Working with Agentic AI: Cyber Threat Hunter
1. Working with Agentic AI: Cyber Threat Hunter
How Human Skills and Agentic Skills Dynamically Combine Across Cyber Threat Hunting Responsibilities
1.1. Cyber Threat Hunting as Professional Work
A cyber threat hunter proactively searches systems, networks, endpoints, cloud environments, identities, applications, security telemetry, and other authorized data sources for evidence of malicious activity that has not been adequately identified by existing automated security controls. Rather than depending entirely on predefined alerts, the role involves developing hunt hypotheses, investigating anomalous behavior, analyzing security telemetry, examining adversary tactics, techniques, and procedures, correlating evidence across multiple sources, identifying indicators of compromise or suspicious behavior, investigating possible attacker persistence and lateral movement, distinguishing malicious activity from legitimate behavior, and determining whether suspicious findings warrant escalation. Cyber threat hunters also contribute to threat intelligence application, detection engineering, incident investigation, security-control improvement, threat-hunting methodology, documentation, reporting, and collaboration with security operations, incident response, digital forensics, vulnerability management, security engineering, and other cybersecurity functions. Their work therefore combines proactive investigation, adversary understanding, technical analysis, contextual reasoning, and continuous improvement of defensive capabilities.
1.2. Working with Agentic AI
Agentic AI can participate across cyber threat hunting by applying language comprehension, reasoning, classification, information retrieval, coding, pattern analysis, comparison, generation, evaluation, and workflow-execution capabilities to security telemetry, endpoint events, network records, authentication activity, cloud logs, threat intelligence, detection rules, incident histories, vulnerability information, system inventories, and other authorized cybersecurity sources. An AI agent can help collect and normalize hunt-relevant information, generate preliminary hunt hypotheses, translate hypotheses into search strategies, construct or refine queries, correlate events across multiple data sources, identify unusual behavioral patterns, compare observed activity with known adversary techniques, retrieve relevant threat intelligence, summarize suspicious activity, organize investigation evidence, generate preliminary timelines, identify information gaps, prepare hunt reports, and convert validated findings into candidate detection improvements. These activities can operate as interconnected workflows in which the agent retrieves evidence, executes authorized analytical tools, evaluates intermediate findings, revises queries, expands or narrows investigative scope, and adjusts subsequent actions when new telemetry, intelligence, analyst judgments, or investigation results become available. The cyber threat hunter remains important for developing meaningful investigative hypotheses, understanding environmental context, distinguishing legitimate but unusual activity from adversary behavior, evaluating uncertain evidence, recognizing novel attack patterns, directing deeper investigation, determining the significance of findings, and making or escalating consequential cybersecurity decisions.
1.3. Human Skills and Agentic Skills
Human skills in cyber threat hunting include adversarial thinking, cybersecurity knowledge, investigative reasoning, hypothesis development, technical intuition, contextual interpretation, anomaly evaluation, evidence assessment, creativity, persistence, risk judgment, and the ability to understand how apparently unrelated activities across endpoints, identities, applications, networks, and cloud resources may form a meaningful pattern of adversary behavior. These skills are especially important when malicious activity deliberately resembles legitimate administration, evidence is incomplete or distributed across multiple systems, normal behavior differs among users or assets, known indicators are unavailable, or an adversary changes techniques to evade existing detections. The cyber threat hunter also performs analytical activities that can overlap substantially with AI capabilities, including log analysis, information retrieval, event correlation, threat intelligence analysis, query development, pattern recognition, evidence organization, and investigation documentation.
