Business & Technology
How does AI improve the speed of threat hunting?
The introduction of LLM-powered AI SOC platforms is democratising threat hunting by breaking down the technical barriers that have historically limited access to it for senior analysts.
By allowing analysts to translate intent into platform-specific queries using natural, non-technical language, AI eliminates the need for specialised knowledge like Python scripting or proprietary query languages.
Now we know that artificial intelligence can accelerate threat hunting and open it up to a wider set of team members, but exactly how does it achieve this transformation? This article covers exactly how.
Applied to the threat hunting process, AI can:
- Automate evidence gathering
- Suggest where threats can be hunted
- Translate intent into queries
- Provide a reasoning layer that wasn’t there before
- Enable complex, always-on threat hunting
Threat hunting isn’t good enough if it is sporadic, subjective, or based on human timelines: adversaries are attacking at the speed of machines, and AI-enabled ones at that.
Weaving AI deeply into modern threat hunting practices will now only “speed things up,” but change the threat hunting expectation from an occasional benefit to a constant, standard practice.
1. Automating Evidence Gathering (& Saving SOC Cycles)
At the start of a threat hunt, one looming barrier stands in the way: gathering evidence. For the typical SOC, this means toggling between a half dozen tools, taking screenshots, and compiling the case.
With AI, security operations automation becomes a reality. As leading AI SOC platform company Prophet Security explains, “Once a hunt starts, [an AI SOC solution] pulls logs, events, and metadata from integrated sources without requiring the analyst to query each one manually.”
Without the use of AI, this process can take up to an hour with manual investigative querying processes alone: across SIEM, EDR, email, IAM, etc. With AI, that timeline is reduced to less than 20 minutes.
2. Suggesting Threat Hunts: Getting to What Matters
However, before evidence can even be gathered, analysts need to know what they’re hunting: the hypothesis.
Not all SOCs are equipped with the same technical expertise or the same amount of time to do a hunt. The status quo is that threat hunting is currently a proactive measure; something done to stay ahead of threats missed by detection rules and done as a hygienic best practice. Otherwise, threat hunting is a strictly reactive procedure as part of the incident response process, and typically done in response to a recent breach or an upcoming audit.
Either way, feeling ahead of the game or behind it still makes threat hunting seem “special.” The end goal is to make it seem standard.
And neither scenario leaves hunters with all that much time to carefully choose where to start, or what to pursue. With so many possible signals, any one of them could lead to a wider issue – or to a dead end. Getting hours into a hunt only to realise the road leads nowhere is a waste of time and money, and every threat hunter knows the feeling.
AI can suggest the threats worth hunting before anyone even starts looking at the signals. By ingesting telemetry from across all integrated tools (EDR, identity logs, network traffic, SIEM), it creates a baseline of normal behaviour.
When something deviates from normal behavior, it can go one step further by mapping to known attacker techniques (MITRE ATT&CK), and then form a hypothesis about what could be wrong.
Most importantly, not all hypotheses are created equal. AI knows this. It ranks hypotheses by criticality (asset criticality, privilege level, likelihood) and presents hunters with a ranked list: not a best-guess, intuition-inspired direction.
Then, all analysts have to do is ask the right questions.
3. Translating Intent into Queries: No Coding Required
Currently, when analysts want to query systems, they have to speak the respective language. With AI, Large Language Models (LLMs) do this technical heavy lifting for threat hunters. In an AI SOC, even a junior analyst can type in a simple request:
“Where else across the environment was this (flagged) IP seen?”
And AI will use natural language processing to translate the plain-language question into platform-specific query languages (SQL, SPL, KQL): no technical interface required. No manual coding. This not only makes “every analyst a threat hunter,” thereby speeding up how many threat hunts can be performed, but it also makes each hunt faster.
Senior analysts can skip the long lines, the reviewing and editing, and the technical learning curves to searches; instead, they can focus on the actual “thinking” part of threat hunting.
Increasingly, AI is doing even that, too.
