Cyber Threat Hunting

We are in the age of sophisticated cyber threats, threats that can get past traditional security response models and can persist for weeks or months before being discovered. This is where a mature program focused on threat hunting, and threat modeling can make a material difference in an organization’s detection and response posture. Traditional security response models are designed to discover and react to a majority of today’s cyber threats, but it’s the unknown and residual risk that needs appropriate treatment. The average industry metrics around time to detect these advanced threats vary from 9-10 months. For a threat actor, that is ample time to cause significant damage to an organization’s sensitive data and IT systems and worsen its reputation.

Some prerequisites for achieving an effective threat-hunting program are an enterprise security team or managed service focused on security operations, access to a security information and event management (SIEM) platform, and mature endpoint detection and response tools. With these prerequisites in place, Calvetti Ferguson can complement your security posture by developing a threat-hunting program that institutes the methodologies for security professionals to identify and address these threats.

There are several principles involved in threat hunting: looking for anomalous or suspicious activity, understanding the techniques leveraged by advanced attackers, maturing existing controls to block threats, developing advanced containment and response playbooks, and lastly enriching existing data using Indicators of Compromise (IoC) from intelligence feeds.

Our experts at Calvetti Ferguson have decades of experience developing and maturing threat-hunting capabilities and executing threat hunting within various industries and organizations. Whether you need us to help develop your own capabilities or would like us to augment your existing program by providing threat hunting as a service, count on Calvetti Ferguson to help with this critical next step in maturing your security program.