Threat Hunting
Threat hunting is the proactive, human-led practice of searching through an organization's systems and networks for signs of malicious activity that automated detection tools may have missed.
Definition
Threat hunting is the proactive, human-led practice of searching through an organization's systems and networks for signs of malicious activity that automated detection tools may have missed.
Overview
Most security detection is reactive by design: a SIEM rule fires, an Endpoint Detection and Response (EDR) agent flags a process, and an analyst investigates the alert. Threat hunting flips this model — instead of waiting for an alert, a skilled analyst forms a hypothesis ("an attacker may be using a specific legitimate admin tool to move laterally") and actively searches through logs, endpoint telemetry, and network data to prove or disprove it, regardless of whether any automated tool has raised an alarm. This proactive approach exists because sophisticated attackers, particularly those behind advanced persistent threats, are specifically skilled at evading signature-based and even behavior-based automated detection — often using legitimate administrative tools already present on a system ("living off the land") rather than obviously malicious malware. Threat hunters draw on Threat Intelligence about known attacker tactics, techniques, and procedures to inform which hypotheses are worth investigating, and rely heavily on the rich telemetry produced by EDR and SIEM platforms as their raw material for investigation. When a hunt uncovers a genuine, previously undetected technique, the finding is typically converted into a new automated detection rule, so that future occurrences of the same technique are caught without requiring another manual hunt — a feedback loop conceptually similar to what happens during Purple Team exercises. Because it requires deep expertise and significant time investment, threat hunting is typically a capability found in more mature security programs — larger organizations with dedicated Security Operations Center staff, or purchased as a managed service — rather than something every organization performs regularly in-house.
Key Concepts
- Proactive, hypothesis-driven search for threats rather than reactive alert response
- Targets sophisticated attackers who evade automated signature and behavior detection
- Relies heavily on EDR and SIEM telemetry as raw investigative material
- Informed by threat intelligence about known attacker tactics and techniques
- Successful hunts are converted into new automated detection rules
- Requires significant analyst expertise and time investment
- Typically found in more mature security programs or delivered as a managed service
Use Cases
Frequently Asked Questions
From the Blog
How to threat model a service
Run a threat modelling session that produces real work: drawing data flows, marking trust boundaries, walking a category checklist and ranking what to fix.
Read More AI & TechnologyWhat Is Unified Threat Management (UTM)?
Unified threat management is a security approach that combines firewall, antivirus, intrusion prevention, and other protections into a single managed platform. This guide explains what UTM includes, how it works, and when it makes sense.
Read More Career GrowthHow to Transition From QA to Development
Moving from QA to development means turning your bug-hunting instincts into building skills. Here is a practical roadmap to make the switch without starting from zero.
Read More