Enterprise environments rarely run one secrets tool. It’s Vault here, AWS Secrets Manager there, CI/CD secrets in pipelines, and .env files on laptops.
Join Infisical’s live webinar on July 22 for a practical walkthrough of how enterprise teams inventory, rotate, and audit credentials across all of it, and how to assess whether that setup is ready for AI agents.
In a rush? Here are our key takeaways, so you don’t miss out and can come back later for the details.
Traditional threat hunting is constrained by time, expertise and the volume of security telemetry.
AI improves threat hunting by correlating weak signals across multiple data sources and identifying behavioural anomalies.
Modern SIEM and EDR platforms increasingly embed AI features such as natural-language querying and automated investigation summaries.
Large language models act as investigative assistants, helping analysts write queries, interpret logs and document findings more efficiently.
AI augments rather than replaces human threat hunters, allowing analysts to focus on strategic investigation and decision-making.
Threat hunting has always occupied a unique place within cybersecurity. Unlike traditional security monitoring, which responds to alerts generated by detection systems, threat hunting begins with a different assumption: an attacker may already be inside the environment, and existing security controls may have failed to notice.
For many organisations, however, effective threat hunting has remained difficult. It requires experienced analysts, significant amounts of telemetry, strong knowledge of attacker behaviour and enough time to investigate weak signals that may or may not represent malicious activity. Unfortunately, these are precisely the resources that modern security operations centres often lack.
Artificial intelligence is beginning to change that equation.
Rather than replacing human threat hunters, AI is making hunting more accessible, more scalable and considerably faster. Security teams can now investigate larger environments, correlate vastly more data and identify subtle attacker behaviours that would previously have required hours of manual work.
As AI becomes embedded within security platforms, understanding how to use it effectively is becoming an important skill for every cybersecurity professional and not only for dedicated threat hunters.
Most organisations already collect enormous quantities of security telemetry. EDR platforms, network monitoring tools, cloud security services, identity providers and firewalls collectively generate millions of events every day. The challenge has never been collecting data, but, rather, deciding which tiny fraction of those events deserves investigation.
A traditional threat hunt often begins with a hypothesis. An analyst might ask:
Is anyone abusing PowerShell unusually?
Are credentials being used from impossible geographic locations?
Has lateral movement occurred using remote administration tools?
Are there signs of credential dumping that existing detections missed?
Each question requires manually writing queries, analysing results, eliminating false positives and refining the investigation repeatedly. This process is highly dependent upon analyst experience. Junior analysts frequently struggle to know where to begin, while senior hunters spend much of their time performing repetitive analytical tasks rather than applying their expertise. As attacker techniques continue to evolve, maintaining comprehensive hunting coverage becomes increasingly difficult.
AI introduces automation at several stages of the hunting lifecycle. Instead of relying entirely upon manually written queries, modern AI systems can analyse relationships across large datasets, identify behavioural anomalies and suggest investigative paths that analysts might otherwise overlook.
Rather than reviewing individual alerts independently, AI models examine broader patterns. For example, an isolated PowerShell execution may appear perfectly normal. However, AI may observe that the same endpoint also experienced:
unusual process creation,
suspicious DNS lookups,
abnormal authentication behaviour,
cloud API activity,
and privilege escalation attempts.
Viewed individually, none of these events may trigger an alert. Viewed collectively, they begin to resemble an intrusion. This ability to correlate weak signals across multiple data sources represents one of AI’s greatest strengths.
Traditional detection technologies largely depend upon known indicators. Security products search for recognised malware hashes, suspicious IP addresses, known command sequences or established attack techniques. Threat hunting attempts to move beyond these limitations by looking for behaviour instead of signatures.
AI enhances this behavioural approach considerably. Machine learning models can establish a baseline of normal activity across users, systems and applications before identifying statistically unusual behaviour. Rather than asking whether activity matches a known attack, AI increasingly asks a different question: “Does this activity make sense given everything else I know about this environment?”
This behavioural perspective makes detecting novel attacks significantly easier. It also makes security operations less dependent upon yesterday’s indicators of compromise.
One of the biggest misconceptions surrounding AI-powered threat hunting is that organisations require dedicated AI teams or specialist data scientists. In reality, most security professionals will encounter AI through the platforms they already use. Modern SIEM platforms increasingly provide natural language querying.
Instead of memorising complex query syntax, analysts can simply ask “show me endpoints that downloaded executables before authenticating to privileged systems” or “identify users exhibiting abnormal authentication behaviour over the past seven days” and receive rich, data-driven responses. The AI translates these requests into platform-specific queries while explaining its reasoning and suggesting additional investigative avenues.
Similarly, EDR products increasingly summarise attack chains automatically. Rather than manually piecing together dozens of process executions, analysts receive an initial investigation describing likely attacker behaviour, affected systems and recommended next steps. This dramatically reduces the time required to begin meaningful investigation.
During an investigation, analysts constantly perform small cognitive tasks:
interpreting logs,
translating encoded commands,
explaining unfamiliar Windows API calls,
identifying MITRE ATT&CK techniques,
summarising PowerShell scripts,
generating Sigma rules,
writing detection queries,
documenting findings.
These tasks consume significant time despite requiring relatively little strategic thinking. Large language models excel at exactly this type of work. Instead of replacing analysts, AI removes much of the administrative and analytical friction surrounding investigations. The result is that threat hunters spend more time thinking about attacker behaviour and less time performing repetitive technical translation.
Modern security operations face several persistent problems.
The first is scale: no human team can manually review billions of events every day.
The second is analyst fatigue: high alert volumes inevitably produce burnout, inconsistent investigations and missed opportunities.
The third is experience: threat hunting remains heavily dependent upon senior analysts whose expertise takes years to develop.
AI addresses each challenge differently as automation reduces the number of events requiring manual review. Behavioural analytics highlight the most promising investigative leads. Large language models provide junior analysts with contextual explanations that previously required assistance from experienced colleagues. Rather than replacing expertise, AI helps distribute it more effectively across the security team.
Despite rapid advances, AI does not eliminate the need for experienced threat hunters. Models still hallucinate and context still matters. Business knowledge still determines whether unusual behaviour is genuinely suspicious.
An administrator performing emergency maintenance may look identical to an attacker unless organisational context is considered. Likewise, sophisticated adversaries increasingly understand how AI-assisted detection systems operate and are actively adapting their techniques to evade behavioural models.
The human analyst therefore remains responsible for validating conclusions, understanding organisational risk and deciding how investigations should proceed. The future of threat hunting is therefore unlikely to be entirely autonomous. Instead, it will be collaborative: AI performs the large-scale data analysis, while humans perform the strategic reasoning.
Threat hunting has always represented one of cybersecurity’s most intellectually demanding disciplines. AI is not changing that. Instead, it is lowering the barriers that have historically prevented many organisations from hunting effectively. By accelerating investigations, correlating complex behaviours and reducing repetitive analytical work, AI enables security teams to become significantly more proactive without proportionally increasing staffing levels.
Over the coming years, the distinction between traditional detection engineering, threat hunting and AI-assisted investigation is likely to blur. Every analyst will increasingly work alongside intelligent systems capable of generating hypotheses, analysing telemetry and recommending investigative paths.
The organisations that gain the greatest benefit will not be those that simply deploy AI tools. They will be those who learn how to combine machine-scale analysis with human judgement to create faster, more adaptive security operations.
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.