Threat Hunting Coverage Calculator
Score a hunting programme on hypothesis execution, technique and data-source coverage, and conversion of findings into detections.
About Threat Hunting Coverage Calculator
Conversion carries a quarter of the weight because a hunt that finds something and does not leave behind a detection has to be repeated forever. Technique coverage carries the most weight, since it is what determines whether hunting is systematically reducing blind spots or repeatedly revisiting the same comfortable ground. Hunting is expensive senior-analyst time, and without conversion and coverage metrics it drifts into unmeasurable activity that cannot be defended in a budget review.
Formulas
Threat Hunting Coverage
Hunt score = 0.2 × execution rate + 0.3 × technique coverage + 0.25 × data coverage + 0.25 × detection conversion rate.
- execution rate
- Planned hypotheses actually completed
- technique coverage
- In-scope ATT&CK techniques hunted
- data coverage
- Sources queryable versus required
- conversion rate
- Findings turned into permanent detections
Hunt efficiency
Hunting hours per finding = quarterly hunt hours ÷ findings, a blunt efficiency measure.
- quarterly hunt hours
- Monthly hours × 3, matched to the quarterly hypothesis count
Worked example
With the default values below, Threat Hunting Coverage Calculator returns Hunt Programme Score of 55.4%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Hunt hypotheses planned per quarteraccepts 1–1,000 hypotheses
- 24 hypotheses
- Hypotheses actually executedaccepts 0–1,000 hypotheses
- 15 hypotheses
- ATT&CK techniques hunted in the last yearaccepts 0–250 techniques
- 40 techniques
- Techniques in scopeaccepts 1–250 techniques
- 160 techniques
- Data sources queryable for huntingaccepts 0–500 sources
- 18 sources
- Data sources the hunt plan requiresaccepts 1–500 sources
- 24 sources
- Findings producedaccepts 0–10,000 findings
- 9 findings
- Findings converted into new detectionsaccepts 0–10,000 detections
- 6 detections
- Hunting hours per monthaccepts 0–5,000 hours/month
- 60 hours/month
Results
- Hunt Programme Score
- 55.4%
- Hypothesis Execution Rate
- 62.5%
- Technique Coverage Hunted
- 25.0%
- Hunt Data Coverage
- 75.0%
- Findings Converted to Detections
- 66.7%
- Hunting Hours per Finding
- 20.0 hours
- Hunt Maturity
- Level 2 — hunts happen but coverage and follow-through are patchy
Step by step
- 1Values used
- 2Threat Hunting Coverage
- 3Hunt efficiency
- 4Hunt Programme Score= 55.4
- 5Hypothesis Execution Rate= 62.5
- 6Technique Coverage Hunted= 25.0
- 7Hunt Data Coverage= 75.0
- 8Findings Converted to Detections= 66.7
- 9Hunting Hours per Finding= 20.0 hours
Assumptions and limits
- The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Threat Hunting Coverage calculated?
Hunt score = 0.2 × execution rate + 0.3 × technique coverage + 0.25 × data coverage + 0.25 × detection conversion rate. Conversion carries a quarter of the weight because a hunt that finds something and does not leave behind a detection has to be repeated forever. Technique coverage carries the most weight, since it is what determines whether hunting is systematically reducing blind spots or repeatedly revisiting the same comfortable ground.
Why does Threat Hunting Coverage matter?
Hunting is expensive senior-analyst time, and without conversion and coverage metrics it drifts into unmeasurable activity that cannot be defended in a budget review.
What values do I need to enter?
This calculator takes 9 inputs: Hunt hypotheses planned per quarter, Hypotheses actually executed, ATT&CK techniques hunted in the last year, Techniques in scope, Data sources queryable for hunting, Data sources the hunt plan requires, Findings produced, Findings converted into new detections, Hunting hours per month. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is a hunt that finds nothing a failure?
No — but it must still produce output: a documented hypothesis, the data it was tested against, and either a new detection or a recorded gap in telemetry. A negative result with evidence is coverage; a negative result with no artefact is unrecorded time.
How many hypotheses per quarter is reasonable?
For one full-time hunter, roughly 15–25 well-scoped hypotheses a quarter. Fewer usually means the scope is too broad; many more usually means they are queries rather than hypotheses.