The federal government is putting more emphasis on finding and disrupting cyber threats before they turn into incidents. But that effort won’t happen at the federal level alone. State and local agencies are often on the frontlines of cyberattacks, putting them in a position to spot activity that could provide an early signal of a broader threat.
When people hear that the government is taking an “offensive” approach to cybersecurity, they tend to jump straight to hacking back or taking action against an attacker’s own infrastructure. But getting ahead of an adversary starts earlier. It means finding signs of malicious activity sooner, understanding what an attacker is doing, and getting that information to the right people before the attacker has time to cause damage.
You don’t need to touch an adversary’s infrastructure to be on offense. You need to be relentless about finding them.
That gives state and local agencies a crucial role: they may not be carrying out offensive operations themselves, but they can help identify signs of adversary activity earlier. For agencies to play that role effectively, they need visibility, speed, and a dedicated threat hunting capability.
You Can’t Hunt What You Can’t See
The first requirement is visibility. Agencies can’t disrupt activity they don’t know about, and attackers have become good at making themselves difficult to find.
Sophisticated adversaries don’t always announce themselves with malware or behavior that triggers an alert. They can use legitimate tools, compromised credentials and normal administrative processes to blend into an environment. If a security team is relying on alerts to tell them when something is wrong, an attacker may already have had time to move through the network before anyone starts looking.
Threat hunting reverses that dynamic. Instead of asking “What alerts do we have?” hunters start with a hypothesis about how an adversary might behave and look across the environment for evidence that supports or disproves it. This requires current, reliable information about what’s happening across endpoints. If an agency has blind spots across its environments, its hunters will have blind spots too. The same principle applies across government. State and local agencies can serve as an important sensor network, spotting suspicious activity in their own environments, and getting that information upstream quickly. That only works if they can see what’s happening locally in the first place.
Speed Matters When the Goal Is Disruption
Agencies also need to be able to turn what they’re seeing into answers fast.
Batch-processed logs that are reviewed next week don’t support a strategy built around disrupting adversaries early. Hunters need to ask questions across an environment and get answers in minutes: where else has this account authenticated? Is this process running on other systems? Have we seen this behavior elsewhere? What happened immediately before and after it?
Those answers can help an agency determine whether it’s dealing with an isolated incident or activity that could be relevant to other government partners.
Moving too fast without that knowledge creates problems. An organization can disrupt the wrong activity, tip off an adversary before it has mapped the full attack or make a decision based on low-confidence data.
Hunting Can’t Be the SOC’s Side Project
The third requirement might be the most overlooked: agencies need people whose job is to hunt.
Threat hunting is a discipline, not something the SOC team does when the alert queue is quiet. Hunters develop hypotheses, look for behaviors that existing controls may have missed, and investigate activity that doesn’t fit into an alert.
If agencies want to move left of the incident, they must build that hunting muscle deliberately. The important part is building the habit of asking questions about the environment rather than waiting for an alert.
What State and Local Agencies Can Do Now
For state and local agencies, the priority should be strengthening their ability to detect and understand what is happening locally and get useful information to the right partners, whether that’s through fusion centers, MS-ISAC, CISA or other established channels. That doesn’t mean waiting for a bigger budget or another tool. Agencies can start by establishing a baseline for normal behavior, identifying two or three relevant hunt hypotheses and using the capabilities already available.
Visibility and a habit of asking questions will do more to build that capability than another tool sitting on the shelf.
The conversation about offensive cybersecurity will continue to focus on what happens when it’s time to take action against an adversary. But by then, a lot of the important work should already have happened.
The most effective posture starts early: find the adversary, understand what they’re doing, and deny them the ability and time to accomplish their objective.
The author, Aaron Smith, is Head of Threat Hunting at Tanium.