Overview
Direct Answer
Threat hunting is the proactive and iterative process of searching for adversaries and malicious activity that existing detection systems have failed to identify within an organisation's infrastructure. Unlike reactive incident response, it assumes breach and systematically investigates suspicious behaviour patterns using hypothesis-driven methodologies.
How It Works
Analysts develop threat hypotheses based on threat intelligence, attack frameworks, and known adversary tactics, then search through network logs, endpoint telemetry, and system artefacts to validate or refute those hypotheses. This cycle involves querying data sources, correlating events, and escalating findings to incident response teams. The process emphasises manual investigation combined with analytics tools to uncover subtle indicators of compromise.
Why It Matters
Organisations face a detection gap where sophisticated adversaries dwell undetected for extended periods; hunting closes this gap by reducing dwell time and minimising breach impact. Regulatory compliance frameworks increasingly expect active threat-seeking capabilities, and early detection significantly reduces remediation costs and data exposure risk.
Common Applications
Financial institutions hunt for unauthorised account access and lateral movement; healthcare organisations search for data exfiltration patterns; technology firms investigate supply chain infiltration. Threat hunting supports response to advanced persistent threats and zero-day exploitation where signature-based detection proves insufficient.
Key Considerations
Threat hunting demands significant skilled personnel and investment in data retention infrastructure, making it resource-intensive for smaller organisations. Success depends heavily on the quality of threat intelligence and hypotheses; poorly targeted searches yield false positives that erode team productivity.
Cross-References(1)
More in Cybersecurity
Cybersecurity
Offensive SecurityThe practice of protecting systems, networks, and programs from digital attacks, unauthorised access, and data breaches.
Software Supply Chain Security
Security GovernancePractices and tools that protect the integrity of software components, dependencies, build pipelines, and distribution channels from compromise and tampering.
Security Audit
Security GovernanceA systematic evaluation of an organisation's information system security by measuring compliance with established criteria.
Buffer Overflow
Offensive SecurityA programming error where data written to a buffer exceeds its capacity, potentially allowing code execution.
Encryption
Data ProtectionThe process of converting plaintext data into ciphertext using an algorithm, making it unreadable without the decryption key.
DevSecOps
Security GovernanceAn approach integrating security practices within the DevOps process, making security a shared responsibility.
Intrusion Prevention System
Offensive SecurityA network security technology that examines network traffic to detect and prevent vulnerability exploits.
Cyber Kill Chain
Offensive SecurityA model describing the stages of a cyberattack from reconnaissance through data exfiltration.