NUURBY:// Technologies

How Do Security Experts Catch Hackers?

Security experts are a bit like detectives — except instead of footprints and fingerprints, they look for patterns in data that don't quite add up.

Looking for Patterns, Not Just Alarms

A single failed login isn't suspicious — everyone mistypes a password sometimes. A hundred failed logins from a new location in ten seconds is a completely different story. Most of the time, this kind of anomaly is caught by automated systems reacting to endpoint alerts — according to the SANS 2025 SOC Survey, 85% of security operations centers primarily trigger their incident response from endpoint alerts, rather than from analysts proactively going looking for trouble.1

Comparing Against Known Threats

Security tools maintain lists of known-bad indicators — malicious websites, suspicious file patterns, known attacker infrastructure — and compare new activity against them automatically. This handles the well-understood, previously-seen threats efficiently, and it's the backbone of most day-to-day detection. But it has a fundamental limitation: it can only catch what's already been seen and catalogued somewhere. Anything genuinely new — a fresh technique, a never-before-seen piece of malware — slips right through a purely comparison-based system, no matter how comprehensive the list is.

How Most Incidents Actually Get Found
Comparison — SOCs' primary detection trigger vs. incidents found by hunting specifically
In more technical terms
Threat hunting
Proactively searching for signs of compromise instead of waiting for an alert — it assumes an attacker may have already bypassed automated defenses and actively looks for them.
TTPs (Tactics, Techniques, and Procedures)
The behavioral patterns an attacker actually uses — hunters focus on these rather than specific indicators of compromise, since TTPs are much harder for an attacker to simply change.
Hypothesis-driven investigation
Starting a hunt from an educated guess about attacker behavior, then testing that guess against real log data — a structured, almost scientific approach rather than a random search.
Dwell time
How long an attacker sits inside a system undetected — the entire purpose of threat hunting is to shrink this number by finding what automated tools missed.

Starting From a Hunch, Then Testing It

Real threat hunting isn't a random search through logs hoping something jumps out — it's structured, almost like a scientific method. A hunter starts with a hypothesis: maybe "if an attacker got in through a phishing email last week, they'd likely have tried moving to a second machine by now." That hypothesis then gets tested directly against 30-plus days of real log data, not guessed at. If the evidence supports it, the hunt escalates into a full investigation; if it doesn't, the hunter's understanding of what's normal gets sharper anyway, which makes the next hunt more effective too.

Digging Into the Evidence

When something looks suspicious, experts trace it back: where did it come from, what did it touch, has this happened before? This is called an investigation, and by volume, it accounts for a genuinely small share of how incidents are actually found — Expel's 2026 Annual Threat Report found only about 2% of the incidents it investigated in 2025 were surfaced specifically by threat intelligence and hunting teams.2 But that small percentage represents outsized value: hunting exists specifically to catch what automated detection was built to miss, meaning that 2% often represents the most sophisticated, most dangerous intrusions — the ones patient enough and quiet enough to avoid tripping any automated alarm at all.

Getting Faster Every Time

Every real incident teaches something — a new pattern to watch for, a gap to close — which is why security genuinely does get stronger over time, not weaker. AI-assisted tools are now compressing that learning curve dramatically on the technical side: one security director reported that hunts which previously consumed up to 40 hours of manual analyst work now compress to roughly one hour with AI-augmented hunting tools.3 That's not a marginal efficiency gain — it's the difference between hunting being a rare, resource-intensive luxury and something a team can genuinely do continuously.

AI-Augmented Hunting Compresses Investigation Time
Comparison — hours of analyst time per hunt

The Human Side of the Job

None of this happens without genuinely skilled people, and that's currently the field's biggest bottleneck, not the technology. ISC2's 2025 research found 88% of organizations experienced at least one significant cybersecurity event they attributed specifically to skills deficiencies on their team, while 48% of cybersecurity professionals separately reported feeling exhaustion just trying to keep up with the pace of new threats and technology.4 Catching sophisticated attackers takes real expertise and real bandwidth — and right now, the industry has a meaningful shortage of both.

The Skills Gap Behind the Detection Gap
Comparison — organizational impact and professional strain

What This Actually Means for You

Catching sophisticated attackers isn't magic — it's a combination of automated systems handling the known and well-understood, and skilled people specifically going after everything automation was never going to catch on its own. Neither half works well without the other, and that combination is exactly why "cybersecurity" has grown into a genuine profession rather than something a single tool can fully automate away. A few practical takeaways:

Sources
  1. SANS 2025 SOC Survey, cited via torq.io
  2. Expel 2026 Annual Threat Report, cited via expel.com
  3. Dropzone AI launch announcement, March 2026, cited via dropzone.ai
  4. ISC2, 2025 research, cited via dropzone.ai

This is exactly what NUURBY's threat hunting workspace is built for — giving a real analyst the tools to dig in and connect the dots, the same way a professional would.