4. Providing Additional Reasoning, At Machine Speed
Automation-only tools (SOAR, XDR) may correlate events, but the best AI SOC platforms tell analysts why they happened. Agentic AI is behind that.
By providing an additional reasoning layer, analysts can move more quickly and confidently through hunts, having a built-in backup “brain” at each step.
Agentic AI constructs dynamic attack narratives, building an attack graph across users, hosts, processes, and network connections. It processes and correlates context, tying it into the broader story.
After mapping to MITRE ATT&CK, it can show analysts:
- A timeline of the attack
- A likely attack path
- Any missing steps
These missing steps are where threat hunters fill in. It takes teams from raw logs to the structured intent of the attacker, bypassing hours of analysis, toggling, and piecing together clues along the way.
Now, instead of “Suspicious PowerShell execution” alerts, teams get something like: “Suspicious PowerShell on a domain controller by a rarely used admin account after anomalous login.”
Starting there means starting with a significant head start.
5. Enabling Complex, Always-On Threat Hunting for Max Coverage
Another reason threat hunting with AI is faster than threat hunting without it, is that AI never tires. In traditional setups, humans are the head, foot, and tail of threat hunts. They might operate automated tools, but things don’t happen until they’re at the controls.
While most SOCs run 24/7, small teams and even large enterprises understand how hard (and costly) that can be. Your 3 am threat hunting team is not going to be as sharp, savvy, or awake as your 9 am team.
Or, as AI.
AI-enabled threat hunting through an AI SOC means vigilance that never sleeps, tires, or makes mistakes out of exhaustion. Mental powers are never taxed, and help surface signals that may otherwise be overlooked.
Speed Becomes Consistency
AI makes threat hunting faster. And when things are done faster, they can be done more often.
This benefits large enterprises, who, even at their best, may only conduct threat hunting once a week (or once a day for elite achievers).
This benefits mid-tier organisations that hover somewhere between quarterly threat hunts and even-based threat hunts: trying to stay on top of things but having to split analysts between proactive activities and daily tasks.
And it benefits the smallest companies that struggle to even staff a SOC, much less a SOC full of experienced threat hunters.
For all these teams, AI gives them something they never had: round-the-clock threat hunting, done at machine speed, and proactive security that comes standard.
The Takeaway: At a time when AI-driven threats never sleep, AI-driven threat hunting is more than a nice recommendation. It is the new norm for organisations that understand AI attackers aren’t playing by traditional detection rules, and that they will increasingly be found only via ongoing, AI-powered threat hunts.
Blossom Pottery Cafe opened on Friday, August 14 at 18 South Bar, bringing a new artistic opportunity to coffee, tea and cake lovers in the town.
Opening the cafe was a long-standing dream of owner Wendy, who began pottery as a personal hobby and gradually developed the idea of creating a space where people of all ages can enjoy the peaceful pass time.
With every table full on opening weekend and dozens of beautiful pieces newly painted by guests, the owner said her ‘heart is so full’ to see the dream realised.
“So grateful to see so many of you coming to support us on our opening day,” she shared. “Thank you so much.”
Wendy earlier said: “We’re incredibly excited to be opening Blossom Pottery Studio & Café and bringing something new to Banbury.
“We hope it becomes a place where people can take a break from their busy lives, enjoy being creative, and make lasting memories with family and friends.
“The support we’ve received from the local community has been amazing, and we can’t wait to welcome everyone through our doors.”
As part of the grand opening, all customers who visited during the opening weekend or made a pottery painting booking within the next three months received a free cupcake from the cafe.
Blossom Pottery Cafe hosts family-friendly pottery painting sessions from 10am each day, with normal cafe opening hours 8am to 5pm.
Atos highlighted the views of three apprentices entering the technology industry, focusing on apprenticeships as a route into tech as artificial intelligence reshapes workplace skills.
All three work as First Line Service Desk Apprentices and described a jobs market in which technical knowledge alone is not enough. Alongside coding and troubleshooting, they said communication, customer service, problem-solving and adaptability have become central to early careers in IT.
