The Threat Hunting Maturity Model, Explained Honestly
Use the five-level Hunting Maturity Model to assess your program and choose a realistic next improvement.
“We do threat hunting” can mean anything from searching a vendor IOC list once a month to running a disciplined program that creates and automates original analytics. A maturity model helps replace that vague claim with observable practice.
David Bianco’s Hunting Maturity Model describes five levels, HMM0 through HMM4. It is best used as a diagnostic tool, not a badge. A team can be strong at one level for endpoint data and weaker for identity or cloud data.
The five levels
HMM0 — Initial
The team relies on automated alerts and does not conduct proactive searches. This often reflects capacity or data constraints, not analyst ability.
Evidence you are here: nearly every investigation begins with an alert.
Next move: protect a small, recurring block of time for one tightly scoped hunt and document it.
HMM1 — Minimal
Hunts use externally supplied indicators, such as hashes, domains, IP addresses, or campaign artifacts.
Strength: quick to begin and useful for checking known exposure.
Limitation: indicators expire and usually find threats already identified elsewhere.
Next move: extract the behavior behind the indicator. Ask how the actor obtained execution, persisted, or communicated.
HMM2 — Procedural
The team follows published procedures and technique-based playbooks. This moves beyond fragile indicators toward repeatable adversary behavior.
Evidence you are here: hunts are repeatable, but most hypotheses and procedures originated outside the organization.
Next move: adapt one playbook to local assets, identities, baselines, and risk.
HMM3 — Innovative
Hunters create original hypotheses from local knowledge, risk, observations, and intelligence. The organization can test questions specific to its own environment.
Common constraint: telemetry quality and retention become more limiting than ideas.
Next move: track which hypotheses fail because data is missing, then prioritize the most valuable visibility gaps.
HMM4 — Leading
Successful hunt logic becomes automated, allowing people to focus on new questions. Hunting and detection engineering operate as a continuous feedback system.
Evidence you are here: conversion from validated hunt to tested detection is routine, measured, and maintained.
Next move: review automated analytics so old assumptions and exclusions do not silently decay.
Maturity is not a tooling score
An expensive platform cannot create hypotheses, repair poor ownership, or turn a one-time query into a maintained analytic. Tooling can improve speed and scale, but maturity depends on repeatable behavior:
- protected time for proactive work;
- reliable, understood telemetry;
- documented hypotheses and results;
- local environmental knowledge;
- clear handoffs to incident response; and
- a path from validated hunt logic to durable detection.
How to assess your program
Review the last ten proactive investigations, not the claims in a strategy deck. For each, record its origin:
| Origin | Likely level |
|---|---|
| Automated alert | HMM0 activity, not a hunt |
| External indicator | HMM1 |
| Published procedure | HMM2 |
| Locally created hypothesis | HMM3 |
| Automated logic produced by a prior hunt | HMM4 |
The dominant category is a better estimate than the best example. One original hypothesis does not make a sustained HMM3 program.
Also assess by data domain. You might operate at HMM3 for Windows endpoints, HMM2 for identity, and HMM0 for SaaS. That view is more actionable than assigning one flattering number to the entire SOC.
Build the next rung, not the top floor
Trying to jump from alert-only operations to advanced behavioral analytics usually creates shelfware. Improve one transition at a time:
- HMM0 → HMM1: schedule and document proactive searches.
- HMM1 → HMM2: move from indicators to durable techniques and procedures.
- HMM2 → HMM3: create hypotheses from local risk and operational knowledge.
- HMM3 → HMM4: operationalize validated logic through detection engineering.
Choose one data domain and define evidence of progress. For example: “During the next quarter, run four identity hunts, create at least one local hypothesis, and send every validated analytic through detection review.”
Hunting maturity is the ability to ask increasingly original questions and turn useful answers into lasting defensive coverage. Measure what your team repeatedly does, identify the weakest transition, and make the next level routine before claiming the one above it.