Agentic skills in cyber threat hunting are task-oriented capabilities through which an AI agent can assist with hypothesis generation, telemetry analysis, threat intelligence retrieval, behavioral comparison, event correlation, query development, anomaly investigation, evidence organization, hunt documentation, and detection improvement. Depending on available systems and authorization, these skills may retrieve and normalize security data, generate search queries or analytical code, compare activity across hosts and accounts, correlate events over time, identify behavioral outliers, map observed activity to known adversary techniques, retrieve related intelligence, organize investigative timelines, classify findings, summarize evidence, maintain hunt status, and identify possible gaps in existing detections. Their usefulness depends on telemetry coverage, data quality, environmental context, system access, model capability, tool availability, adversary sophistication, false-positive rates, and the level of reliability required for the investigation.
The relationship between human skills and agentic skills in cyber threat hunting should therefore be understood as a dynamic and collaborative division of work between the cyber threat hunter and Agentic AI across different professional responsibilities. The cyber threat hunter contributes human skills such as adversarial thinking, investigative judgment, hypothesis formation, contextual interpretation, technical intuition, uncertainty evaluation, and risk judgment when performing responsibilities including hunt planning, behavioral analysis, anomaly investigation, adversary tracking, compromise assessment, evidence evaluation, and escalation. Agentic AI contributes agentic skills such as high-volume telemetry processing, information retrieval, query generation, event correlation, pattern comparison, anomaly identification, intelligence retrieval, evidence organization, and iterative analytical support across many of the same responsibilities. The relative contribution of each can change continuously according to the hunt hypothesis, available telemetry, environmental conditions, adversary behavior, strength of evidence, investigative progress, and potential consequences of the findings. A hunt may therefore involve human-generated hypotheses followed by agentic analysis, agent-generated investigative leads followed by human validation, or repeated exchanges in which findings from one side reshape the next analytical action of the other. The practical objective is not to assign complete hunts permanently to either the human analyst or Agentic AI, but to dynamically combine and coordinate the human skills of the cyber threat hunter with the agentic skills of Agentic AI according to the changing requirements of each responsibility, task, and subtask.
1.4. Dynamic Allocation of Tasks and Subtasks
A responsibility such as hypothesis-driven hunting, telemetry analysis, behavioral investigation, or compromise assessment consists of multiple tasks and subtasks rather than one indivisible activity. These subtasks can require different combinations of information retrieval, query development, data analysis, event correlation, adversarial reasoning, contextual interpretation, evidence evaluation, and decision-making. Human and agentic participation can therefore vary within the same threat-hunting responsibility.
The allocation of work should be understood as dynamic rather than fixed. An agent may initially analyze large volumes of telemetry, identify an unusual behavioral pattern, escalate the finding to the cyber threat hunter for contextual interpretation, receive a revised hypothesis or investigative direction after human review, and then continue searching additional systems or data sources. Other analytical subtasks may be completed largely through agentic skills when the data, investigative objective, tools, and authorization are sufficiently clear. Allocation can change according to adversary sophistication, data quality, environmental complexity, investigation consequence, model capability, tool access, output reliability, false-positive rates, intermediate findings, and organizational security controls.
A useful way to understand this structure is:
Occupation → Responsibility → Task → Subtask → Human and/or Agentic Skills → Evaluation → Possible Reallocation
The purpose of integrating agentic skills is therefore not to remove professional investigative responsibility. It is to expand the analytical capabilities available to the cyber threat hunter and enable work to be allocated according to the evolving requirements of each hunt.
