The continued need to modernize our deployed hunt and tactical cyber warriors has never been greater. Adversaries leveraging polymorphic and artificial intelligence (AI) driven attack methods are rapidly outpacing traditional hunt capabilities. Targets have grown exponentially from legacy IT targets and networks to a hybrid ecosystem of industrial control systems, critical infrastructure and multiple cloud tenants all with intermingled access and identity targets. It’s no longer a simple hunt where a cyber protection team (CPT) performs a week-long packet capture of a single environment and then runs the replay through basic forensic tools to determine if a compromise exists. Methodologies for attackers are changing — and so should our hunt detection mechanisms, strategy and tooling.
