Join our Newsletter — 33% off our NHI Course

What are the signs that a hunting programme is stuck at partial automation?

The clearest signs are console-hopping, manual query building, repeated pivoting between tools, and hunts that depend on a few expert analysts to finish. If data is available but investigations still stall, the programme has automation in the stack but not in the workflow.

What partial automation looks like in a hunting programme

Partial automation usually shows up as a programme that has tools, data, and even some scripted steps, but still needs people to stitch the investigation together. The workflow is not yet executable end to end: analysts still have to interpret alerts, move between consoles, and decide what query or pivot comes next. Automation exists, but it has not absorbed the investigative path.

That distinction matters because automation in security hunting is not just about faster alerting. The real test is whether the programme reduces analyst friction across the full hunt lifecycle, from hypothesis to collection to validation. If the process still depends on human memory and manual switching to preserve context, the programme is only partially automated.

One practical sign is that the team can retrieve data quickly, but cannot turn it into an investigation without manual assembly. The environment may have logs, detections, and dashboards, yet each hunt still begins with a person deciding where to look, how to correlate fields, and which system to query next. At that point, the tooling supports the hunt, but the hunt itself is still human-led.

Operational signals that the workflow is still manual

Console-hopping is one of the clearest indicators. If hunters must move repeatedly between SIEM, EDR, cloud logs, ticketing, and enrichment tools to answer a single question, the programme has not unified the work into a repeatable path. The same is true when analysts keep rebuilding queries from scratch instead of reusing saved logic, playbooks, or chained searches.

Another signal is repeated pivoting without automation support. In a mature hunting workflow, one result should trigger the next step with minimal friction, such as automated enrichment, prebuilt joins, or a guided investigation path. When every pivot requires a new manual query, a new tab, or a fresh export, the process is still dependent on analyst effort rather than system design.

A third sign is bottleneck dependence on a few experts. If hunts only finish when particular analysts are available, the programme has not converted expertise into reusable operational capability. That often means the team has accumulated know-how, but not codified enough of it into workflows, detections, or decision logic that the wider function can use consistently.

Why stalled hunts matter more than tool count

The main issue is not whether automation exists somewhere in the stack, but whether it changes how quickly a hunt reaches a defensible conclusion. A programme can have data access, orchestration tools, and enrichment integrations while still failing to reduce the number of manual decisions required per case. If investigations stall even when relevant data is available, the limitation is workflow maturity, not visibility.

That is why partial automation often produces a false sense of progress. Teams may report that they have automated collection or alert routing, yet the analyst still performs the hardest and slowest work, which is correlation, interpretation, and validation. The result is a programme that looks efficient at the edges but remains slow at the centre.

In practice, the most useful question is whether automation removes repeated judgement calls or only speeds up access to raw data. If it does not reduce the number of times a human has to re-orient, re-query, or re-confirm the same information, the hunt process has not been automated enough to scale.

Practitioner Guidance

What to verify: Trace one common hunt from start to finish and count how many times an analyst must leave the current context, rebuild a query, or manually correlate results. If the same steps recur across hunts, treat them as automation candidates rather than analyst skill requirements.

What good looks like: A mature hunt workflow lets a practitioner move from hypothesis to evidence with minimal console switching, repeated query construction, or dependency on a single expert. The best signal is not more alerts, but shorter time to a validated answer with less manual stitching.

Common mistake: Teams often label collection automation as hunt automation. That overstates maturity, because pulling data faster does not help much if the investigation still requires manual pivots and expert memory to make sense of it.

Practitioner takeaway: If analysts still have to assemble the investigation by hand, the programme is not automated enough where it matters, it is only instrumented.