1.5. Cyber Threat Hunting Responsibilities
1.5.1. Threat Hunting Strategy and Hunt Planning
Threat hunting strategy and planning establishes what areas of the environment should be investigated, why a hunt is necessary, which data sources are relevant, and how findings will be evaluated. Human skills are important for identifying meaningful investigative priorities, understanding the threat environment, recognizing weaknesses in existing defenses, and determining where proactive investigation can provide the greatest security value. Agentic skills can organize threat information, review previous hunts, analyze available telemetry sources, identify recurring detection gaps, and prepare preliminary hunt plans.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Establish hunt priorities, interpret threat context, identify meaningful investigative objectives, and determine appropriate hunt scope. | Organize threat information, analyze previous findings, inventory relevant data sources, identify possible coverage gaps, and prepare preliminary hunt plans. | AI can organize information for hunt planning; human judgment establishes meaningful priorities and scope; approved objectives can then guide subsequent agentic analysis. |
1.5.2. Hunt Hypothesis Development
Hypothesis development converts threat knowledge, unusual observations, intelligence, environmental risks, or weaknesses in existing detections into testable propositions about possible adversary activity. Human skills contribute adversarial thinking, creativity, technical intuition, environmental understanding, and the ability to imagine how an attacker might evade established controls. Agentic skills can analyze threat intelligence, previous incidents, known adversary behaviors, vulnerabilities, detection gaps, and environmental information to generate and compare candidate hypotheses.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Apply adversarial thinking, technical intuition, environmental knowledge, and investigative judgment to formulate meaningful hypotheses. | Analyze threat information, previous incidents, adversary behaviors, vulnerabilities, and detection gaps to generate candidate hypotheses. | AI can broaden the hypothesis space; human judgment selects and refines meaningful hypotheses; selected hypotheses can then become inputs for agentic hunt preparation. |
1.5.3. Threat Intelligence Analysis and Application
Cyber threat intelligence provides information about adversaries, campaigns, infrastructure, tactics, techniques, procedures, vulnerabilities, indicators, and other threat characteristics that can guide proactive hunting. Human skills are important for evaluating intelligence relevance, reliability, timeliness, and applicability to the environment. Agentic skills can retrieve, summarize, classify, compare, and correlate intelligence from authorized sources and connect relevant information with internal telemetry or hunt hypotheses.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Evaluate intelligence quality and relevance, interpret adversary behavior, and determine how intelligence should influence hunting priorities. | Retrieve, summarize, classify, compare, and correlate threat intelligence and connect relevant information with hunt hypotheses. | AI can continuously process threat information; human interpretation determines its significance; relevant intelligence can trigger new or revised agentic hunts. |
1.5.4. Security Telemetry Collection and Preparation
Effective hunting depends on appropriate telemetry from endpoints, networks, identities, applications, cloud environments, security platforms, and other monitored systems. Human skills are important for determining which data is necessary, understanding collection limitations, evaluating telemetry quality, and recognizing visibility gaps. Agentic skills can inventory available sources, retrieve authorized data, normalize fields, organize datasets, identify missing information, and prepare telemetry for subsequent analysis.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Determine relevant telemetry, interpret collection limitations, evaluate visibility, and identify consequential data gaps. | Inventory and retrieve authorized telemetry, normalize information, organize datasets, and identify missing or inconsistent records. | AI can prepare and assess available data; human evaluation determines whether visibility is sufficient; identified gaps can change hunt scope or collection priorities. |
1.5.5. Hunt Query and Analytical Logic Development
Threat hunts frequently require search queries, filters, correlations, scripts, statistical analyses, or other analytical logic for locating suspicious behavior within large datasets. Human skills are important for translating hypotheses into meaningful investigative conditions and recognizing whether analytical logic adequately represents the suspected behavior. Agentic skills can generate preliminary queries, scripts, filters, and analytical code; translate logic between supported tools; refine searches; and explain how query conditions relate to the hunt hypothesis.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Translate investigative hypotheses into meaningful search logic, validate assumptions, and determine whether analytical methods represent the suspected behavior. | Generate and refine queries, filters, scripts, correlations, and analytical code and adapt them to available data structures and tools. | Human-defined hypotheses guide agentic query generation; query results reveal weaknesses or excessive noise; human interpretation can refine the logic for another analytical cycle. |
