CybersecurityDefensive Security

Threat Hunting

Overview

Direct Answer

Threat hunting is the proactive and iterative process of searching for adversaries and malicious activity that existing detection systems have failed to identify within an organisation's infrastructure. Unlike reactive incident response, it assumes breach and systematically investigates suspicious behaviour patterns using hypothesis-driven methodologies.

How It Works

Analysts develop threat hypotheses based on threat intelligence, attack frameworks, and known adversary tactics, then search through network logs, endpoint telemetry, and system artefacts to validate or refute those hypotheses. This cycle involves querying data sources, correlating events, and escalating findings to incident response teams. The process emphasises manual investigation combined with analytics tools to uncover subtle indicators of compromise.

Why It Matters

Organisations face a detection gap where sophisticated adversaries dwell undetected for extended periods; hunting closes this gap by reducing dwell time and minimising breach impact. Regulatory compliance frameworks increasingly expect active threat-seeking capabilities, and early detection significantly reduces remediation costs and data exposure risk.

Common Applications

Financial institutions hunt for unauthorised account access and lateral movement; healthcare organisations search for data exfiltration patterns; technology firms investigate supply chain infiltration. Threat hunting supports response to advanced persistent threats and zero-day exploitation where signature-based detection proves insufficient.

Key Considerations

Threat hunting demands significant skilled personnel and investment in data retention infrastructure, making it resource-intensive for smaller organisations. Success depends heavily on the quality of threat intelligence and hypotheses; poorly targeted searches yield false positives that erode team productivity.

Cross-References(1)

Cybersecurity
Threat Intelligence

More in Cybersecurity

Threat Intelligence

Offensive Security

Evidence-based knowledge about existing or emerging threats to an organisation's digital assets and infrastructure.

Information Security

Security Governance

The practice of protecting information by mitigating information risks including unauthorised access, use, and disruption.

Biometric Authentication

Identity & Access

Using unique biological characteristics like fingerprints, facial features, or iris patterns to verify identity.

Encryption

Data Protection

The process of converting plaintext data into ciphertext using an algorithm, making it unreadable without the decryption key.

Cyber Kill Chain

Offensive Security

A model describing the stages of a cyberattack from reconnaissance through data exfiltration.

Spear Phishing

Offensive Security

A targeted phishing attack directed at specific individuals or organisations using personalised deceptive content.

MITRE ATT&CK

Offensive Security

A globally accessible knowledge base of adversary tactics and techniques based on real-world cyber observations.

Attack Vector

Offensive Security

The specific path, method, or scenario used by an attacker to gain unauthorised access to a system.