It is also a signal against which threat detection works. The best cases for threat hunting are those in which a specific signal from the SSO state is present, but when hunting, we look for evidence that something like it should have been ingested into the data life cycle. The difference may sound subtle; however, it reflects fundamentally different assumptions about the adversary. Detection assumes that the attacker has made a mistake that can be detected. Hunting assumes that the attacker already exists and has sufficient skills to avoid triggering the usual detection logic and proceeds to find them despite those protections.
This framing provides a rationale for why threat hunting can deliver value that detection automation alone cannot, and, in turn, why AI is required to make hunting sustainable at the scale and frequency needed to genuinely impact security posture.
What Threat Hunting Actually Is
Threat Hunting: often referred to as the proactive, analyst-driven search through enterprise telemetry (both network & endpoint) for signs-of adversary activity that there has been no success in automated detection Why this is effective: It makes the assumption that some attacks will bypass signatures, rules, and behavioral baselines, and being methodical in searching for those attacks based on an understanding of how real adversaries work is better than waiting to detect them.
An extensive guide to artificial intelligence in cybersecurity describes how AI transforms the speed, magnitude and caliber of hypotheses that these hunt programs run through and how it democratizes proactive searching channels across more surface areas for security teams.
CISA has its own threat-hunting mission: to proactively search networks, endpoints, and datasets for malicious, suspicious, or risky activities that have bypassed existing detection tools. CISA threat hunting program conducted this work across federal and critical infrastructure environments, leveraging misuse telemetry and threat intelligence not replicable by any individual organization, but the same investigative logic applies to enterprise hunting programs operating within an organization.
The Constraint That AI Removes
When it was all human-based work, the biggest limitation to threat hunting was the bottleneck in time and expertise. As an example, a good threat hunter might take days just combing through telemetry for signs of a specific technique used by a particular type of attacker, hitting many data sources (and likely correlating results across them), and testing and discarding hypotheses piece by piece. The predictable result of this time cost was that it kept hunting far apart, leaving long stretches of time during which an adversary could operate under the radar.
The SANS 2024 Threat Hunting Survey tracked the shift toward formalization, finding that organizations establishing formal hunting methodologies rose from 35 percent of respondents in 2023 to 51 percent in 2024. The same research identified the shortage of skilled hunters and data quality challenges as the primary barriers preventing more frequent hunting.
AI addresses both constraints directly. That encodes analytical patterns (that previously resided only in the heads of experienced hunters) into representations that allow centralized parts of our federated system to operate on data volumes that are harder and harder for human beings to wrangle with – so making hunter-based hypothesis-generation simpler, and therefore lowering the entry criteria for effective hunters.
How AI Generates Hunting Hypotheses
Hypotheses are statements that can be tested regarding the expected adversary behavior in circumstances where it is present. A hunter may hypothesize that an attacker who has achieved an initial foothold on a network will likely use certain credential-access techniques before moving laterally and design queries to search for detections of those techniques in authentication logs and process data.
How is data generated in AI for hunting hypotheses?
- Historical Threat Intel: Models trained on historical threat intel and incident data will let you know which techniques are fairly likely to appear together in an attack chain based on how often they co-occur historically, giving rise to the hypothesis about what other techniques could also be present should an indicator be detected.
- Structured hypothesis extraction: Natural language processing models can extract structured hypotheses from threat intelligence reports, capturing written descriptions of attacker behavior as a testable query against internal telemetry.
- Statistical anomaly detection: Works by flagging deviations under what would trigger automated alert escalation and working downwards based on querying the learned baselines against moved values that consumers need manual investigations into.
These hypothetical sources do not replace a hunter’s judgment about which leads to chase. This time, they increase both the number of hypotheses you can begin with and the quality of those hypotheses.
TTP Feature Extraction and AI in Telemetry Search
Establishing a hypothesis, however, is just the beginning of investigative work and digging through massive amounts of data to test it. For instance, an analyst seeking to find possible credential dumping in a large enterprise environment may need to explore months of endpoint process logs and correlate process creation events with patterns for file access and sequences of authentication events.
AI tools speed up this search in two interrelated directions. They first allow hunters to ask questions in natural language or high-level behavior without enforcing low-level query syntax on every data source. If a hunter wants to describe the behavior they want to hunt, we take that description and use AI to convert it into queries that are codified across different data sources. Next, AI correlation engines aggregate telemetry to merge similar events, so a hunter is looking at evidence in sets rather than one event at a time.
In particular, AI systems trained on the MITRE ATT&CK framework can detect sequences of process behavior, network activity and authentication (among other entities) that create a correlation to known behaviors by adversaries laid out in MITRE documentation, even when those events are separated from each other across multiple datasets and separated by time. An AI-assisted TTP detection hunter can now easily test a hypothesis against a specific attacker technique and be presented with candidate evidence clusters that have been pre-correlated, rather than needing to build the correlation from scratch from raw logs.
Making Hunting a Continuous Capability
AI brings a huge operational change to threat hunting by focusing on continuous instead of episodic detection and response. Because human analyst hours limit both hypothesis generation and telemetry search, hunting cannot be done simply ad hoc but instead needs to be scheduled and rationed. Hunting can be done non-stop across different hypotheses in parallel when AI does the data processing legwork and populates the analytic starting points.
This bedevils deterrence, as continuous hunting meaningfully shifts the communication of threat. Instead of being safe for weeks in between scheduled hunt cycles, an attacker now operates with someone or something always watching. Dwell time is the amount of time that an adversary has prior to detection, and as with any Sensor-detectable technique-based mechanism, techniques reliant on extended dwell time are structurally less effective when the amount of dwell time before detection decreases.
This is where judgment of what hypotheses AI generates are worth chasing, contextual understanding to interpret ambiguous evidence, and adversary knowledge to identify new types of techniques that models haven’t yet learned to flag plays a role. AI shifts the nature of allocation of where hunters spend their time, not if for what they are trained in.
Frequently Asked Questions
How often should an organization be doing threat hunts?
Organizations with mature programs aided by AI-enabled tooling should focus instead on continuous or near-continuous hunting across a rotating set of hypotheses, rather than periodic, scheduled hunts. More mature programs often begin their first monthly hunts by covering their highest-risk systems and increasing cadence as capabilities develop.
Does this mean analysts do not require significant technical skills to hunt with AI’s help?
While the use of AI assistance in executing queries and correlating telemetry lowers the bar for expertise, it does not eliminate the need for analytical judgment on your part. Hunters still need to understand adversary TTPs, how to sift through evidence and determine if an AI-produced result is a real lead or noise.
Where does one start to develop an AI-assisted threat hunting capability?
The majority of programs start hypothesis-driven hunts based on the current threat intelligence feed most relevant to their industry, and then leverage AI to automate telemetry search and correlation. If you can take a small number of high-quality hypotheses and build an investigative discipline around them, it is much more valuable than trying to automate hypothesis generation across as wide of a net as possible right out of the gate.