cybercrime threat hunter

Cybercrime – A New Role for the Threat Hunter

Next Story

Large-Scale Telco Cloud Deployments Heading for Critical Mass by 2020

The prevalence of cybercrime and the constant threat of intrusion into company networks has created a new role in many large enterprises – that of the threat hunter.

Threat hunting is becoming an integral part of defensive activities in larger enterprises or those that have been heavily targeted in the past, according to a new SANS Survey. But these  findings also show that threat hunting is still an immature practice, relying mostly on human intuition to conduct searches.

SANS defines threat hunting as a focused and iterative approach to search out, identify and understand adversaries that have entered the defender’s networks. Hunting needs to be proactive to be effective, however 43% of respondents say their hunts are triggered by an event or perhaps by a hunch, and 5% of respondents could not define exactly what triggers their hunts. The remainder are either monitoring continuously, which is what is recommended, or on a regular schedule, such as once a week.

“Threat Hunting is new to most organizations and demonstrates that it has had a positive effect on reducing attacker dwell time for those organizations that conduct hunts regularly,” says the survey’s author, Rob Lee, SANS fellow and curriculum lead author for the SANS Incident Response and Forensics training courses.

In the survey, 60% of those who hunt for threats reported measurable improvements in their InfoSec programs based on their hunting efforts, and 91% report improvements in speed and accuracy of response.

The staffing and skills that are required for this task remain problematic for organizations trying to fill threat hunting positions, with only 31% of organizations designating a program for threat hunting with assigned staff. Log analysis, knowledge of the network, threat analysis, incident response and forensics are all sought-after skills for developing threat hunting programs.

Skills—and tools—also need to mature to improve data searching, connect the dots between information sources, investigate and conduct the searches, according to respondants.

“The survey benefits our industry by showing that most organizations are new to hunting efforts,” Lee concludes. “It is also a gut check for those organizations not yet starting to incorporate hunting into their security operations.”

Results will be discussed at the SANS Threat Hunting and Incident Response Summit, April 18-19 in New Orleans.

Following the summit, the full results of the survey will be shared during a two-part webcast aired live Wednesday, April 26 and Thursday, April 27 at 1 PM EDT. The webcasts, hosted by SANS, are sponsored by AnomaliDomainToolsMalwarebytesRapid7Sqrrl and ThreatConnect. Register to attend the webcasts at and

Anyone attending the webcasts receive early access to the associated whitepaper, which will be posted and available at after the live webcasts.

The following two tabs change content below.
Carlos Casanova is an internationally known speaker, IT architect, leadership advisor and the co-author of “The CMDB Imperative”. He has over two decades of hands on experience guiding CIOs and Sr. Leadership to achieve effective IT operations and improve ROI from infrastructure investments. His expansive experience enables him to quickly assess their true needs and achieve better business outcomes. He takes the complexity out of today's cluttered IT and business environments to simplify their goals in order to accelerate achievement and success.