Threat Hunting in the Age of AI: What Still Needs You
Agentic threat hunting, step by step: what AI can automate, what belongs in a script, and what still comes down to the analyst.
Topic
When & Where
Details
Format:
Management lecture
Language:
English
Session description
Speaker: Jeroen Hoof
“Point an agent at the data lake and let it find evil” is the current pitch for AI-driven threat hunting. However, this does not always make sense.
This session takes hypothesis-led hunting apart step by step and assigns each step to the mechanism that actually fits it: a human, a deterministic script, or a model. The PEAK framework (Prepare, Execute, Act with Knowledge) is used as the work breakdown, not as a methodology pitch.
PREPARE: hypothesis generation, threat modelling, data source validation, scoping. This phase decides whether a hunt is worth running at all. Hypotheses come from adversary behaviour, environment-specific context, and knowledge of what your telemetry does not contain. An AI model can help you gather public intelligenc ...