1.5.6. Endpoint Threat Hunting
Endpoint hunting examines processes, files, services, registry activity, command execution, authentication events, persistence mechanisms, endpoint connections, and other host-level evidence for indications of adversary behavior. Human skills are important for understanding operating-system behavior, recognizing suspicious sequences, interpreting unusual administrative activity, and distinguishing malicious actions from legitimate operations. Agentic skills can process large volumes of endpoint telemetry, correlate events, identify unusual process relationships, compare behavior across hosts, and organize suspicious activity for investigation.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Interpret endpoint behavior, recognize suspicious execution patterns, evaluate administrative activity, and determine investigative significance. | Analyze endpoint events, correlate processes and activities, compare hosts, identify behavioral anomalies, and organize suspicious evidence. | AI can identify unusual endpoint patterns at scale; human judgment distinguishes legitimate anomalies from possible compromise; validated findings can direct deeper agentic searches. |
1.5.7. Network Threat Hunting
Network threat hunting examines communication patterns, connections, protocols, traffic flows, DNS activity, remote access, and other network evidence for suspicious or unexpected behavior. Human skills contribute understanding of network architecture, protocols, normal communication patterns, and adversary movement. Agentic skills can analyze connection records, compare activity against baselines, identify unusual destinations or communication patterns, correlate network evidence with endpoint events, and organize potential investigative leads.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Interpret network behavior, understand architecture and protocols, recognize suspicious communications, and evaluate their security significance. | Analyze network telemetry, compare communication patterns, identify anomalies, correlate network and endpoint evidence, and organize investigative leads. | AI can surface unusual network behavior; human interpretation determines whether it is operationally legitimate or suspicious; confirmed concerns can guide broader agentic correlation. |
1.5.8. Identity and Account Behavior Hunting
Identity-focused hunting searches for suspicious authentication activity, privilege use, account access, credential misuse, and behavioral patterns that may indicate compromised or malicious accounts. Human skills are important for understanding expected account behavior, administrative practices, privilege relationships, and legitimate operational exceptions. Agentic skills can compare authentication histories, identify unusual access times or locations, detect abnormal privilege use, correlate account activity across systems, and identify behavioral deviations.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Interpret account context, administrative practices, privilege relationships, and unusual identity behavior. | Compare authentication and access activity, identify behavioral deviations, correlate identity events, and surface unusual privilege usage. | AI can identify identity anomalies across large datasets; human judgment determines whether behavior is explainable; suspicious cases can trigger expanded agentic investigation. |
1.5.9. Behavioral Baseline and Anomaly Analysis
Threat hunters often need to understand normal system, user, service, administrative, and network behavior before determining whether an observed deviation is suspicious. Human skills are important for understanding operational context and recognizing when legitimate changes make historical baselines misleading. Agentic skills can analyze historical telemetry, establish preliminary behavioral patterns, identify statistical or contextual outliers, compare peer groups, and monitor deviations over time.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Interpret normal operational behavior, recognize legitimate exceptions, evaluate contextual significance, and determine which anomalies deserve investigation. | Analyze historical activity, construct preliminary baselines, identify outliers, compare behavioral patterns, and monitor deviations. | AI can continuously surface deviations from established patterns; human interpretation filters benign anomalies and redirects agentic analysis toward more meaningful behaviors. |
1.5.10. Adversary Tactics, Techniques, and Procedures Analysis
Threat hunting requires understanding how adversaries gain access, execute actions, establish persistence, escalate privileges, evade defenses, access credentials, discover systems, move laterally, collect information, communicate externally, and pursue their objectives. Human skills contribute adversarial reasoning and the ability to recognize variations or combinations of techniques that do not precisely match known patterns. Agentic skills can map observed evidence to known adversary behaviors, compare activities with threat intelligence, organize related techniques, and identify additional behaviors that may logically accompany existing findings.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Interpret adversary behavior, recognize variations in attack techniques, evaluate attacker objectives, and reason about likely subsequent actions. | Map evidence to known behaviors, compare activity with intelligence, organize related techniques, and identify additional behaviors for investigation. | AI can rapidly connect evidence with known adversary patterns; human reasoning evaluates novel or ambiguous behavior; resulting interpretations can generate additional agentic searches. |
