Most hunting programs are still reactive. The hypothesis that starts a hunt usually comes from an alert the SOC already has, so the hunt inherits the boundary of whatever telemetry produced that alert. Activity outside that telemetry never triggers a hunt at all, which makes this a visibility problem before it is a process problem. Automating the search runs the same bounded query on a faster clock.
Automated threat hunting is the use of software, correlation logic, or AI agents to run hypothesis-driven searches for adversary activity across an environment’s telemetry, on a cycle that starts before any rule fires. In a manual hunt, an analyst writes the query, reads the result, forms the next question, and pivots by hand. That is slow enough that most teams run a handful of hunts a quarter. Automation compresses the query and correlation work so the cycle can run continuously, and it leaves the set of queryable sources exactly where it found them.
Two adjacent terms get confused with it.
A hunt seeded from an existing alert searches ground already covered by the detection layer, which defeats the whole purpose of finding what detection missed.
Every hunt follows the same hypothesis-to-evidence sequence, whether an analyst executes it by hand or an agent runs it on a schedule.
Automation changes which parts a human performs by hand while leaving the sequence intact. Agents derive hypotheses from known TTPs, execute queries across every connected store, and correlate at a volume no analyst matches. A human still validates before anything escalates.
The reliability of all four steps rests on step two. A hypothesis is only as good as the data available to test it, and a hunt that queries three of five relevant log stores returns an answer shaped by the two it never touched.
Four categories carry most hunting work, and each does a specific job in that sequence.
Most organizations have built the collection and context layers reasonably well. What is missing is the connective layer that runs one hunt across all of them at once. A hunt is an investigation nobody escalated yet, so it stalls on whatever boundary an investigation would.
Living-off-the-land techniques abuse trusted, pre-installed operating system components to do the work malware used to do. PowerShell, WMI, scheduled tasks, and legitimate administrative tooling are signed, expected, and already on the host, so an adversary using them leaves behavior to observe and no malicious binary to match. Hunting for those keys on indicators of compromise (IOCs) has nothing to key on, because the artifacts are the same ones a systems administrator generates on a normal Tuesday.
The SANS 2025 threat hunting survey found 76% of organizations observed LOTL techniques in nation-state attacks and 49% in ransomware attacks, up from 42% the prior year. That ransomware jump is the signal worth watching: LOTL is spreading from well-resourced state operators into commodity criminal tooling. SANS has since published a 2026 edition of this survey, so read these as the 2025 baseline.
Behavioral hunting is the right answer to LOTL in principle, and it only works across the portion of the environment the hunter can query. This is where the reactive-trigger pattern becomes a structural blind spot. A hunt seeded by an existing alert runs against the telemetry that produced the alert, so a behavioral hunt built on that same partial coverage stays blind to LOTL activity in the unmonitored remainder. The behavior is happening. The query never reaches it.
Automating that hunt changes how fast the bounded search completes and nothing about how far it sees. Applied over partial coverage, automation delivers clean results specifically where attackers already know defenders are not looking, and that is worse than a slow hunt because it arrives carrying the unearned confidence of a completed process.
Consider an agent that queries five of eight log sources and returns clean in under two minutes. That output is indistinguishable from genuine safety unless the analyst knows which three were never in scope. In most deployments, nobody is tracking that list.
Whether the query layer can reach every store where LOTL behavior would appear. The sophistication of the correlation logic on top matters considerably less. PowerShell script-block execution logs, WMI event subscriptions, and administrative tool invocation records are where these techniques leave traces, and any one left unqueried breaks the hunt without generating a single error message.
Completeness is a property of the data layer, prior to and separate from the hunting logic above it. That makes coverage the first question to answer, not the last.
Not yet, and the honest case for automation does not depend on it being so.
Staffing is why automation has genuine value now. SANS’s 2025 survey found 61% of organizations naming staffing as the primary barrier to effective hunting, and that is a barrier no team clears by posting a requisition. Automation adds capacity a stretched team cannot hire its way into on any useful timeline. The 2026 edition shifts resource emphasis toward technology, which is worth reading before quoting the staffing figure as current.
In-house programs are growing while their ability to prove effectiveness shrinks. SANS reported in-house hunting at 58% of organizations in 2025 while formal effectiveness measurement fell to 51%. More teams are hunting, and fewer can demonstrate the hunting works, a credibility gap that surfaces the moment a board asks what the program found last quarter.
SANS also stated plainly that AI’s impact on uncovering threat actors remained limited. Automation improves hunt outcomes under three architectural conditions. Absent them, it accelerates the existing workflow and nothing more.
Strike48 queries logs in S3, Splunk, Elastic, and other stores where they already live, so a hunt spans the full estate with no migration project in front of it. One query can hit an S3 archive, a Splunk index, and an Elastic cluster in the same execution and correlate across all three. That is the difference between hunting the environment and hunting the subset somebody could afford to centralize.
Cost is the reason that subset exists. In Strike48’s 2026 survey of 100 security leaders, 84% said their tools cannot access all their log data for investigations, 65% had an investigation stall because data sat somewhere unreachable, and 80% called the cost of keeping data live and searchable painful or a major concern. Raw sources stay retained regardless of which parsers exist today, so coverage decisions follow risk rather than the per-GB line item.
On the second condition, each agent is scoped to a narrow task, with a knowledge graph defining what it knows and connectors defining which tools it may invoke. When an agent meets a log source nobody built a parser for, Strike48 auto-generates one or reads the semi-structured source directly, so an unfamiliar format widens the hunt instead of silently narrowing it. Every action lands in an audit trail, and human approval gates stay in place for consequential actions such as endpoint isolation.
Three questions separate a platform whose conclusions you can defend from one whose speed you are taking on faith.
Strike48 gives agents visibility across the full log environment before autonomy is applied, so hunt conclusions reflect what the environment actually contains. In early deployments, that brought mean time to detection below eight minutes across an estate legacy SIEM tooling only partially covered.
What is automated threat hunting?
Proactive search for adversary activity, driven by a hypothesis rather than an alert, and run by software or AI agents on a continuous cycle. The agent forms or receives a hypothesis about adversary behavior, queries the relevant log sources for evidence, and correlates what it finds for human review.
How does automated threat hunting differ from manual hunting and threat detection?
Manual hunting is analyst-driven: a person writes each query, reads the output, and pivots by hand. Threat detection is reactive, firing on a known pattern and handing an alert to the queue. Automated hunting compresses the query and correlation steps while a human still validates conclusions before escalation.
What tools and technologies support automated threat hunting?
SIEM, EDR/XDR, NDR, and threat intelligence platforms serve as the collection and context layers. What most organizations lack is the connective search-and-reasoning layer that runs a single hunt spanning every one of them and grounds its conclusions in the resulting evidence.
Is fully automated threat hunting realistic today?
Not yet. SANS’s 2025 survey was blunt about how little AI had contributed to actually uncovering threat actors. Automation improves outcomes where three conditions are met: complete log coverage as the input, narrowly scoped agents carrying the reasoning, and human validation at the escalation point. Strike48 keeps that last gate deliberately, with agents running investigation and correlation autonomously while humans approve actions carrying real-world consequences.
Why do living-off-the-land attacks evade automated hunts?
LOTL techniques abuse trusted OS components such as PowerShell and WMI, so there is no malicious indicator to match. A hunt run over partial coverage misses LOTL behavior in the unmonitored remainder no matter how fast the query completes. WMI event subscriptions in particular go unmonitored in many estates, leaving persistence established through them invisible to the hunt.