Notifications
Clear all
Topic starter
20/08/2026 5:24 pm
TL;DR: Threat hunting is a hypothesis-based security discipline that depends on continuous monitoring, intelligence, validation, and cross-team collaboration, according to Expel. The core lesson is that hunting only works when visibility, logging, and operational context are already strong enough to turn anomalies into evidence and action.
NHIMG editorial — based on content published by Expel: Threat hunting basics and the four fundamentals behind a proactive security strategy
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: Why do NHIs complicate threat hunting in SOC environments?
A: NHIs complicate hunting because service accounts, tokens, and workload credentials do not behave like human users and often have standing or excessive privilege.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: What do security teams get wrong about threat hunting at scale?
A: They often treat hunting as a query-writing problem instead of a workflow design problem.
Practitioner guidance
- Instrument identity telemetry for hunting Collect authentication events, privilege changes, token use, and service account activity into searchable telemetry so hunters can test identity-based hypotheses, not just endpoint alerts.
- Baseline non-human account behaviour Define normal access windows, source systems, and command patterns for API keys, service accounts, and workloads so deviations are visible before they become incidents.
- Link SOC triage to IAM ownership Route anomalous identity findings to the teams that own the account, credential, or role so containment decisions can happen before lateral movement completes.
What's in the full article
Expel's full blog covers the operational detail this post intentionally leaves for the source:
- Practical examples of how its SOC uses cross-customer telemetry to spot threat patterns that a single environment may miss.
- The step-by-step structure of a hypothesis-based hunt, including how analysts validate or disprove an initial suspicion.
- Examples of the monitoring and log sources the article treats as foundational for an effective hunting programme.
- The collaboration model between SOC, incident response, and intelligence teams that supports faster investigation.
👉 Read Expel's threat hunting guide for the operational foundation behind the framework →
Threat hunting foundations: are your visibility and hypotheses ready?
Explore further
20/08/2026 6:14 pm
Threat hunting is only as effective as identity visibility. The article frames monitoring as a general security foundation, but the same logic applies directly to IAM and NHI governance. If teams cannot see service accounts, API keys, and privileged sessions with enough fidelity, hunting becomes retrospective guesswork rather than timely detection. The practitioner conclusion is simple: identity telemetry is not optional input to hunting, it is part of the hunting control itself.
A question worth separating out:
Q: How do IAM and SOC teams work together during identity-focused threat hunting?
A: SOC should surface the anomaly, while IAM and PAM teams explain whether the account, role, or session should have existed in the first place. That division of labour reduces false positives and speeds containment. The key is a shared investigation path that preserves identity context from first alert to decision.
👉 Read our full editorial: Threat hunting foundations are shifting from reactive to proactive defense
