Threat Hunting in Action: AI, Exploits & Automation
Turn the intelligence you collect into the investigations that matter
Your team has threat reports, vulnerability alerts, and security telemetry. The difficult part is deciding which signals matter to your environment, what to investigate next, and how to turn the findings into better defenses.
A new exploit emerges. Suspicious activity appears around an AI service. An intelligence report describes behavior your existing detections may miss. How do you move from that information to a focused hunt—and give your analysts a process they can repeat?
This Summit brings together threat intelligence, threat hunting, detection engineering, and security leadership in one practical day.
Through a keynote, four workshops, and an expert closing panel, you’ll explore how to turn emerging threats into testable hypotheses, connect intelligence with internal telemetry, introduce automation with human oversight, and communicate the value of your work.
Join Dennis Chow, Joe Fleurat, Filipi Pires, and Alexandra “Alex” Hurtado for perspectives spanning intelligence operations, adversary behavior, detection engineering, and the realities of running a modern SOC.
What this summit will help you do
The day follows the decisions a security team needs to make when new intelligence arrives:
Establish relevance. Determine whether a threat, vulnerability, or adversary technique matters to your organization.
Define the hunt. Turn the intelligence into a clear hypothesis and identify the evidence needed to investigate it.
Connect the data. Use endpoint, identity, cloud, and application telemetry to examine suspicious behavior.
Make the work repeatable. Identify enrichment and investigation steps that can benefit from SOAR or AI assistance.
Explain the result. Translate findings, coverage gaps, and improvements into decisions for technical teams and leadership.
You’ll leave with a clearer approach to planning hunts, evaluating automation, and connecting investigation results to security priorities.
Who should attend
This summit is designed for practitioners who work with security investigations, threat intelligence, or detection workflows:
Threat hunters and senior SOC analysts who want to develop focused hunt hypotheses and identify useful telemetry for emerging threats.
Cyber threat intelligence analysts looking to turn reports, indicators, and vulnerability intelligence into investigations defenders can execute.
Detection engineers and security automation engineers exploring how ATT&CK mapping, enrichment, SOAR, and AI assistance can support repeatable hunting workflows.
Incident responders who want to use intelligence to guide investigations and translate lessons from incidents into proactive hunting.
SOC managers, CTI leads, and fusion center leaders responsible for improving collaboration, assessing automation, and demonstrating the value of security operations.
Best suited to: intermediate and experienced security professionals familiar with logs, SIEM or EDR investigations, and basic attacker tactics and techniques.
What you’ll explore during the day
Opening keynote
The Shrinking Window: Modern Threats and the Fusion Imperative
Explore how changing adversary behavior affects the way security teams collect intelligence, prioritize investigations, and develop detections.
The keynote will examine:
How AI affects the speed and scale of attacker activity.
Where handoffs between CTI, hunting, and detection teams can slow investigations.
How to feed intelligence into an ongoing hunting program.
Which skills analysts and engineers need as automation becomes part of daily operations.
Takeaway: a clearer view of how intelligence and hunting should work together within your SOC.
Workshop 1
Hunting the AI Adversary and Defending Generative Tools
As organizations adopt generative AI, defenders need to understand what suspicious use looks like and where evidence of abuse might appear.
This session explores:
Prompt injection and potential data exfiltration through corporate AI services.
Telemetry that can help investigate abnormal AI API interactions.
Behavioral approaches to investigating evasive or changing payloads.
How to turn an AI-related threat scenario into a focused hunt.
Takeaway: a practical way to frame investigations around AI services and identify the evidence needed to test your hypothesis.
Workshop 2
From Exploit Intelligence to Actionable Hunt Hypotheses
An emerging vulnerability matters most when you can connect it to your exposure and the activity an attacker might generate.
This session explores:
Assessing vulnerability and exploitation signals for relevance to your environment.
Interpreting threat reporting and adversary discussions with appropriate attention to source quality.
Prioritizing investigations around credible exploitation activity.
Developing hypotheses for behavior that may follow an initial compromise.
Takeaway: a structured approach to translating exploit intelligence into a hunt with a defined scope and evidence requirements.
Workshop 3
Intelligence-Driven Automation: SOAR Playbooks and AI-Assisted Hunting
Explore how to reduce repetitive investigation work while keeping analysts responsible for the decisions that matter.
This session covers:
Enriching an indicator of compromise with internal telemetry and external context.
Connecting ATT&CK techniques to investigation and playbook steps.
Identifying repeatable tasks suitable for SOAR automation.
Introducing retrieval-augmented generation and basic hunting-agent concepts.
Using evaluations and human review to check the quality of AI-assisted outputs.
Takeaway: an approach to designing hunting workflows with clear inputs, useful automation, and deliberate review points.
Workshop 4
Metrics That Matter: Reporting the Value of Cyber Fusion
A useful hunt should inform what your team does next. This session focuses on making that value visible.
You’ll explore:
Measuring investigation efficiency, detection quality, and coverage improvements.
Evaluating time savings from automation alongside the effort needed to review its outputs.
Translating technical findings into business-risk language.
Structuring post-investigation reports and CTI briefs for different audiences.
Takeaway: a clearer approach to reporting what changed, what remains exposed, and which action deserves priority.
Closing panel
Making Intelligence-Driven Hunting Work Across Teams
The closing discussion connects the day’s technical themes with the practical challenges of operating a security team:
Improving collaboration between strategic CTI and operational defenders.
Recruiting and developing the skills needed for AI-assisted security operations.
Managing analyst workload and burnout.
Balancing automation with human judgment.
Defining what effective performance looks like in a modern SOC.
Bring questions about the challenges you face in your own team.
What to know before attending
To get the most from the sessions, you should be comfortable with:
Basic SOC, incident response, or threat intelligence workflows.
Reading security logs and understanding common indicators of compromise.
The purpose of SIEM and EDR platforms.
Basic attacker tactics and techniques; familiarity with MITRE ATT&CK will help.
Experience writing investigation queries or working with playbooks will be useful. The automation sessions will introduce AI concepts in the context of security operations.
For the live event, use a laptop or desktop with a reliable internet connection. Specific software, accounts, or preparation needed for workshop exercises will be listed with the final session details.
Make your next hunt count
Join security practitioners and leaders for a day focused on turning intelligence into useful investigations—and turning those investigations into decisions your team can act on.
Reserve your place at The Cyber Fusion Summit