Understanding Threat Hunter Personas

You might ask: "Why should I understand threat hunter personas? What benefits will it bring me?" Surprisingly, they do a lot! As mentioned in a previous post, threat hunter research identifies four fundamental people within the industry. Each persona highlights various skill sets and approaches within the threat hunting community, emphasizing both technical intelligence and strong interpersonal skills. These individuals can help convey important needs of threat hunters to the supporting communities and organizations. Personas bring the threat hunter role to life.

This is the sixth article in my ongoing "The Rise of the Threat Hunter" blog series. For more information about the series, check out the intro here or read last week's article titled "The Challenges of Being a Threat Hunter". If you haven't checked out the full report, I strongly recommend you do so! This blog series doesn't do justice to the details of the report.

Meet the Characters

Let's start with a general overview of each personality. Detailed personas can be found from page 11 of the UVic Report.

Olivia: Creative Team Leader

Traits: Collaborative, Creative, Curator of Tool Sets
Role: Olivia is a creative team leader who proactively hunts and leads her team, curating tool sets. Her creativity and leadership skills make her an invaluable asset in developing innovative solutions and fostering a collaborative environment.
Why Olivia Matters: Olivia's ability to effectively curate tool sets and lead her team ensures that threat hunting efforts are both efficient and effective. Her proactive approach helps predict and reduce threats before they escalate.

Jay: Analytical Automation Expert

Traits: Analytical, Problem Solver, Automation Expert
Role: Jay represents the new entrant in threat hunting who approaches it with a problem-solving mindset and strong academic foundation, knowledgeable in analytics and automation.
Why Jay Matters: Jay's expertise in automation reduces manual workload, allowing the team to focus on more complex tasks. His analytical skills ensure threats are thoroughly investigated and mitigated.

Thomas: Experienced Cyber Space Cowboy

Traits: Experienced, Intuitive, Self-Taught
Role: Thomas is an experienced, self-taught threat hunter often referred to as a "Cyber Space Cowboy," who uses his intuition and vast experience to identify threats in smaller teams.
Why Thomas Matters: Thomas's extensive experience and intuition are crucial for overcoming complex threats. His self-taught background provides a unique perspective that complements the team's overall strategy.

Ren: Manager and Customer Relations Expert

Traits: Good Communicator, Customer Relations, Manager
Role: Ren embodies the management role that oversees threat hunting teams, facilitates effective communication and collaboration, and maintains connections with customers and organizational leadership. Although not directly involved in daily threat hunting, Ren's role is crucial for ensuring smooth communication and coordination.
Why Ren Matters: Ren's ability to manage customer relations and internal communication ensures that the threat hunting team has access to the support and resources they need. His strategic oversight helps align the team's efforts with organizational goals.

Using Personas to Build a Stronger Threat Hunting Team

Understanding Strengths and Weaknesses: Team leaders can assign roles that align with individual strengths and weaknesses by identifying each persona's unique attributes. For example, Olivia's leadership and creativity can be used for team coordination and innovative problem-solving, while Jay's analytical skills and automation expertise can be utilized for data analysis and tool development.

Improving Collaboration: Understanding each person's different work styles and communication preferences can improve team dynamics. Encouraging open communication and regular feedback helps ensure that all team members, from experienced Thomas to new Jay, feel valued and understood.

Targeted Training and Development: Personas can guide the creation of personalized training programs. Providing advanced forensic training for Thomas could enhance his intuitive hunting style, while offering leadership workshops for Olivia can further develop her team management skills.

Optimizing Resource Allocation: Understanding each person's specific needs and preferences enables better resource allocation. Ensuring that each persona has access to the necessary tools and support can increase productivity and job satisfaction. For example, providing Jay with the latest automation tools can boost his productivity and innovation.

Building a Balanced Team: Combining different personalities with their diverse skills and perspectives creates a more balanced and flexible team. This diversity enables the team to effectively handle a wide range of threats, from proactive threat detection to effective incident response.

Using Personas to Create Better Tools

Cybersecurity is a Delicate Balance: Cybersecurity analysts face the overwhelming weight of case load, requiring a delicate balance of human capital, detection logic, orchestration, and automation to respond efficiently and effectively. Specialized tools that automatically detect and mitigate threats within the system address only part of the battle—the known patterns. The other half involves constantly changing, unpredictable unknown threats. Threat hunters are the ones who catch what these tools miss. Until new threats are discovered, understood, and attack vectors are connected by threat hunters, these cannot be integrated into future detection and response systems or automated to reduce noise and improve security posture.

Better Equipment Starts with Athletes, Not Shoes: Personas go beyond helping form better teams; they are also an important tool for guiding the development of relevant and effective cybersecurity solutions. Like digital rock climbers, threat hunters choose a path through data mountains and catch the smallest signal anomalies. As digital athletes who scale cliffs, threat hunters perform with historically designed equipment that has limited understanding of their unique challenges and working styles. Comprehensive knowledge about organizational challenges, tool issues, physical and mental limitations, as well as awareness of team dynamics, personal motivation, and individual style contributes to the emergence of solutions that enable more efficient time and energy savings. Without a complete picture of what threat hunters are, vendors cannot provide cybersecurity solutions that make threat hunters exceptional in their own disciplines.

Our cybersecurity design and engineering teams at OpenText use this and other valuable data from personas to create cybersecurity tools that improve the end-user experience and enable threat hunters to detect and stop threats faster than ever before.

Different but Diverse: While the current research highlights a range of threat hunter personas, this is only the beginning of understanding what modern threat hunting looks like. Many educational backgrounds, career paths, and experiences across various industries highlight the importance of diversity. Having team members with skills such as analytical thinking, critical thinking, attention to detail, logical reasoning, knowledge and experience, and adaptability unlocks the key to enabling teams to overcome challenges and creatively and skillfully uncover hidden threats.

In Conclusion

Understanding threat hunter personas is not just about creating more effective teams; it's about forming a comprehensive framework that supports and develops the abilities of those on the front lines of cybersecurity. Organizations can better allocate resources, tailor training programs, encourage a collaborative environment, and create solutions that maximize each team member's strengths.

Not all threat hunters wear the title, and most have additional responsibilities that reflect a variety of roles often overlapping with threat detection and response. Chief Consultant, Platform Engineer, Security Engineer, Technology Leader, and even CISO wear many hats. As a security consultant once told me, "We're all a bit of hunters."

Learn More About OpenText Cybersecurity

Ready to empower your threat hunting team with products, services, and training that help protect your most valuable and sensitive information? Explore our comprehensive cybersecurity portfolio for a 360-degree visibility across endpoints and network traffic to proactively identify, prioritize, and investigate threats. View our Cybersecurity Portfolio.

Source: Understanding Threat Hunter Personas - OpenText Blogs