liveBook · Manning

Maturity level

As explained in Cyber Threat Hunting

A measure of how developed and capable an organization’s threat-hunting practices are.

A maturity level measures how developed and capable an organization’s threat-hunting practice is. Five levels range from Initial to Optimizing, with higher levels representing stronger capabilities. section 2.8.1

The five-level model progresses through these capabilities:

  • Initial: relies mainly on security monitoring and detection tools; hunting is little, nonexistent, or infrequent and ad hoc. section 2.8.1
  • Managed: establishes the practice, assigns a threat-hunting role, and conducts ad-hoc searches through senior analysts. section 2.8.1
  • Defined: formalizes the process, creates a dedicated team, uses searches and statistics, and connects hunting with threat intelligence and monitoring. section 2.8.1
  • Quantitatively Managed: conducts regular hunts with advanced analytics, broad data access, situational awareness, and metrics that drive improvement. section 2.8.1

Organizations may span levels across capabilities. A weighted score calculator handles these mixed profiles, giving greater importance to regular expeditions and situational awareness than to formally defining the hunter role. section 2.8.2

Assessing and improving a practice

Review current capabilities, score the organization, identify gaps, recommend improvements, and create a three-year roadmap showing the target maturity level for each year. Collect relevant artifacts and interview the people involved. section 2.9 section 2.10

How Cyber Threat Hunting covers it

How deep it goes
Defines five capability levels and adds a weighted calculator for organizations whose capabilities span multiple levels.
Examples
Uses capability tables, a weighted score calculator, a sample scored organization, and a three-year improvement roadmap.
What you can do after
Evaluate a threat-hunting practice, recommend improvements, and plan target maturity levels across three years.
How it connects
Connects threat hunting with security monitoring, threat intelligence, threat modeling, risk management, analytics, and situational awareness.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.