My team is worried that investing in AI-driven detection means we won't need threat hunters anymore. I personally think AI just gives us better visibility, but I am struggling to convince them. How are other teams balancing automation with the human element of threat hunting?
Manual threat hunting remains necessary because human analysis is required to identify sophisticated attacks and living-off-the-land techniques that automated systems often misclassify as benign activity.
2 answers
Back in 2019, I watched a team outsource their detection to an ML-based vendor, thinking the product would handle everything. They stopped their manual deep dives, only for us to walk right through their perimeter during a red team exercise using living-off-the-land techniques that their automated tools classified as benign management traffic.
The reality is that AI handles the known-unknowns quite well, but it falls apart when an attacker acts like a legitimate user. Relying solely on automation is a gamble that eventually loses because software lacks the capacity to question the context of a legitimate process performing a malicious action.
Manual threat hunting is not dead, but its function is shifting from tactical log review to complex, hypothesis-driven exploration. While AI excels at noise reduction and identifying known patterns at scale, human intuition remains the only reliable mechanism for uncovering sophisticated, non-malware based incursions that bypass automated thresholds.
I completely agree with you, Victoria Dunn. It is a bit nerve-wracking to rely on human intuition, but I am trying to learn how to better document my manual process for those complex threats.
Victoria Dunn, your point about hypothesis-driven exploration is vital. I am currently mapping out the specific steps for my team to ensure we don't overlook these sophisticated, non-malware incursions in our logs.
Thank you for the perspective, Victoria Dunn. I have been worried about my team relying too heavily on automation, so this reminder about the necessity of human intuition provides some much-needed clarity for us.