An investigation model where a human starts the hunt and decides what matters, while automation handles the repetitive evidence collection. This preserves analyst judgement while reducing the time needed to assemble and test a hypothesis.
Expanded Definition
Analyst-led hunting is a security investigation model in which a human analyst forms the initial hypothesis, decides which signals matter, and steers the inquiry while automation gathers and normalises evidence. It is distinct from fully automated detection, where systems decide both the lead and the outcome, and from purely manual investigation, where every query and correlation is assembled by hand. In practice, this approach sits between alert triage and formal incident response: it is exploratory, iterative, and designed to surface weak signals that may not map cleanly to fixed rules. The model aligns well with the functions and governance language used in the NIST Cybersecurity Framework 2.0, especially where organisations need repeatable processes for identifying and analysing suspicious activity.
Definitions vary across vendors on how much automation still qualifies as analyst-led, but the core principle is consistent: human judgement remains the control point for hypothesis selection and interpretation. This matters because the analyst is not simply reviewing alerts; they are testing a theory about adversary behaviour, environment drift, or identity misuse. The most common misapplication is calling a workflow analyst-led when the analyst only confirms machine-generated conclusions after the evidence has already been preselected.
Examples and Use Cases
Implementing analyst-led hunting rigorously often introduces queue-management overhead, requiring organisations to weigh faster evidence gathering against the discipline needed to preserve human judgement.
- An analyst suspects lateral movement after a privileged account logs into multiple systems outside normal hours, and automation pulls authentication, endpoint, and network telemetry for review.
- A hunt is initiated around possible abuse of NIST Cybersecurity Framework 2.0 detection and response activities after a new host pattern appears in SIEM queries.
- A team investigates whether a service principal or other NHI has been over-privileged, using automated evidence collection to compare token use, scope changes, and unusual API calls.
- An analyst starts with an identity-centric hypothesis, such as repeated impossible travel followed by abnormal access to sensitive applications, and automation assembles the access path.
- During an active threat hunt, the analyst iterates on the hypothesis as new evidence appears, rather than waiting for a fixed playbook to declare a result.
This model is especially useful in environments with mixed telemetry quality, where the investigator needs the flexibility to follow a weak lead without spending most of the time on manual log gathering. It also fits cases where context matters more than volume, such as identity compromise, insider threat, and NHI abuse patterns.
Why It Matters for Security Teams
Analyst-led hunting matters because it preserves decision quality while reducing the friction that often slows investigations. If automation is allowed to choose the hunt path end to end, teams can miss unconventional attacker behaviour, especially when the adversary blends into normal identity activity or uses legitimate tools in abnormal ways. If, by contrast, everything is manual, hunts become too slow to scale and too inconsistent to repeat. The security value of the model is that it creates a repeatable loop: analyst hypothesis, automated evidence gathering, human interpretation, and refinement.
For identity-heavy environments, this is particularly important when investigating compromised user accounts, service accounts, secrets abuse, or NHI activity, because the first clue is often behavioural rather than signature-based. Analyst-led hunting also supports better handoff into incident response by producing a clearer rationale for why a lead mattered, what evidence was collected, and where confidence remains uncertain. Organisations typically encounter the operational cost of misunderstanding this model only after a false positive flood or missed intrusion, at which point analyst-led hunting becomes operationally unavoidable to restore investigative control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-1 | Continuous monitoring and anomaly analysis underpin hunt-driven investigation workflows. |
| NIST AI RMF | The AI RMF supports human oversight and accountable use of automation in decision support. | |
| OWASP Agentic AI Top 10 | Agentic workflows need human control points when tools gather evidence or execute actions. |
Use hunt findings to strengthen monitoring coverage and refine the signals your team watches continuously.
