Notifications
Clear all
Topic starter
01/08/2026 10:51 pm
TL;DR: Agentic AI can compress threat hunting from hours into minutes by turning analyst intent into correlation, enrichment, and timeline reconstruction, according to Exaforce’s analysis of a real Axios npm supply chain compromise. The operational shift matters because hunting speed, not just detection coverage, increasingly determines whether teams can validate blast radius before malicious packages disappear.
NHIMG editorial — based on content published by Exaforce: Vibe Hunting: A New Model for Threat Hunting Beyond SIEM Queries
Questions worth separating out
Q: How should security teams use agentic AI in threat hunting without losing control?
A: Use agentic AI to accelerate correlation, enrichment, and evidence gathering, but keep human approval at the points where findings become decisions.
Q: Why do supply chain incidents demand identity-aware hunting?
A: Supply chain incidents often begin with compromised publishing credentials, then move into package distribution, CI/CD execution, and downstream runtime compromise.
Q: What breaks when threat hunting stays tied to SIEM queries alone?
A: Hunting slows down because analysts have to manually translate events across identity, endpoint, cloud, and code systems before they can prove a narrative.
Practitioner guidance
- Map hunt automation to delegated investigative access Limit agent permissions to the minimum data sources required for hunt execution, including telemetry, case management, and approved enrichment systems.
- Connect package telemetry to identity context Join package registry events, maintainer credentials, CI/CD identity, and runtime execution logs so supply chain investigations do not depend on manual cross-tool correlation.
- Promote validated hunt logic into repeatable detections Save the indicators, query logic, and decision criteria from each successful hunt, then convert them into scheduled searches or custom detections that can re-run automatically.
What's in the full article
Exaforce's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step walkthrough of the Axios hunt prompt and how it was refined after the first pass
- Examples of the data pivots used across endpoint, network, CI/CD, and GitHub package context
- How the hunt was converted into a repeatable detection rule and scheduled automation
- Screens and workflow details showing how cases were created and looped back into monitoring
👉 Read Exaforce's analysis of vibe hunting and the Axios npm supply chain attack →
Vibe hunting and SIEM limits: what changes for threat hunters?
Explore further
01/08/2026 10:59 pm
Threat hunting is becoming a governance problem, not just an analyst workflow problem. Once an organisation relies on agentic AI to compress correlation and enrichment, it has to govern what data the system can see, what actions it can take, and how results are validated. This intersects directly with identity because hunting agents need controlled access to logs, cloud telemetry, code context, and cases. The control question shifts from query skill to delegated investigative privilege, which makes access design part of operational resilience.
A question worth separating out:
Q: How do you know if AI-assisted hunting is actually improving security?
A: Look for shorter time to validated evidence, more repeatable hunt logic, and detections that are promoted from successful investigations. If the platform only creates faster reports, it is improving workflow, not security. Real improvement shows up when the team can confirm suspicious activity, preserve the chain of evidence, and rerun the same logic later.
👉 Read our full editorial: Vibe hunting compresses threat hunting from queries to narratives