Kyle Brady said he moved into an apprenticeship after studying physics, maths and computer science at A level, then spending time in temporary work, including as a forklift driver, while building his technical skills independently. The apprenticeship, he said, offered a way to gain workplace experience while continuing to learn.
His account points to a common hurdle for new entrants: gaining practical experience before securing a first role. Brady said that challenge shaped his view of what employers value in technology jobs.
“After completing my A levels in physics, maths and computer science, I knew I wanted a career in technology. I’ve always enjoyed solving problems and understanding how things work, but I found it difficult to get my foot in the door. I spent some time in temporary jobs, including as a forklift driver, while building my technical skills in my own time. When the opportunity to start an apprenticeship came along, it felt like the perfect way to gain real workplace experience while continuing to learn.
“One of the biggest things my apprenticeship has taught me is that a career in tech is about much more than technical knowledge. Working on the helpdesk has shown me how important communication, customer service and problem-solving are. Being the first point of contact for users has completely changed how I see the industry and helped me develop skills I never realised I’d need. The experience has also shown me how quickly technology is evolving, especially with AI becoming part of more workplaces. That means the ability to keep learning and adapting is becoming just as important as technical skills. My apprenticeship has helped me build that mindset while giving me hands-on experience with the realities of working in IT.
“It’s also opened up opportunities I wouldn’t have had otherwise. Learning about career paths in cybersecurity and data engineering has shown me the range of opportunities available and given me confidence about where my career could go next. I’d encourage anyone thinking about a career in technology to keep an open mind and not feel like university is the only route. Apprenticeships give you the chance to earn while you learn, develop practical skills from day one and build the confidence to adapt as technology continues to change. In an industry being transformed by AI, that real-world experience is invaluable,” Brady said.
Ryan Cresswell said he studied IT at college and games design at university before working in sales to strengthen his people skills. He later returned to technology, but said employers often wanted practical IT experience as well as qualifications.
His experience reflects a wider issue for people seeking entry-level technology roles. Employers often ask for evidence of workplace readiness even for junior positions, making apprenticeships one way to bridge the gap between education and employment.
“After studying IT at college and games design at university, I began working in sales to hone my people skills before returning to technology. One of the biggest challenges I faced while applying for jobs in tech was that employers liked my qualifications but wanted candidates with hands-on IT experience. That made it difficult to get my foot in the door.
“My apprenticeship has given me the opportunity to earn, learn and gain practical experience at the same time. It’s allowed me to develop my technical troubleshooting skills, but I’ve also learned a lot about communication, problem-solving and handling different types of people. My advice to anyone considering a career in tech is to explore the different paths available. In the past it felt like university was the only choice, but that’s no longer the case. Also, speak to people already working in the industry and stay curious. Apprenticeships are a great way to build skills, confidence and hands-on experience, whether working individually or in a team, while discovering what’s right for you. The most important thing is to keep learning and not be afraid to take a different path if the first one doesn’t work out,” Cresswell said.
Skills shift
Zainab Hussain said she chose an apprenticeship because it offered immediate workplace experience and a path into more senior roles without student debt. She said the role had helped her develop both technical and interpersonal skills, including troubleshooting problems and explaining complex concepts clearly.
Her comments underscore how apprenticeships are being framed by employers and trainees as an alternative to university for some digital roles. In this case, the appeal lies in earning while learning, building professional networks and gaining direct exposure to the daily demands of IT support.
“I’m naturally drawn to tech and have always been IT literate, so I knew it was the right path for me. It’s an industry that’s constantly evolving, and I wanted to be part of that. I chose an apprenticeship because it felt like the best way to gain real experience from day one, and it sets you up to move into higher roles faster than if you go to university. I also wanted to build a career in the industry without taking on student debt.
“My time at Atos so far has helped me develop both my soft and technical skills, such as how to troubleshoot problems and communicate complex concepts clearly. I’ve also had the chance to earn, learn and build my experience, all of which are helping prepare me for the next stage of my career. The apprenticeship path has given me valuable opportunities to network with co-workers from different career backgrounds and skill sets, which you wouldn’t get at uni. The workplace experience has been incredibly valuable, so if you’re interested in tech, I’d encourage you to go for an apprenticeship, explore every opportunity available and keep an open mind,” Hussain said.