1.5.11. Indicator and Artifact Investigation
Indicators and artifacts can include suspicious domains, addresses, file hashes, processes, files, commands, accounts, registry changes, certificates, network patterns, and other observable evidence associated with possible malicious activity. Human skills are important for determining contextual significance and avoiding conclusions based solely on isolated indicators. Agentic skills can retrieve related evidence, search across available telemetry, correlate indicators with other events, enrich artifacts with authorized intelligence, and identify related systems or accounts.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Evaluate indicator context, determine evidentiary significance, recognize misleading or weak indicators, and guide further investigation. | Search telemetry for indicators, enrich artifacts, correlate related events, identify affected assets, and organize supporting evidence. | AI can rapidly investigate indicators across multiple sources; human judgment evaluates their significance; validated relationships can trigger broader agentic searches. |
1.5.12. Attack Path, Persistence, and Lateral Movement Investigation
When suspicious activity is identified, threat hunters may investigate how an adversary entered the environment, maintained access, escalated privileges, moved between systems, accessed additional accounts, and progressed toward objectives. Human skills are important for reconstructing incomplete attack paths, developing hypotheses about missing activity, and understanding system relationships. Agentic skills can correlate events across hosts, accounts, timestamps, network connections, and security tools to construct preliminary timelines and identify possible movement paths.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Reconstruct incomplete adversary activity, reason about missing evidence, interpret system relationships, and evaluate possible attack paths. | Correlate events across systems and identities, construct timelines, identify related activity, and generate possible movement sequences. | AI can assemble distributed evidence into preliminary attack paths; human reasoning identifies gaps or alternative explanations; revised hypotheses can guide further agentic searches. |
1.5.13. Compromise Assessment and Evidence Evaluation
Threat hunters must determine whether suspicious findings represent actual compromise, benign anomalies, incomplete evidence, or activity requiring further investigation. Human skills are central to weighing evidence, considering alternative explanations, assessing confidence, and determining the security significance of a finding. Agentic skills can consolidate evidence, compare observations with known patterns, identify supporting or contradictory information, and maintain structured investigative records.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Evaluate evidence, consider alternative explanations, assess confidence, and determine whether findings indicate compromise or require further investigation. | Consolidate evidence, identify supporting and contradictory information, compare observations with known patterns, and maintain investigative context. | AI can organize evidence and possible interpretations; human judgment determines confidence and significance; uncertainty can trigger additional agentic evidence collection. |
1.5.14. Threat Escalation and Incident Response Handoff
A threat hunt may uncover evidence requiring formal incident response, containment, forensic investigation, remediation, or other defensive action. Human skills are important for determining when escalation is justified, communicating investigative confidence, explaining affected assets and likely adversary behavior, and coordinating with response teams. Agentic skills can organize evidence, generate preliminary incident summaries, construct timelines, identify affected entities, and prepare structured handoff information.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Determine escalation thresholds, evaluate potential impact, communicate investigative findings, and coordinate response activities. | Consolidate evidence, prepare timelines and summaries, identify affected entities, and organize handoff information. | AI can prepare structured escalation evidence; human judgment determines whether and how escalation occurs; response findings can subsequently become new inputs for continued hunting. |
1.5.15. Detection Engineering and Defensive Improvement
