Online Training Special Offer: iPad Air w/ Smart KB, Surface Go, or $300 Off


Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

Threat Hunting: Open Season on Cyber Threats

Most Organizations Involved in Threat Hunting; Enhanced Security Associated with Hunting; Improvement Needed

  • Bethesda, MD
  • April 5, 2016

Most organizations are involved in threat hunting to some extent, according to results of a new survey to be released by SANS Institute during a two-part webcast on April 14 and April 15.

"Every hour of every day you are either hunting or being hunted," says Eric Cole, PhD, SANS Analyst and network security expert. "The only question you have to ask is which side do you want to be on?"

Nearly 86% of organizations responding to the survey want to be doing the hunting, albeit informally, as more than 40% do not have a formal threat hunting program in place.

"The question is no longer whether or not you are going to have a breach, but how quickly you will detect the adversary to control the overall impact," Cole continues. "Building a hunting program can help your organization reduce the amount of damage from an attack."

Results indicate that hunting is providing benefits. In this survey, 52% who have implemented threat-hunting programs have found previously undetected threats, 74% have reduced attack surfaces, and 59% enhanced speed and accuracy of response by using threat hunting.

Responses indicate that organizations want to realize more benefits from threat hunting and to formalize their programs, with 88% of those respondents who do threat hunting saying their threat-hunting programs need to be improved.

Full results will be shared during a two-part webcast at 1 PM EDT on both Thursday, April 14 and Friday, April 15, sponsored by Carbon Black, DomainTools, Endgame, Hewlett Packard Enterprise, Malwarebytes, and Sqrrl, and hosted by SANS. Register to attend the April 14 webcast, which focuses on what threat hunting is, pitfalls to gaining actionable results and how threat hunting is currently being used at and the April 15 webcast on threat-hunting methodologies and tools at

Those who register for the webcast will also receive access to the published results paper developed by SANS Analyst and network security expert, Eric Cole, PhD.

Tune in for #THREATHUNTING Update - Part 1, APR 14: AND Part 2, APR 15: #infosec

#THREATHUNTING Survey Results Revealed: 4/14 AND 4/15 #infosec #databreach

What R Orgs Doing to Detect Hidden Threats?? Find Out: Pt 1, 4/14: AND Pt 2, 4/15: #infosec

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 60 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates a practitioner's qualifications via over 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system—the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (