Cyberspace Vigilante or Security Sleuth: Understanding Who Threat Hunters Are

Threat hunters play a critical role in organizational security, yet the human factors of their work and the challenges they face are often overlooked. Through interviews with 20 threat hunters (3 pilots and 17 formal interviews), we aimed to better understand the role by investigating their personal characteristics, workflows, tools, and challenges. Our study resulted in the identification of 17 key dimensions of threat hunters characteristics and work practices, which informed the creation of four personas that represent the complexity of this critical role. By humanizing the role of threat hunters, we lay the groundwork for user-centered tools that enhance their well-being and strengthen organizational security.