Threat hunting findings can reveal weaknesses in existing alerts, detection rules, monitoring coverage, telemetry collection, and security controls. Human skills are important for deciding which findings are generalizable, evaluating detection trade-offs, and determining whether new controls will meaningfully improve defense without creating excessive noise. Agentic skills can convert validated hunt patterns into candidate detection logic, compare findings with existing rules, identify coverage gaps, generate preliminary analytics, and analyze resulting detection performance.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Determine which hunt findings should become persistent detections, evaluate trade-offs, and validate defensive improvements. | Generate candidate detection logic, compare existing coverage, identify gaps, analyze rule performance, and organize improvement opportunities. | Validated human findings can be translated into candidate detections by AI; human evaluation refines them; subsequent detection results can provide evidence for further agentic optimization. |
1.5.16. Threat Hunt Documentation and Reporting
Threat hunt documentation records hypotheses, scope, data sources, queries, evidence, findings, conclusions, unresolved questions, and recommended defensive actions. Human skills are important for determining the significance of findings, communicating uncertainty, distinguishing evidence from inference, and presenting conclusions appropriate to technical and nontechnical audiences. Agentic skills can consolidate investigative records, generate preliminary timelines and summaries, structure reports, normalize terminology, and maintain links among evidence and conclusions.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Interpret findings, communicate confidence and uncertainty, validate conclusions, and explain security implications to relevant stakeholders. | Consolidate hunt records, prepare timelines, structure reports, summarize evidence, and maintain relationships among findings and supporting information. | AI can prepare documentation throughout the hunt; human review validates investigative meaning and conclusions; corrections can update subsequent agentic reporting. |
1.5.17. Cross-Functional Cybersecurity Collaboration
Cyber threat hunters collaborate with security operations, incident response, digital forensics, threat intelligence, detection engineering, vulnerability management, security engineering, network and cloud teams, and other technical stakeholders. Human skills are central to communicating investigative context, resolving disagreements, coordinating responsibilities, and determining how findings should affect defensive activities. Agentic skills can summarize discussions, maintain shared investigative context, track actions, retrieve supporting evidence, and identify unresolved questions.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Coordinate security teams, communicate investigative context, resolve disagreements, clarify responsibilities, and guide collaborative decisions. | Summarize discussions, track actions, retrieve evidence, identify unresolved questions, and maintain shared investigative context. | AI-maintained context can support cross-functional collaboration; human decisions and new evidence can continuously update subsequent agentic work. |
1.5.18. Threat Hunting Process and Coverage Improvement
Threat hunting effectiveness depends on continuously improving hunt methodologies, telemetry coverage, analytical techniques, hypothesis quality, investigation efficiency, and the conversion of findings into persistent defenses. Human skills contribute judgment about hunt value, investigative quality, coverage priorities, and practical improvements. Agentic skills can analyze previous hunts, recurring findings, false positives, investigation duration, telemetry gaps, detection outcomes, and unresolved cases to identify patterns and improvement opportunities.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Evaluate hunt effectiveness, establish improvement priorities, assess coverage weaknesses, and determine practical methodological changes. | Analyze hunt histories, false positives, telemetry gaps, recurring findings, and investigation outcomes to identify improvement opportunities. | AI can identify patterns across previous hunts; human judgment selects meaningful improvements; implemented changes generate new evidence for continued evaluation. |
1.5.19. Cybersecurity, Adversary, and Threat Hunting Knowledge
Cyber threat hunters need current knowledge of operating systems, networks, cloud technologies, identity systems, endpoint behavior, security telemetry, attack methodologies, adversary tactics, forensic concepts, detection techniques, vulnerabilities, threat intelligence, and evolving defensive technologies. Human skills contribute accumulated technical experience, adversarial intuition, contextual understanding, and the ability to apply knowledge to unfamiliar investigative situations. Agentic skills can retrieve, summarize, compare, and organize authorized technical, vulnerability, adversary, and defensive information according to the current hunt.
| Human Skills | Agentic Skills | Dynamic Human–Agentic Interaction |
|---|---|---|
| Develop cybersecurity expertise, adversarial intuition, investigative knowledge, and the ability to apply technical understanding to unfamiliar threat activity. | Retrieve, filter, summarize, compare, and organize cybersecurity, adversary, vulnerability, and threat-hunting information. | AI can continuously surface relevant technical and threat knowledge; professional interpretation determines its investigative relevance; new findings can guide further agentic retrieval. |
1.6. Human–Agentic Involvement Across Cyber Threat Hunting
The relative involvement of human and agentic skills differs among responsibilities and among the tasks within each responsibility. The following matrix therefore represents common tendencies rather than fixed assignments.
