Describe the threat hunting maturity model. Where do most organizations fall on this spectrum, and what capabilities are needed to progress from one level to the next?

Question

Accepted Answer

The threat hunting maturity model, originally proposed by David Bianco, provides a framework for assessing and advancing an organization's hunting capabilities across five levels, from purely reactive to fully proactive.

Level 0, Initial, describes organizations that rely entirely on automated alerting. There is no hunting activity at all. The SOC operates in a purely reactive mode, investigating only the alerts that their SIEM and security tools generate. Many organizations start here, and the detection capability is limited to what the vendors' default rules can identify.

Level 1, Minimal, represents organizations that incorporate threat intelligence indicators into their monitoring. Analysts search for specific indicators of compromise from intelligence feeds, conducting IOC sweeps against logs and endpoints. While this is a step above pure reactive monitoring, it is still primarily indicator-driven rather than behavior-driven, and the searches depend on someone else having already identified the threat.

Level 2, Procedural, is where structured hunting begins. Organizations at this level follow documented hunting procedures and playbooks created by others. Analysts execute predefined hunts based on known attack patterns, MITRE ATT&CK techniques, and published hunting playbooks. The hunts are repeatable and documented, but they do not yet involve original hypothesis creation or custom analysis techniques.

Level 3, Innovative, marks the transition to truly proactive hunting. Analysts at this level create their own hypotheses based on their understanding of the environment, current threat landscape, and identified detection gaps. They develop custom hunting queries, build novel analytics, and use data science techniques to identify anomalies. This is where hunting starts producing significant value in the form of previously unknown threats being discovered and new detections being created.

Level 4, Leading, represents the pinnacle of hunting maturity. Organizations at this level automate successful hunting techniques, turning repeatable hunts into continuous detections. They develop custom tools and analytics platforms tailored to their environment. Hunting activities are tightly integrated with red team exercises and adversary simulation, creating a continuous validation cycle. The hunting program systematically measures and improves detection coverage against the ATT&CK framework.

Most organizations fall between Level 1 and Level 2. They have SIEM tools in place and conduct basic IOC searches, but they lack the structured hunting processes and skilled personnel needed for true proactive hunting.

To progress from Level 1 to Level 2, organizations need documented hunting playbooks, standardized workflows, and training for analysts on executing structured hunts. The transition from Level 2 to Level 3 requires investing in analyst development, particularly building skills in data analysis, statistical anomaly detection, and deep understanding of adversary behavior. It also requires leadership support in the form of dedicated hunting time rather than expecting analysts to hunt only when the alert queue is empty.

The progression from Level 3 to Level 4 demands engineering capabilities to automate hunting findings, integration with red team and adversary simulation programs, custom tooling development, and metrics-driven program management. This level typically requires dedicated hunting personnel rather than analysts splitting time between reactive monitoring and proactive hunting.