Survey Finds Threat Hunting Teams Prioritize Proactive Reconnaissance

Summary

Team Cymru’s 2024 survey of 293 security practitioners found that 49% reported a major breach in the prior year, while respondents cited funding, historical data and staffing as threat-hunting challenges and prioritized third-party monitoring.

Key points

• In the survey, 49% of practitioners said their organization experienced a major security breach in the previous 12 months; 72% of those respondents said threat hunting helped mitigate it.
• 53% of respondents considered their current threat-hunting program very effective, citing tools such as EDR and SIEM, experienced analysts, and baseline data.
• Respondents identified insufficient funding and historical data as leading obstacles, along with shortages of trained threat hunters.
• The top priority for the coming year was expanding third-party monitoring for signs of compromise, amid concerns about third-party and supply-chain compromises.
• Respondents also prioritized greater host and network visibility, additional threat-hunting staff, and increased log storage and retention.
• Actionable threat intelligence was the most requested program enhancement; respondents also sought network-forensic detection, NetFlow telemetry, and full packet capture capabilities.