Survey: Effective Threat Hunting Depends on Tools, Training and Baseline Data
Summary
A survey of 293 security practitioners found that respondents credit threat-hunting tools, trained analysts and baseline data with improving programs. The article also recommends better visibility, automation, asset inventories and log retention.
Key points
- In the survey, 49% of respondents said they had experienced a major breach in the prior 12 months; among them, 72% said threat hunting helped prevent or mitigate it.
- 53% described their threat-hunting program as very effective, up from 41% the previous year.
- Respondents identified suitable tools, experienced analysts and baseline host and network data as key contributors to program effectiveness.
- The leading challenges were insufficient historical data, inadequate funding and a shortage of trained threat hunters.
- Recommended steps include improving network visibility, automating repetitive work, inventorying assets, mapping the attack surface and retaining logs for future hunts.
Article Details
- Publisher
- Team Cymru
- Report Period
- 2024 survey
- Scope
- Security practitioners' views on threat hunting programs
- Sample Size
- 293 security practitioners
- Key Statistics
- 49% of respondents experienced a major security breach in the past 12 months.
- Of respondents who experienced a breach, 72% said their threat hunting program played a key role in preventing or mitigating it.
- 53% rated their threat hunting program very effective, compared with 41% the previous year.
- 25% rated their program somewhat effective, and 23% said it was not very effective.
- Recommendations
- Use tools that improve visibility, such as EDR and SIEM, and provide relevant threat intelligence.
- Train security team members in threat hunting and automate repetitive tasks to free time for higher-impact work.
- Inventory assets and systems, map the attack surface, and establish baseline data for normal host and network activity.
- Create a log-retention strategy and document past processes and procedures for future threat hunting.