| Responsibility | Typical Human Involvement | Typical Agentic Involvement | Common Interaction Pattern |
|---|---|---|---|
| Threat Hunting Strategy and Hunt Planning | Very High | High | Human-led planning with agentic analytical support |
| Hunt Hypothesis Development | Very High | High | Human adversarial reasoning with agentic hypothesis expansion |
| Threat Intelligence Analysis and Application | High | Very High | Agentic intelligence processing with human interpretation |
| Security Telemetry Collection and Preparation | High | Very High | Agentic data preparation with human visibility assessment |
| Hunt Query and Analytical Logic Development | High | Very High | Agentic query generation with human investigative validation |
| Endpoint Threat Hunting | Very High | Very High | Iterative agentic analysis and human interpretation |
| Network Threat Hunting | Very High | Very High | Agentic telemetry analysis with human contextual reasoning |
| Identity and Account Behavior Hunting | Very High | Very High | Agentic anomaly detection with human interpretation |
| Behavioral Baseline and Anomaly Analysis | High | Very High | Agentic behavioral analysis with human contextual validation |
| Adversary Tactics, Techniques, and Procedures Analysis | Very High | High | Agentic mapping with human adversarial reasoning |
| Indicator and Artifact Investigation | High | Very High | Agentic evidence correlation with human significance assessment |
| Attack Path, Persistence, and Lateral Movement Investigation | Very High | Very High | Iterative human–agentic reconstruction |
| Compromise Assessment and Evidence Evaluation | Very High | High | Agentic evidence organization with human investigative judgment |
| Threat Escalation and Incident Response Handoff | Very High | High | Human-led escalation supported by agentic evidence preparation |
| Detection Engineering and Defensive Improvement | High | Very High | Agentic detection development with human validation |
| Threat Hunt Documentation and Reporting | High | Very High | Agentic documentation with human investigative validation |
| Cross-Functional Cybersecurity Collaboration | Very High | Medium–High | Human collaboration supported by persistent AI context |
| Threat Hunting Process and Coverage Improvement | High | High | Agentic pattern analysis with human prioritization |
| Cybersecurity, Adversary, and Threat Hunting Knowledge | Very High | High | Continuous agentic retrieval and human application |
1.7. Why the Division of Work Changes
The boundary between human and agentic participation can change from one hunt, hypothesis, suspicious event, investigative lead, task, or subtask to another.
| Allocation Factor | Effect on Human–Agentic Work |
|---|---|
| Investigation complexity | Complex hunts involving multiple systems, identities, techniques, or incomplete attack paths may require greater human investigative reasoning and iterative agentic analysis. |
| Potential consequence | Findings suggesting active compromise, privileged access, data loss, destructive activity, or other significant threats require stronger human validation and escalation judgment. |
| Telemetry availability | Agentic analysis depends on sufficiently complete, relevant, timely, and authorized endpoint, network, identity, cloud, application, and security telemetry. |
| Data quality | Incomplete, inconsistent, noisy, incorrectly normalized, or poorly contextualized security data can reduce analytical reliability and increase human review requirements. |
| Model capability | More capable models may perform increasingly sophisticated correlation, query generation, evidence analysis, and investigative reasoning. |
| Agentic skill availability | Specialized skills for log analysis, threat intelligence, behavioral analytics, query development, evidence correlation, and other hunting activities determine what can be delegated effectively. |
| Tool access | Access to SIEM, endpoint telemetry, network monitoring, cloud logs, security analytics, threat intelligence, scripting environments, and other authorized tools expands agentic capability. |
| Output reliability | Unsupported correlations, weak hypotheses, false positives, or technically incorrect interpretations require human validation or reassignment. |
| Intermediate findings | New indicators, anomalous behavior, compromised accounts, suspicious hosts, or additional intelligence can immediately change hunt scope and investigative priorities. |
| Adversary sophistication | Attackers using novel, evasive, low-and-slow, or legitimate-tool-based techniques may require greater human creativity, contextual reasoning, and adversarial thinking. |
| Environmental context | Normal behavior differs among organizations, systems, users, applications, and infrastructure, making contextual understanding important for interpreting anomalies. |
| Authority and accountability | AI capability does not itself provide authority to declare compromise, initiate consequential containment, authorize disruptive actions, or make final risk decisions. |
These factors can operate simultaneously. A high-volume telemetry-analysis task may be largely agentic under well-understood conditions, while a subtle behavioral anomaly associated with a potentially sophisticated adversary may immediately shift the investigation toward human-led reasoning and repeated human–agentic collaboration.
