Topic starter
19/08/2026 3:59 pm
TL;DR: Threat hunting at scale is less about tooling than about prioritisation, shared definitions, and understanding where attackers blend into normal administrator behaviour, according to Sprocket Security’s conversation with T. Rowe Price. The practical lesson is that hunters need context, graph-based reasoning, and a clear separation between hunting, incident response, and red teaming to reduce blind spots.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Ahead of the Breach – Matthew Winters on Threat Hunting, Graph Thinking, and Making Adversaries Cry”.
Key questions
Q: How should security teams structure threat hunting so it does not collapse into incident response?
A: Threat hunting should be a separate function with its own charter, data sources, and success metrics.
Q: Why do attackers who behave like administrators make threat hunting harder?
A: They make hunting harder because they exploit normal-looking access patterns, shared systems, and broad entitlements.
Q: What are the signs that a threat hunting programme is becoming too reactive?
A: A reactive programme usually depends on threat feeds, performs broad IOC sweeps, and lacks a documented hypothesis for each hunt.
Practitioner guidance
- Define hunting, response, and testing as separate functions Write distinct charters for threat hunting, incident response, and red teaming so each team has its own success criteria, escalation path, and deliverables.
- Start hunts with dataset extremes Review the biggest, smallest, rarest, and most frequent values in a dataset before deeper analysis so analysts learn the baseline and reduce noise early.
- Separate automated and human behaviour Compare activity over time to isolate machine-generated patterns from genuine user actions, then investigate the exceptions that do not fit expected workflows.
Bottom line: Threat hunting at scale depends on prioritising the right part of the attack path, not on adding another tool to the stack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:36 pm
Prioritisation is the real control plane of threat hunting. The article shows that large environments fail hunters less through missing telemetry than through weak sequencing and vague objectives. When teams cannot agree on where to start, they create survivorship bias in the hunt itself, because only the obvious signals get attention. Practitioners should treat hunt ordering as a governance decision, not an analyst preference.
A question worth separating out:
Q: How do graph-based methods improve threat hunting prioritisation?
A: Graph-based methods show which actions connect multiple stages of an attack and which ones are structurally important to the attacker’s path. That helps defenders spend time on choke points rather than on isolated anomalies. When a hunt can remove a critical link in the chain, it has a better chance of changing adversary behaviour.
👉 Read our full editorial: Threat hunting at scale depends on where defenders look first