Threat hunting is the hypothesis-driven search for intruders that the detections missed. This chapter describes what happens to it when AI proposes hypotheses, drafts and runs queries and clusters anomalies, and it argues that the hunter's scarce contribution is judgement about which hypotheses deserve the data, the compute and the analyst's week. It covers the hunt record, the conversion of findings into detections, the discipline that a hunt which finds nothing still produces a coverage statement, and the risks that come with the new tools: generated queries that are costly or wrong, over-trust in anomaly rankings, and hunts that drift from the threat to the data. It concerns two of the five blue team functions: B1 Anticipate, because a hunt starts from intelligence and from an honest view of where the organisation is exposed, and B2 Detect, because a hunt's lasting product is a detection that did not exist before.
The chapter builds on the finding-to-control discipline of Architecture as Code (Chapter 9C), where threat handling lives in the codebase and findings return as pull requests (61, Nordqvist, 2025), and on AI Red Team, Chapter 26, where every finding from an exercise, a campaign or an incident ends as a verified control, closed only when the re-test passes (64, Nordqvist, 2026). It also takes over the conclusion of The Transformed Security Architect, Chapter 14, that reviewing what AI proposes requires independent reproduction and review that does not start from the AI's answer (66, Nordqvist, 2026). Chapter 5 supplies the hypotheses, Chapter 6 receives the detections and Chapter 11 closes the loop in the purple exercise.
A hunt starts from a statement that can be false. In this book a hunt is a bounded, time-boxed search of defined data for evidence of a named adversary behaviour, started from a hypothesis, run by a named threat hunter and recorded so that the result can be reviewed and repeated. "Look for anything unusual in the identity logs" is not a hypothesis. "A service account used by the claims export job has been used from a host that is not part of the export job's host set, within the last 90 days" is one, because a query can show it to be true or leave it unsupported.
Primary topics explored
- Hypothesis-driven hunting
- Agents as hunting assistants
- The hunt record
- From finding to detection
- Null results
- Cost and safety
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 9: Threat Hunting Transformed: Hypotheses, Data and Agents in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Craft” and is one of 32 drawn from the manuscript.