According to Nearly 300 Security Practitioners
One of the best ways to proactively protect your organization is through threat hunting. Then, with the right tools, training, and intelligence, security practitioners can take their threat hunting program one step further to conduct threat reconnaissance, where they track relevant threats to their organization and take action before a breach or attack can happen.
But are security teams today equipped with the right tools, people, and processes to make their threat hunting program effective? To learn more, we surveyed 293 security practitioners for this year's “Voice of a Threat Hunter 2024.” They shared about the current state of their threat hunting program and what they need to make it more proactive and effective.
Here’s how this year’s responses show changes, improvements, and setbacks from last year’s responses.
Threat Hunting Program Effectiveness
In 2024, 53% believe their current threat hunting program is very effective — an increase from 41% in 2023. They're putting in place tools, people, and processes that are increasing their effectiveness and increasing their confidence as well.
What made their threat hunting so effective in 2024 was having the right tools in place such as endpoint detection and response (EDR) and security information and event management (SIEM), which ranked second in 2023. Another contributor is having trained and experienced threat hunting analysts, which ranked first in 2023. The third contributor to effectiveness is having baseline data available to threat hunters to identify what host and network “normal” looks like, which ranked sixth last year. What ranked third last year? Having formalized processes and procedures for conducting threat hunts.
Overall, threat hunting is made effective by having the right tools, people, processes, and data in place — a comprehensive approach to threat hunting.
Top Objectives
In 2024, proactive detection of previously unknown threats is the top objective for their threat hunting program. This was followed by monitoring third parties for indicators of compromise or risk — likely due to the significant increase in third-party breaches worldwide — and reducing the attack surface by discovering and removing weaknesses.
These objectives are more proactive and outward-facing than last year's more internal-focused objectives, which included creating detection rules based on threat hunt outputs, having the ability to identify threats before an attacker causes damage, and reducing attack surface by discovering and removing weaknesses.
Top Challenges
The biggest challenge slowing the success of a security team's threat hunting program in 2024 is tied for a lack of appropriate funding and a lack of historical data to threat hunt against (historical data being one of the ways a program can be effective). An additional challenge is a lack of trained threat hunters — trained hunters being another way a program can be effective.
However, these are entirely different challenges than reported in 2023. Last year, the top challenges were a lack of tools to perform threat hunting with, poorly understood and/or undocumented baseline activity, and no executive-level support of the threat hunt program.
Ultimately, challenges from last year and this year can be summed up as a lack of internal support, a lack of tools, a lack of trained hunters, and a lack of data — all things that, when working well, contribute to a program's effectiveness.
Top Program Enhancements
What enhancement do security practitioners want to add to improve their existing threat hunting program? At the top of the list is actionable threat intelligence, which can help them become more aware of the relevant threats to their organization, and help mitigate some of the challenges listed above. This enhancement rose from seventh place in 2023 to first this year.
They also wish for additional staff with specific threat hunting experience, something that contributes to effectiveness — which was in second in 2023. Third, they're looking for network forensic detection, netflow telemetry, and/or full packet captures to give them the information they need to protect their organization — which was in first in 2023.
Budgets
One of the biggest challenges listed above was a lack of appropriate funding for their threat hunting programs. In 2024, 44% expect their budget to increase over the next year. Last year, only 38% expected it to increase, which is likely why the top challenge this year is a lack of funding.
Top Priorities
The top priorities for next year continue building on the objectives for this year. For their threat hunting program, security teams want to continue to expand their third-party monitoring for signals of compromise, followed by increasing their host/network visibility. Tied for third are adding more threat hunters or contracts for external support, and increasing storage and retaining logs for use by threat hunters.
Last year's top priorities were to add more threat hunters or contract for external support, tied with increasing their host/network visibility. Ultimately, these priorities are ongoing.
Biggest Worries
As they prepare for the future, the biggest worry on the minds of security practitioners in 2024 is failing to retain qualified personnel — which rose from #7 in 2023, underscoring the importance of having the right members of the security team. They’re also worried about being unable to truly measure the success of the threat hunting program, which was the top worry last year. They also worry about failing to keep up with current trends and threat intelligence, which was the third biggest worry in 2023.
Conclusion
Making a threat hunting program effective relies on a number of contributing factors that include having the right tools, people, processes, and data in place. It’s certainly an ongoing process, but security teams can take steps in the right direction to move from reactive to proactive.
Read the “Voice of a Threat Hunter 2024” report today.