--- title: Three Considerations for Measuring Return on Investment from Threat Hunting description: Threat hunting often has ill-defined metrics for organizations attempting to measure “return on investment.” image: https://blog.nisos.com/hubfs/threathuntblog-01.png --- [![NISOS_logo_high_res_horiz-black](https://blog.nisos.com/hs-fs/hubfs/NISOS_logo_high_res_horiz-black.png?width=3357&height=674&name=NISOS_logo_high_res_horiz-black.png "NISOS_logo_high_res_horiz-black")](https://www.nisos.com/) - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) # Blog ## Three Considerations for Measuring Return on Investment from Threat Hunting by [Landon Winkelvoss](https://blog.nisos.com/blog/author/landon-winkelvoss) | Jul 08, 2020 | [Cybersecurity](https://blog.nisos.com/blog/tag/cybersecurity), [threat hunt](https://blog.nisos.com/blog/tag/threat-hunt), [threat intelligence](https://blog.nisos.com/blog/tag/threat-intelligence), [ROI](https://blog.nisos.com/blog/tag/roi) Threat hunting often has ill-defined metrics for organizations attempting to measure “return on investment.” If an analyst isn’t finding bad actors in the environment, leadership may question the value they are bringing. If they are finding a lot of actors, leadership may question how effective they are at their job if incident response is constantly being called for false alarms. Furthermore, questions will arise, depending on how long the actors were present in the network, the severity of the breach and if disclosures need to occur. In almost all of the above scenarios, a threat hunter's job is usually limited by not having enough visibility to make the appropriate detections. In the case of threat intelligence, sometimes there is too much information, which we will cover in forthcoming blogs.  Below are some considerations for level setting expectations and deriving the appropriate metrics for threat hunters. **Create a Coverage Map** After determining the set of actors that are likely to target the enterprise (nation state, criminal groups, hacktivists, insider threat, and script kiddies), create a coverage map for the purpose of identifying collection gaps.  The MITRE ATT&CK framework identifies many tactics and techniques utilized by threat actors. While selecting various TTPs allows an organization to identify and address the gaps that matter, this may not be possible for a couple reasons, mainly:  1. Logging is insufficient 2. Detecting may require a defensive tool that is not in the budget  Therefore, a cyber analytics repository needs to be created. **Use a Cyber Analytics Repository** A Cyber Analytics Repository (CAR) is a catalog of product-specific queries used to hunt TTPs identified in the coverage map.  For example, if an organization uses Splunk, the query will be in SPL. f an endpoint detection and response agent (Endgame, for example) is used, the query will be in EQL, etc.  The CAR may also include use cases from which to create alerting rules. [We shared some thoughts here on how to develop use cases for threat hunting. ](https://blog.nisos.com/white-papers/mi_threat_hunt_operationalized) **Create Metrics Based on Company-wide Actions ** Threat hunting is not just about finding bad actors; it’s about driving threat and risk mitigation in conjunction with security operations, security engineering, risk and compliance, policy and the appropriate business unit.  Threats include malicious or suspicious activity on the network. Risks include coverage gaps, missing logs, or missing alerts. Both should be tailored to an organization's requirements.  It is not enough to discover a threat actor on a network or a coverage gap. Threat hunters must reach out to the appropriate teams in an organization with suggestions on how to remove threats and close gaps.  Further, not all findings will have equal value. For example, discovering an advanced threat actor on a network will have much more value than finding adware on an endpoint. **It is important to define values for findings and to keep track of these values to demonstrate the return on investment that the threat hunt team brings to an organization.** To ensure that findings are addressed, the threat team must track closure. At the end of each quarter, the team can provide these metrics to management. In turn, management can use the metrics as a guide to allocate resources.  For example, the threat hunt team may have discovered risks and gaps that fell under the onus of the security engineering team. By the end of the quarter, if the security engineering team has only actioned a small percentage, management can consider allocating additional resources to that team. --- --- --- - Solutions - [Human Risk](https://nisos.com/solutions/human-risk/) - [Cybersecurity](https://nisos.com/solutions/cybersecurity/) - [Trust and Safety / Platform](https://nisos.com/solutions/trust-safety/) - [Corporate / Physical Security](https://nisos.com/solutions/corporate-security/) - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/insider-threat-intelligence-solutions/) - [Risk Assessments](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape Assessment](https://nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Executive Shield](https://www.nisos.com/services/executive-shield/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Insights® Investigation](https://www.nisos.com/services/adversary-insights/) - [Event-Driven Intel Investigation](https://www.nisos.com/services/event-driven-investigation/) - Why Nisos - [About Us](https://nisos.com/company/about-us/) - [Client Success](https://nisos.com/company/client-success/) - [Our Approach](https://nisos.com/company/our-approach/) - [The Dogpile](https://www.nisos.com/the-dogpile/) - [Team Pandion™](https://www.nisos.com/company/team-pandion/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [Blog](https://www.nisos.com/nisos-blog/) - [Resource Library](https://nisos.com/resources/library/) - [Podcast](https://www.nisos.com/podcasts/) - [News](https://www.nisos.com/news/) - [Events](https://nisos.com/events/) - [Law Firms](https://nisos.com/law-firms/) - [Federal](https://nisos.com/federal/) - [Media Inquiries](https://nisos.com/company/about-us/media-support/) **Contact** [info@nisos.com](mailto:info@nisos.com) tel: [703-382-8400](tel:7033828400) 2101 Wilson Blvd. Suite 304 Arlington, VA 22201 ![Nisos](https://blog.nisos.com/hs-fs/hubfs/Nisos_July2023/images/NISOS_logo_high_res_vert_white@2x.png?width=320&name=NISOS_logo_high_res_vert_white@2x.png "Nisos") [Terms and Conditions](https://www.nisos.com/terms-conditions/) [Cookie Policy](https://www.nisos.com/cookie-policy/) [Privacy Policy](https://www.nisos.com/privacy-policy/) ©2025 Nisos All Rights Reserved ![](https://px.ads.linkedin.com/collect/?pid=1593266&fmt=gif)