. Adversaries adapt their techniques constantly. A good hunter is always thinking about what the adversary might do next, not just what they've done before. I don't see that being automated anytime soon. Luna: So hunting is here to stay. It might look different — more data, more automation assisting — but the core human element remains. Lucas: Absolutely. And as more organizations realize they can't just set and forget their security tools, hunting will only become more central. It's not a niche practice anymore. It's becoming table stakes for mature security programs. Luna: That's a good place to leave it. Thanks, Lucas. Lucas: Thanks, Luna. And thanks to everyone listening. Next time we'll look at how security teams are using generative AI for threat detection — the promises and the pitfalls.