Score a hunting programme on hypothesis execution, technique and data-source coverage, and conversion of findings into detections.
Conversion carries a quarter of the weight because a hunt that finds something and does not leave behind a detection has to be repeated forever. Technique coverage carries the most weight, since it is what determines whether hunting is systematically reducing blind spots or repeatedly revisiting the same comfortable ground. Hunting is expensive senior-analyst time, and without conversion and coverage metrics it drifts into unmeasurable activity that cannot be defended in a budget review.
Threat Hunting Coverage
Hunt score = 0.2 × execution rate + 0.3 × technique coverage + 0.25 × data coverage + 0.25 × detection conversion rate.
Hunt efficiency
Hunting hours per finding = quarterly hunt hours ÷ findings, a blunt efficiency measure.
Hunt score = 0.2 × execution rate + 0.3 × technique coverage + 0.25 × data coverage + 0.25 × detection conversion rate. Conversion carries a quarter of the weight because a hunt that finds something and does not leave behind a detection has to be repeated forever. Technique coverage carries the most weight, since it is what determines whether hunting is systematically reducing blind spots or repeatedly revisiting the same comfortable ground.
Hunting is expensive senior-analyst time, and without conversion and coverage metrics it drifts into unmeasurable activity that cannot be defended in a budget review.
This calculator takes 9 inputs: Hunt hypotheses planned per quarter, Hypotheses actually executed, ATT&CK techniques hunted in the last year, Techniques in scope, Data sources queryable for hunting, Data sources the hunt plan requires, Findings produced, Findings converted into new detections, Hunting hours per month. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
No — but it must still produce output: a documented hypothesis, the data it was tested against, and either a new detection or a recorded gap in telemetry. A negative result with evidence is coverage; a negative result with no artefact is unrecorded time.
For one full-time hunter, roughly 15–25 well-scoped hypotheses a quarter. Fewer usually means the scope is too broad; many more usually means they are queries rather than hypotheses.