Notifications
Clear all
Topic starter
02/08/2026 11:42 am
TL;DR: Compromised credentials can take 292 days to identify and contain on average, while phishing and social engineering breaches persist for 261 and 257 days respectively, according to Panther. Threat hunting is therefore less about chasing alerts and more about finding valid logins, over-permissioned access, and tool misuse before they become long-dwell incidents.
NHIMG editorial — based on content published by Panther: What Is Cyber Threat Hunting? A Practitioner's Guide to Proactive Threat Detection
By the numbers:
- Breaches involving compromised credentials can take up to 292 days to identify and contain.
- Phishing attacks can take 261 days to identify and contain on average.
- Social engineering attacks can take 257 days to identify and contain on average.
Questions worth separating out
Q: What breaks when security teams do not hunt for identity abuse in cloud environments?
A: Teams miss the difference between valid access and legitimate access.
Q: Why do NHIs complicate threat hunting in SOC environments?
A: NHIs complicate hunting because service accounts, tokens, and workload credentials do not behave like human users and often have standing or excessive privilege.
Q: How do security teams know whether threat hunting is actually working?
A: Threat hunting is working when teams can move from first suspicious connection to confirmed containment without long manual pivots.
Practitioner guidance
- Build identity-led hunting hypotheses Start each hunt with a question about IAM role assumptions, OAuth token use, or privileged access that should be rare in your environment.
- Create baseline profiles for cloud and SaaS access Define normal access by user, service account, workload, region, and time of day so deviations are measurable.
- Convert validated hunts into detections Treat every confirmed hunt as a source of new detection logic.
What's in the full article
Panther's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for building hunt leads around cloud and SaaS behaviour, including identity provider logs and role assumptions.
- Practical examples of turning hunt findings into detection-as-code workflows with testing and deployment discipline.
- Operational guidance on using PantherFlow, natural language queries, and security data lake workflows for triage and investigation.
- Tooling and workflow detail for small teams trying to build a repeatable hunting process within 3 to 6 months.
👉 Read Panther's guide to cyber threat hunting and proactive threat detection →
Threat hunting in cloud and SaaS environments: what IAM teams miss?
Explore further
02/08/2026 12:54 pm
Credential abuse is now a hunting problem, not just an access-control problem. When attackers log in with valid credentials, many perimeter and endpoint controls treat the activity as ordinary. That shifts the burden to behavioural detection, identity context, and telemetry correlation. For NHI and IAM teams, the lesson is that authorised access can still be adversary access when privilege, timing, or source context diverge from the baseline. The practitioner conclusion is clear: hunt the identity pattern, not just the endpoint alert.
A question worth separating out:
Q: Should organisations prioritise hunt coverage for valid accounts or malware first?
A: For most cloud and identity-heavy environments, valid accounts should come first because attackers increasingly prefer legitimate credentials and admin paths over noisy malware. Hunting for valid account abuse catches credential theft, role misuse, and lateral movement earlier than file-based signatures. Malware hunting still matters, but identity abuse is often the higher-yield starting point.
👉 Read our full editorial: Cyber threat hunting turns credential abuse into detectable behaviour
