Threat Hunting Management Workshop: Rethinking Priority

Threat hunting requires a different approach to prioritization than alerts or incident response. This workshop explains why it is not about chasing the most severe threat, but about identifying weak visibility, incomplete detection coverage, and areas of unknown risk. Scott Poley presents a structured method for managing threat hunting as a discovery driven capability that strengthens the overall security program.

The session explores how prioritization often becomes clearer after execution, compares actor focused and technique focused strategies, and shows how hunting improves detection engineering and telemetry coverage. It also outlines a management level framework for measurable coverage tracking and program growth. Participants who complete the workshop and final challenge earn a certification from Intel 471's Threat Hunting Management Program.