Excited to welcome Sydney Marrone to TCP! She’s Head of Threat Hunting at Nebulock, a former Principal Threat Hunter at Splunk, and co-founder of THOR Collective Dispatch.
Her research, frameworks, and open-source work are helping make threat hunting more effective and accessible. For this piece, we landed on Maslow’s hierarchy as a way to explore the building blocks of effective agentic hunting. Sydney breaks down how telemetry, guardrails, and context help teams turn that potential into practice.
Every security program I talk to wants AI in the SOC now, not eventually. Detection engineering that drafts its own rules, hunting that generates its own hypotheses, incident response that starts before anyone reads the page. None of that is unreasonable. But almost none of those programs have re-architected the SOC lifecycle to support it.
This piece is narrow on purpose. Not AI across the whole SOC, but the specific question of whether your foundations can support an agent that hunts in your environment. The thesis is uncomfortable and simple: deploy AI on shaky SOC foundations and you don’t get a force multiplier, you get an amplifier for every gap you were quietly compensating for. That gap isn’t a model problem. It’s an instrumentation problem.
The stack most teams are about to hand an agent was built for humans who quietly compensated for its gaps: analysts knew JHOPPER and jhopper@corp were one person, and that the build server runs powershell.exe thousands of times a day. That knowledge lives in people, not pipelines. Agents inherit the environment exactly as it was recorded, and reasoning, however good, can’t manufacture ground truth the pipeline never captured.
So the failure doesn’t look like a model failure. An executive’s laptop gets quarantined mid-board presentation, and the SOC is scrambling to explain why the ”autonomous” system just blocked the CFO. Nothing was compromised. The agent did exactly what it was built to do, in an environment that couldn’t support it.
That’s the whole argument. Agentic systems don’t compensate for missing foundations, they amplify them. Deploy an agent on a weak SOC and the weakness doesn’t stay hidden; it compounds:
Inconsistent telemetry becomes confident false correlations.
Weak baselines become alert storms nobody can triage.
Missing context becomes reasoning built on gaps the agent can’t see.
No hunt memory becomes the same ground re-covered every week.
Unscoped actions become production incidents with an executive audience.
An AI agent goes from threat hunter to threat generator the moment you deploy it on top of a program that wasn’t ready for it.
Threat Hunting in 2026
Threat hunting in 2026 is the same discipline it has always been: proactively searching for adversary behavior your automated detections were never built to catch. What changed is the terrain. Telemetry volume, identity sprawl, and the speed of cloud and SaaS have all outgrown the human capacity to hold context across a shift, let alone across a quarter. The job used to be one analyst with a hypothesis and a query window. It’s becoming one analyst, a hypothesis, and a decision about how much of the search to hand to a system that doesn’t get tired and doesn’t forget what it looked at last week.
Good hunting in 2026 doesn’t chase indicators, it chases behavior. A hash is trivial to rotate and an IP is cheaper still, but the way an adversary moves laterally, escalates privilege, and establishes persistence is expensive for them to change. That’s the top of the Pyramid of Pain, and it’s where good hunting has always lived, because it’s the layer signatures can’t express and the layer that actually costs an attacker something. A good program hunts there deliberately, with telemetry it trusts and a sense of what normal looks like, so the behavior that matters stands out from the behavior that’s just Tuesday.
Which is the whole problem. That behavioral layer is exactly where an agent either accelerates a good program or amplifies a weak one, and which one it does is decided entirely by what’s underneath it. That’s what the pyramid is for, and it’s what ATHF operationalizes.
Maslow’s Hierarchy Applied to Agentic Threat Hunting
Maslow’s Hierarchy of Needs is a useful borrowed frame because security programs get the bottom of it wrong in the same way people do. A person deprived of sleep and safety does not self-actualize through effort, and a program without normalized telemetry does not reach autonomous hunting through ambition. The prerequisites aren’t motivational. They’re structural.
