SecTor 2025 | From Days to Hours: Accelerating Cyber Threat Response with AI Agents

Why It Matters

Accelerating detection and prioritization of emerging threats shrinks the attacker’s window, turning costly, weeks‑long mitigation cycles into near‑real‑time responses for enterprises.

Key Takeaways

• AI agents can cut threat response from days to hours.
• Social media mining identifies emerging threats before public disclosure.
• Semantic clustering with LLMs replaces traditional ML for unknown CVEs.
• Multi‑agent workflow prioritizes and enriches threats using business context.
• Demonstrated system automates hunting query generation for rapid mitigation.

Summary

At SecTor 2025, Ival, a veteran of Israel’s 8200 unit and director of security research at Hunters, unveiled a weekend‑project AI platform that compresses cyber‑threat response cycles from days into hours. The talk framed the problem around the "black" and "gray" risk phases—periods before public disclosure and before official patches—where defenders traditionally scramble to understand and mitigate emerging threats. The solution ingests real‑time social‑media signals from Reddit, Twitter and other channels, then uses large language models to semantically cluster posts, bypassing conventional keyword‑based ML. Authoritative feeds (NIST, CIS, vendor advisories) are merged, and a suite of specialized agents—Thread Identifier, Threat Analyst, and Threat Hunter—process this enriched context against a user‑defined business profile to surface, prioritize, and enrich the most relevant threats. Key examples include IBM’s GPT‑4 study showing 87% success exploiting one‑day vulnerabilities, and the system’s ability to output a concise list of zero to two actionable threats, complete with hunting queries and mitigation guidance. The agents leverage tools like Perplexity and ExaSearch to retrieve supporting intel, demonstrating a fully automated pipeline from noisy social chatter to actionable SOC playbooks. If adopted broadly, such an agentic platform could dramatically shrink the defender’s window, turning reactive patch cycles into proactive threat hunting. Enterprises would gain near‑real‑time visibility into sector‑specific risks, enabling faster containment, reduced breach costs, and a strategic shift toward AI‑augmented security operations.

Original Description

Identifying and responding to emerging threats before they escalate into widespread attacks is one of the hardest challenges in cybersecurity today. Threats often surface first in informal channels, long before official advisories are published. By the time traditional detection systems catch up, it's often too late.

In this session, we will present a collaborative AI-agent framework built to act as a threat intelligence and threat hunting accelerator. The system ingests and semantically processes large volumes of structured and unstructured data - including CISA alerts, CVE databases, vendor reports, EXA and Perplexity search results, and social media signals. Using a custom LLM-based clustering engine, the system groups early threat signals by topic, CVE, and campaign, allowing for real-time insight into what's emerging across the security landscape.

Each agent in the framework plays a specialized role: surfacing relevant threats, analyzing and prioritizing them based on relevance and severity, extracting TTPs and IOCs, and generating hunting queries.

We'll walk through the system design, share implementation insights (including hallucination control, prompt chaining and evaluation), and showcase how this setup enables teams to reduce the time between "first appearance" and "first action" to hours or even minutes.

Attendees will leave with a deep understanding of how LLM-based agents can be used as proactive actors in cyber threat intelligence and response workflows.

By: Yuval Zacharia | Director R&D, Security Research & AI, Hunters

Presentation Materials Available at:

https://blackhat.com/sector/2025/briefings/schedule/?#from-days-to-hours-accelerating-cyber-threat-response-with-ai-agents-46897