October has made a strong case for this year’s Cybersecurity Awareness Month (opens in a new tab) theme, “Securing the Next 250,” chosen in honor of the U.S.’s 250th anniversary. The initiative, started by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA), occurs annually in October to raise awareness about online safety and empower individuals and businesses to protect themselves from cybercrime.
As the nation embarks on the next 250 years, security operations teams need to prepare for a cyber threat environment that is changing rapidly. Attackers are getting faster and quieter. AI is shrinking the window between a vulnerability being disclosed and exploited while attackers are increasingly blending in and moving with greater stealth through their use of legitimate tools, valid credentials, and normal user behavior.
What’s now referred to as “Black October” gave us some live examples. Within a few days, a cluster of disclosures landed, including the critical PHP2Shell flaws (opens in a new tab) that let an unauthenticated attacker run code with a crafted web request and put nearly 70% of websites at risk. Along with the eMudhra CA compromise (opens in a new tab) and HTTP2Shell (opens in a new tab), a critical Brotli flaw, they sent teams scrambling to find and fix their exposures.
Most security teams are not structured to combat these types of threats quickly enough, or they don’t have the tools to get ahead of it. It’s time to change that.
The curse of modern cyber threats
It used to be that threat volume was the biggest problem security teams faced. Now, we've layered speed on top of that. The disclosure-to-exploit window has compressed significantly and 30-day patch cycles are seen as a pre-AI artifact.
AI systems are able to generate working exploits for the large majority of vulnerabilities they find in a fraction of the time a human researcher would need. Additionally, with the help of AI, they’re leaning on real tools and adopting normal user behavior to avoid tripping traditional alerts. They’re blending in because, to our security systems and teams, they look just like us.
They’re abusing cloud accounts and living-off-the-land binaries, things that don’t look like an attack because it’s the same access and tools your own admins and standard users are executing every day. Attackers don’t need malware anymore because, as long as they have one valid credential and the patience to look like a normal user, they’re more likely to go unnoticed.
In cases like we saw with Black October, threat actors are also gaining access through other, assumed safe places, such as the HTTP2Shell in Google’s Brotli library. Threat concerns can also arise when organizations don’t have a single inventory of all their infrastructure devices. With the recent PHP exploit, for example, many organizations were scrambling to find where PHP ran within their systems before they could begin to consider a fix. Additionally, when organizations need to wait for vendor patches to combat active threats, such as with PHP, it can cause longer, more serious vulnerabilities for organizations and their customers.
What compounds the problem is that most security teams are built to react; to first wait for an alert, then investigate. Facing these evolving cyber threats head on requires a more proactive approach.
How to structure security teams to combat modern threats
Reactive models break down the moment attackers stop generating the kind of activity alerts are built to catch. With a proactive mindset, your organization can stay ahead of those threats.
To get there, organizations need three things. First, real-time visibility into your systems and an awareness of what’s in your inventory. Second, a clear baseline of what normal looks like for you, so outliers actually stand out. And third, for cyber threat hunting to be treated like its own discipline, not something the SOC picks up in its downtime. It needs a team whose actual job is hypothesis-driven hunting, not just alert triage.
Teams must assume adversaries are already inside and deny them dwell time. Don’t wait for them to make noise, because in many cases they won’t until it’s too late. AI may be accelerating how fast attackers find and exploit gaps, but it can also make defenders faster if real-time visibility makes its findings trustworthy. Figure out how you can make AI work for you.
At Tanium, we’ve run numerous cyber threat hunts with customers. Often, we trace the noise back to internal deployment tools or a security-tool conflict no one caught. I’ve seen organizations go from over 700.000 unresolved alerts to fewer than 100 a day because a governed hunting engagement moved them from chasing alerts to a continuously hunted view of their environment. Black October gave us even more experience. While organizations were still asking where PHP ran, Tanium HuntIQ provided customers with a fleet-wide inventory sorted by vulnerable version and a behavior hunt for what an attacker would do next.
Security leaders have been on the defensive for so long, but it’s time we switch to offensive as cyber threats get worse. Create a hunting team for your organization and then let them run with it. I think you’ll be amazed at what they find.
It’s a hunt or be hunted world
The world of cybersecurity boils down to if you are hunting or being hunted. With a dedicated team and a clear understanding of your organization’s baseline, you’ll be better prepared to hunt the threats facing your organization. Cybersecurity Awareness Month ends this week, but the threats don’t. When the next emerging threat arrives, you’ll want to already be hunting.
Follow our Hunt or Be Hunted blog series to learn more about how threat hunting can help your organization or chat with one of our experts to get more specific recommendations.