Taken together, the three accounts point to a shift in the skills mix associated with junior technology roles. As AI tools become more common in workplaces, the apprentices said the ability to keep learning, work with users and adapt to changing systems is becoming as important as formal technical training.
All three also described apprenticeships as a practical answer to the experience barrier that can prevent candidates entering the sector. They framed the route as a way to gain income, training and exposure to real workplace problems at the same time, while opening paths into areas such as cybersecurity, data engineering and wider IT support.
Liquidators have been instructed to wind down Go Fly Oxford, which provided lessons for commercial and private pilots licences.
Colin Wilson and Emma Mifsud, of Opus Restructuring & Insolvency, have been appointed as joint liquidators for Go Fly Oxford Ltd back in May 2025.
But new records filed by the liquidators have revealed an HMRC secondary preferential claim of £118,132.
Ten unsecured claims have been received by the liquidators totalling £60,314.
Further unsecured creditor claims estimated in the statement of affairs total £88,955, the published documents say.
Over the past year, liquidators say they investigated whether any recoveries could be made from directors or other parties, but concluded there were no further viable assets or claims.
Aircraft shown in the 2024 accounts at a book value of £238,181 had been sold before liquidation. The liquidators found the sales appeared to be at fair value and saw no basis for a claim over the transactions.
The aircraft sales happened about seven months before liquidation, outside the relevant period for a preference claim.
The aircraft were reportedly transferred to creditors and leased back so the company could continue trading.
A purchaser of a PA34-200 aircraft was said to owe £6,000. The liquidators received £4,980; the remaining £1,020 was treated as settled because the purchaser had paid a company liability instead.
Two employees were made redundant on 31 March 2025 and were given information to submit claims to the Redundancy Payments Service.
READ MORE: MOT centre and car shop collapses into administration
The flying school was based at Oxford Airport when it collapsed.
Its website, which has since been shut down, described the business: “At Go Fly Oxford we pride ourselves on offering a personal and tailored approach to pilot training.
“We know that people learn at different paces and in different ways, this makes catering for individual needs our main target.”
Oxford Airport’s main trade is pilot training. Flight schools at Oxford train pilots who go on to fly for more than 100 airlines in the UK and globally, including for British Airways.
Historically, the airport has been Europe’s foremost centre for professional pilot training with well over 40,000 students having started their careers there.
At one point, the airport’s runway was the busiest in the world with more than 235,000 movements a year (a take-off or landing) and up to 1,100 flights in a single day, its website says.
The business’ report says: “Over the course of 2025, the company will be complementing its Diamond DA40 fleet with a new fleet of Elixir aircraft, a safer and more efficient type of aircraft, which will provide a much reduced cost per flight hour.
“This, along with growth in enrolments and full utilisation of the European base will ensure the profitability of the business in the coming years.”
Stage Watch: Award-winning Hadestown to visit Oxford as part of first UK and Ireland tour
Avanti West Coast to be renationalised in March | Rail industry
TfL’s bailiffs are chasing me for a stranger’s unpaid Ulez fines | Low emission zones
-
Oxford united FC1 week agoChris Gunter steps away Wales role to focus on Oxford United
-
Oxford united FC2 weeks agoOxford United transfer chief explains EFL embargo and contract dilemma
-
Oxford News4 weeks agoUK private school’s ‘outstanding’ headteacher is to retire
-
Oxford Events3 weeks agoOxford Open Doors: nine properties to explore without booking
-
Oxford News4 weeks agoSalon Privé at Blenheim Palace 2026 – day one revs up
-
Oxford united FC3 weeks agoLeicester City confirm ‘serious’ injury before Oxford United clash
-
Oxford united FC2 weeks agoFormer Oxford United boss Matt Bloomfield drops Wycombe manager hint
-
Student Life4 weeks agoOxford academics sign open letter opposing Nathan Cofnas’ suspension