Stop Asking Your Reactive SOC to Be Proactive

We keep expecting alert-based teams to magically become threat hunters. That's like expecting your smoke detector to prevent fires.

In the previous five posts, we showed that your Security Operations Center (SOC) doesn't hunt, your Managed Security Service Provider (MSSP)'s Target Operating Model is probably outdated, you don't need 24/7 hunting, the hybrid model works best, and your MSSP can't answer the questions that matter for hunting threats.

Now, the most challenging part: accepting that we never designed your reactive SOC to be proactive, and this is okay.

The Impossible Expectation

We built SOCs to respond to alerts, then asked them to also hunt for threats that don't generate alerts using the same people, shifts, and performance metrics. It doesn't work.

We are asking SOC analysts to be fast in acknowledging alerts within minutes, thorough in investigating every alert, proactive in conducting hunts for threats that don't generate alerts, and available 24/7 with consistent quality.

The skills are different. The time horizons are different. The success metrics are different. The mental models are different.

Reactive vs. Proactive: Different Mindsets

Alert response requires a reactive mindset: Something happened. Investigate. Determine severity. Act. Move to the following alert.

Threat hunting requires a proactive mindset: What if something happened that we didn't detect? Where is the evidence? Investigate until I prove or disprove my hypothesis.

You will not find it easy to toggle between these mindsets constantly throughout a shift.

The Performance Metric Problem

Your MSSP measures reactive work based on the time to acknowledge alerts, the number of tickets closed per shift, SLA commitments met, and other similar metrics.

Threat hunting requires different metrics: threats discovered without alerts, blind spots identified, hypotheses proven, and meaningful recommendations provided. You should not measure these on an hourly basis.

When analysts do both, they optimize for what we measure them on: the alert queue.

The Skill Set Mismatch

Great SOC analysts are fast thinkers who pattern-match against known attacks and excel at consistent execution.

Great threat hunters develop hypotheses about unknown threats and excel at creative problem-solving.

Most naturally excel at one. And even those who can do both cannot do the work simultaneously to the quality you want to trust.

The Business Model Reality

MSSPs make money delivering scalable monitoring. They optimized for throughput to make 24/7 monitoring affordable.

Threat hunting doesn't scale the same way. You can't hunt for 50 customers simultaneously. Each environment is unique.

The business case for 24/7 monitoring doesn't include periodic hunting.

Check the "Who" Rather than the "How"

Instead of asking "How do we make our SOC hunt?" ask "Who should be hunting?"

Your MSSP has the right "who" for continuous monitoring, but the wrong "who" for hypothesis-driven investigation.

Independent hunting services have the right "who" for investigation, but the wrong "who" for 24/7 monitoring.

The answer is letting different teams do what they do best.

The Path Forward

• Stop expecting your MSSP to hunt. Review their contract. If hunting isn't explicitly defined with time allocation and deliverables, it won't happen.
• Assess your coverage. Use the five questions from Article 5.
• Build the hybrid model. Keep continuous monitoring. Add periodic hunting—quarterly is a good start.
• Create the feedback loop. Implement hunting findings into detection rules. Utilize SOC alert patterns to inform hunting efforts.

The Bottom Line

Your SOC is likely doing exactly what we designed it to do: monitoring alerts, responding to incidents, and containing threats rapidly. That's critical work. The problem isn't that your SOC fails at hunting.

The problem is we keep asking them to do something they were never designed to do, using an operational model that makes hunting impossible.

Stop asking your reactive SOC to be proactive. Start building security operations that allow different teams to do what they do best.

Threats operate in the gaps between what you monitor and what you investigate. The only way to close those gaps is to stop pretending one team can do both and start building the hybrid model that works.

About the Series: This is Part 6 (final) of a six-part series that examines the gap between how security operations are delivered and how modern threats operate. We built the case for why the hybrid model, combining continuous monitoring with periodic hunting, is the only approach that effectively addresses modern threats.

Specialized services exist to be the "who" for threat hunting in your security program. We don't try to monitor alerts or sell products, as that's what your MSSP does best. We hunt. We investigate. We find threats that didn't generate alerts. We share everything we learn, so your entire security program becomes stronger. That's specialization. That's the hybrid model. That's how modern security operations should work. Learn more at focusedhunts.com

← Back to Articles