Security News

Scope of Threat Hunting is Growing; Dwell Time Shrinking: SANS Survey

A new SANS survey finds that organisations are broadening the scope of their threat hunting efforts and that dwell times are decreasing. The survey, to be released in a two-part webcast on September 19 and September 20, also indicates that threat hunting is not so much “about rebranding what many defenders have endeavoured to do over the years,” according to SANS authors Robert M. Lee and Rob T. Lee. Instead, they say, threat hunting is now “about placing an appropriate, dedicated focus on the effort by analysts who purposely set out to identify and counteract adversaries who may already be in the environment.”

The survey found 43% of respondents’ organizations are now performing continuous threat hunting operations, which the authors consider a strong indicator that threat hunting is growing in scope and need. As they point out, “In 2017, the number was only 35%, which shows that many organizations are now adopting methodologies that are key to reducing adversaries’ overall dwell time.”

The authors are hopeful that, as more organisations perform threat hunting, dwell time will shorten even more in the coming years. They indicate that dwell time currently averages above 90 days, but “as recently as 2013, the average dwell time was over six months. The decline since then shows that the adoption of threat hunting and stronger analytical techniques have had a significant impact on reducing the overall dwell time of adversaries across most networks.”

Leave a Comment

Your email address will not be published.

You may also like