The Agentic Threat Hunting Framework (ATHF) describes the operational path. Maslow explains why the order is non-negotiable.
One caveat, because maturity models invite the wrong kind of ambition: most teams should live at L1 and L2. L2 is where the compounding starts, because that’s where your hunting history is written down and searchable, and a program that parks there permanently is healthy, not stalled. Climbing a level because the level exists is how you end up quarantining an executive mid-board-presentation.
Telemetry, the agent’s senses
Maslow: physiological. ATHF: L0 to L1.
For humans, telemetry is data. For agents, telemetry is perception. An agent with inconsistent logs and unresolved identities isn’t cautious. It’s confident, reasoning fluently about a world that doesn’t exist.
A financial services team I know deployed agentic EDR before standardizing identity fields. One employee appeared in the telemetry three ways, JHOPPER, jhopper@corp, and Jane.Hopper, with nothing in the pipeline stitching them back to one person. To the agent, that read as three principals moving in concert across the environment, which is a genuinely alarming pattern if you trust your own data. The point isn’t that the model is too literal to guess they’re the same human. A capable model might. The point is that a guess is all it has. The identity resolution was never captured, so no amount of reasoning recovers it; the agent either fabricates the link or fabricates the threat, and both are wrong in a way that looks confident. Reasoning cannot manufacture ground truth the environment never recorded.
The work at this layer is unglamorous, and it’s where most programs underestimate the effort. Two kinds of work live here: normalizing what you have, and making sure the signals exist at all.
Normalization:
Identity stitching across sources, so one human is one principal.
Timestamp normalization, so events order correctly across systems.
Schema contracts, so a field doesn’t silently change shape.
Host naming that survives a re-image.
The signals themselves:
Process execution with full command lines.
Network flows with process attribution.
Authentication events carrying source and destination.
File access tied to an actor.
If your analysts struggle to answer basic operational questions with data, your agents will struggle harder, because an analyst can compensate for a gap by asking a colleague and an agent cannot. At this layer, autonomy is dangerous. Fix perception first.
Guardrails, safety before speed
Maslow: safety. ATHF: L1.
Safety isn’t about slowing agents down. It’s about bounding what they can do while they’re wrong, which they will be. The nighttime quarantine wasn’t an intelligence failure. The agent reasoned its way to a defensible conclusion from bad inputs and then took an action nobody had scoped for it. The failure happened at design time, in a conversation that never occurred. The question was never whether the agent would be wrong. It was what the agent is permitted to do while it’s wrong, and who finds out.
That question has a boring, writable answer:
actions: query: unlimited alert: requires_confidence_threshold quarantine: requires_human_approval firewall_modify: forbidden escalation_paths: high_confidence_finding: notify_slack destructive_action_requested: page_oncall
If you can’t answer what the agent may do unsupervised, how you stop it mid-investigation, and who gets paged when it acts, you aren’t ready to find out experimentally.
Baselines, learning what “normal” looks like
Maslow: belonging. ATHF: L2.
Belonging means learning the unwritten rules of a place, the behavioral grammar of your environment. It’s the level where agents stop asking “is this known bad?” and start asking “does this belong here?” That second question is the entire foundation of threat hunting, and you can’t answer it without a baseline.
When a service account that has only ever run rsync and mysqldump on its nightly backup window suddenly launches an encoded powershell.exe, no signature is required and no threat feed has to have seen it before. A service account that never launched an interactive shell just launched one. That’s the finding.
Good baselines produce a class of detection that signatures can’t express, deviations that only mean something relative to what’s normal for this entity:
Temporal: activity on a sensitive account outside its established window.
Process lineage: a parent-child chain that violates how the host normally behaves.
Privilege: escalation outside a change window.
Access: a user or service touching data that doesn’t match its role.
A human analyst notices this eventually. An agent with a real baseline notices immediately. No baseline, no deviation. No deviation, no hunting.
Hypothesis Generation, the agent starts hunting
Maslow: esteem. ATHF: L3.