1.8. Developing Cyber Threat Hunting Capability with Agentic AI
The increasing availability of agentic skills does not eliminate the need for traditional threat-hunting expertise. Adversarial thinking, cybersecurity knowledge, technical intuition, hypothesis development, investigative reasoning, contextual interpretation, evidence evaluation, creativity, persistence, and risk judgment remain important because they allow the cyber threat hunter to determine what should be investigated, recognize when apparently legitimate activity may conceal malicious behavior, evaluate uncertain evidence, and determine whether findings represent meaningful security threats.
Professional capability increasingly also includes the ability to delegate suitable analytical subtasks, provide appropriate investigative context, connect agents with authorized telemetry and tools, evaluate generated hypotheses and queries, recognize unsupported correlations, request deeper analysis, redirect investigations, combine evidence from multiple agentic activities, and determine when direct human or specialist intervention is necessary. Competence therefore includes not only performing hunts directly but also orchestrating how investigative work should be distributed across available human and agentic capabilities.
This creates a broader model of professional capability:
Professional Capability = Human Skills + Agentic Skills + Human–Agentic Coordination
The proportions of these components will differ across hunts and responsibilities and will continue to change as models, adversary techniques, security telemetry, analytical tools, defensive technologies, and cybersecurity practices evolve.
1.9. The Evolving Boundary Between Human and Agentic Skills
The relationship between a cyber threat hunter and Agentic AI is best understood as an adaptive division of work rather than a fixed separation between human tasks and AI tasks. Agentic skills may perform substantial portions of telemetry processing, log analysis, threat intelligence retrieval, event correlation, behavioral comparison, query generation, evidence organization, indicator investigation, documentation, and continuous analytical monitoring. Human participation becomes especially important when hunting requires novel hypotheses, adversarial creativity, interpretation of environment-specific behavior, reconstruction from incomplete evidence, evaluation of competing explanations, assessment of uncertain findings, or consequential decisions about compromise and escalation.
The resulting arrangement is therefore an adaptive human–agentic workflow. A cyber threat hunter may formulate an initial hypothesis, AI may translate it into multiple searches and analyze large volumes of telemetry, the hunter may interpret an unexpected behavioral pattern, AI may then correlate that pattern across additional systems and identities, and the hunter may subsequently determine whether the accumulated evidence justifies escalation or another investigative direction. The allocation can change repeatedly as new telemetry is retrieved, hypotheses are rejected, anomalous behavior is discovered, threat intelligence changes, additional assets become relevant, or evidence increases or decreases confidence in a suspected compromise.
The long-term value of Agentic AI in cyber threat hunting therefore lies not only in accelerating searches through security data. It lies in expanding the investigative capabilities available to the cyber threat hunter and enabling them to be dynamically selected, combined, evaluated, and reallocated according to changing threat-hunting requirements. This can improve telemetry coverage, analytical scale, investigative continuity, evidence correlation, hypothesis exploration, detection improvement, and responsiveness while preserving the adversarial reasoning, contextual understanding, and professional judgment required to identify sophisticated threats that automated defenses may otherwise fail to surface.