SANS Cyber Threat Hunting Survey 2024

Keypoints

• Annual cybersecurity reports from major vendors typically include sections such as executive summaries, methodology overviews, attacker TTPs, threat landscape analysis, and vendor-specific insights, offering a comprehensive view of current threats and defense strategies.
• Key statistics highlight that over 51% of organizations now have defined threat hunting methodologies—up from 35%—and 64% measure their threat hunting effectiveness, signifying increased maturity and strategic focus in threat detection efforts.
• Trend data shows a rise in threat hunting outsourcing to 37%, alongside challenges like data quality issues and staffing shortages, emphasizing a shift toward external expertise and resource management.
• Analyzing attack techniques reveals that ransomware groups frequently deploy custom malware and exfiltrate targeted data, while nation-state actors heavily use living-off-the-land methods and custom malware, indicating sophisticated and diverse threat actor behaviors.
• Major threats identified include business email compromise (BEC), which now surpasses ransomware in detection frequency, reflecting the evolution of attacker tactics toward social engineering and credential theft.
• Recent reports emphasize the importance of multi-source intelligence gathering—vendor blogs, independent research, government alerts, and internal research—to stay updated with emerging attacker techniques and adapt defenses accordingly.
• Most organizations (70%) formally track shifts in the threat landscape using open-source tools, with many supplementing this data via commercial solutions, demonstrating a proactive and layered threat intelligence approach.
• Structured review and updates to threat hunting methodologies have increased, with nearly 26% conducting monthly reviews, signifying organizations’ adaptation to rapid threat evolution through regular process refinement.
• Contribution to threat hunting methodologies now heavily involves CISOs (40%) and incident response teams (33%), indicating strategic integration of threat hunting into overall cybersecurity governance and operations.
• Despite progress, challenges such as data management, skills gaps, and effective measurement remain, emphasizing ongoing efforts needed for mature threat hunting practices and continuous improvement.