This is where automation becomes agency. A playbook executes steps someone else chose. An agent at L3 chooses where to look next based on what it doesn’t understand yet.
Traditional hunting starts with a human hypothesis, and agentic hunting inverts that. The agent notices LaunchAgent counts creeping up on a handful of macOS endpoints over thirty days: nothing alerting, nothing obviously malicious, just different from last month. It forms a hypothesis from that drift, possibly persistence staging, and then does what a good hunter does, which is pivot from what changed to what actually executed. The chain it builds looks like this:
Week 1: Three macOS endpoints each carry 2 user LaunchAgents (baseline: 1, installer-signed)
Week 2: New com.update.plist appears, written by a shell rather than a package manager
Week 3: launchd spawns bash, which curls a host never before seen in the environment
Hypothesis: persistence staging → payload retrieval → outbound C2
None of those observations would have paged anyone alone. The sequence is the finding, and sequences across weeks are exactly what humans lose between shifts. This doesn’t remove the analyst. It moves them. The agent surfaces the question; the human decides whether the answer matters, which is a better use of a hunter than writing the fourteenth variation of a query.
Continuous Adversary Modeling, the agent evolves
Maslow: self-actualization. ATHF: L4.
At the top, agents maintain evolving models rather than running fixed logic. The agent documents a novel persistence chain, generates detection logic, ships it, then notices two weeks later that the technique shifted, updates the model, refines the rule, and keeps hunting variants. Detection stops being a quarterly tuning exercise and becomes a living system.
Read that loop again and it stops being threat hunting halfway through. Generating rule logic, shipping it, watching it decay, tuning it: that’s detection engineering, with its own lifecycle and its own memory problem. That’s what the Agentic Detection Engineering Framework (ADEF) is for. ATHF runs hunting through LOCK and answers “is this happening in our environment?” ADEF runs detection through FORGE (Find, Observe, Refine, Govern, Evolve) and answers “how do we codify this so it pages someone?” They’re paired siblings, not a sequence: an agent can’t reason about detections whose rationale was never written down, exactly as it can’t baseline telemetry that was never normalized. Both are memory infrastructure wearing different lifecycles.
Agency Is Earned, Not Deployed
Agents amplify maturity. They don’t create it. You’re ready for basic agentic hunting when your critical assets have telemetry you trust, normal behavior can be baselined, and you have a process for validating what the agent surfaces. You’re not ready when visibility is inconsistent, normal behavior is undefined, or AI is being brought in with the unstated hope that it will fix the program.
The fastest way to know which describes you is to try answering four questions with data rather than opinion:
Show me every PowerShell execution from a web server this month.
What processes typically spawn from this service account?
Which users access this file share, and when?
How many authentication failures is normal for this identity?
If you can’t answer those, your agents can’t either.
Threat hunting has always been about curiosity: the willingness to ask “what if?” and follow the thread. Agentic systems don’t introduce curiosity. They operationalize it. But agents move through a hierarchy of needs the same way people do. Without telemetry they’re blind. Without guardrails they can’t act safely. Without baselines they can’t recognize what belongs. ATHF and LOCK build that foundation on the hunting side, ADEF and FORGE on the detection side. Neither one is the AI. They’re the environment the AI needs to be worth deploying, and you can start building it at L1 tomorrow without deploying a single agent.
Build the foundation first. Then let the agents climb.
Happy hunting!
About the author
Sydney Marrone is the Head of Threat Hunting at Nebulock, SANS course author, co-founder of THOR Collective, author of the Agentic Threat Hunting Framework (ATHF), and co-author of the PEAK Threat Hunting Framework. She is passionate about helping defenders become better threat hunters by turning complex ideas into practical, repeatable techniques. Through open-source research, workshops, and community-driven projects, Sydney builds frameworks and resources that make hunting more structured, collaborative, and effective. Outside of work, she writes for THOR Collective Dispatch, lifts weights, and makes cyber-inspired music with AI.
