Developing detection models through real-world applications of threat intelligence & threat hunting

Most organisations consume threat intelligence as a passive feed and run detection engineering as a reactive backlog. Excite Cyber's closes the gap with a 3-4 week sprint cycle that filters strategic intel against customer technology and industry exposure, validates detection coverage through adversary simulation, executes hypothesis-driven hunts, and feeds results back into customer-specific detection engineering. 

This talk walks the audience through the operating model and the lessons learned from running it across a diverse customer base.

Longer cycles lose relevance against a fast-moving threat landscape; shorter ones don't give hunters depth. The 3-4 week also expedites our speed to iterate. 

Stage 1 - Strategic intelligence triageFiltering intel feeds on two axes: threat actors targeting industries represented in the customer base, and actors targeting deployed technology stacks. 

Stage 2 - The threat actor briefing. What goes into the document passed to the hunt team: TTPs mapped to MITRE ATT&CK, tooling, infrastructure patterns, and crucially — what to look for in the kinds of environments we operate in. Where strategic intel becomes operationally actionable.

Stage 3 - Adversary simulation and coverage gap analysis. The step most hunting programs skip. Simulate the relevant TTPs to map what existing customer toolsets natively detect, partially detect, or miss entirely. The hunt then focuses on what's invisible — because hunting for things your tools already alert on is wasted effort.

Stage 4 - Hypothesis-driven threat hunting. Developing base queries from coverage gaps and threat actor TTPs, and the operating approach for executing hunts across multiple customer environments — handling environmental differences, tuning for noise, and writing repeatable parameterised queries rather than one-off searches.

Stage 5 - Customer-facing findings. What gets reported and how. The distinction between "we hunted for X and found nothing" (still valuable as active assurance evidence) and "we hunted for X and found these anomalies." Framing findings for both technical and executive customer audiences.

Stage 6 - Detection engineering feedback loop. The strategically important stage. Successful hunt queries become detection engineering inputs, building customer-specific detection models from validated hunt logic. Each sprint permanently improves the customer's continuous detection posture — the compounding value that distinguishes proactive defence from one-off hunts.

Stage 7 - Incident response trigger. When hunts find real adversaries, the sprint output becomes an IR engagement. The handoff process, how hunt evidence accelerates IR, and how IR findings feed back into the next sprint's intelligence picture.

Sprint scope creep, intel that turns out to be a dead end mid-sprint, balancing customer-specific work with cross-customer learnings, keeping queries reusable across diverse environments.

Metrics that matter. Beyond vanity metrics like "IOCs ingested." Hunt-to-detection conversion rate, percentage of sprints producing customer-actionable findings, mean time from intel publication to deployed detection, and IR engagements triggered by proactive hunts versus reactive alerts.