Towards a Cognitive-Support Tool for Threat Hunters

TL;DR

The paper tackles the cognitive burden in threat hunting by proposing a human-centered design for a cognitive-support tool, the Threat Hunter Board. Using a design-science approach, it articulates four core features (Canvas, Waypoints, Storyline Explorer, Checklist) and six design heuristics to externalize reasoning, maintain continuity, and facilitate collaboration, validated through a cognitive walkthrough and a clear plan for future user-based validation. The high-fidelity Figma prototype is anchored in prior threat-hunting research and industry partnership, offering a concrete artifact and transferable design knowledge for integrating cognitive support with existing threat detection environments. Overall, the work demonstrates how structured visualization and workflow support can enhance sense-making and coordination in complex cyber investigations, paving the way for further empirical validation and potential integration with AI-assisted reasoning.

Abstract

Cybersecurity increasingly relies on threat hunters to proactively identify adversarial activity, yet the cognitive work underlying threat hunting remains underexplored or insufficiently supported by existing tools. Building on prior studies that examined how threat hunters construct and share mental models during investigations, we derived a set of design propositions to support their cognitive and collaborative work. In this paper, we present the Threat Hunter Board, a prototype tool that operationalizes these design propositions by enabling threat hunters to externalize reasoning, organize investigative leads, and maintain continuity across sessions. Using a design science paradigm, we describe the solution design rationale and artifact development. In addition, we propose six design heuristics that form a solution-evaluation framework for assessing cognitive support in threat hunting tools. An initial evaluation using a cognitive walkthrough provides early evidence of feasibility, while future work will focus on user-based validation with professional threat hunters.

Figures (6)

• Figure 1: The Threat Hunter Board and an overview of its core features.
• Figure 2: F2 Waypoints---example of a waypoint creation.
• Figure 3: F2 Waipoints---example of a waypoint object being edited, and opening its saved view.
• Figure 4: Showcase scenario---view of the Threat Hunter Board at the end of Scene 2.
• Figure 5: Showcase scenario---view of the Threat Hunter Board at the end of Scene 4.