Survey Finds Threat Hunting Programs Improving, but Funding and Data Remain Challenges
Summary
A survey of 293 security practitioners found that 53% considered their threat hunting programs very effective in 2024, up from 41% in 2023. Respondents highlighted proactive detection, third-party monitoring, actionable intelligence, funding and data gaps, and staffing.
Key points
- In the survey, 53% said their threat hunting program was very effective in 2024, up from 41% in 2023.
- Respondents cited EDR and SIEM tools, experienced analysts, and baseline data as contributors to effectiveness.
- The leading objectives were detecting previously unknown threats, monitoring third parties for compromise or risk, and reducing the attack surface.
- Lack of funding and historical data tied as the biggest challenges; respondents also cited a shortage of trained hunters.
- Actionable threat intelligence ranked as the most desired program enhancement, rising from seventh place in 2023.
- 44% expected their threat hunting budget to increase over the next year, compared with 38% the prior year.
- Top priorities included expanding third-party monitoring and host/network visibility, adding threat hunters, and retaining logs for hunting.
Article Details
- Publisher
- Team Cymru
- Report Period
- 2024, with comparisons to 2023
- Scope
- Survey findings on security practitioners’ threat hunting programs, objectives, challenges, budgets, priorities, and concerns.
- Sample Size
- 293 security practitioners
- Key Statistics
- 53% of respondents considered their threat hunting program very effective in 2024, up from 41% in 2023.
- 44% expected their threat hunting budget to increase over the next year, compared with 38% in 2023.
- Recommendations
- Use actionable threat intelligence to help identify relevant threats and mitigate threat hunting challenges.
- Add staff with threat hunting experience and support training for threat hunters.
- Consider network forensic detection, netflow telemetry, or full packet captures to provide threat hunters with useful information.
- Expand third-party monitoring and increase host and network visibility.
- Increase storage and retain logs for threat hunters.