Also known as: proactive threat detection · cyber threat hunting
Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.
Hunting exists because detection tooling only finds what it was configured to look for. A hunter starts from a hypothesis — 'if an adversary were using this technique, what residue would it leave?' — and searches telemetry for that residue regardless of whether anything alerted.
Successful hunts frequently produce no findings, which is a legitimate outcome. The secondary value is durable: hypotheses that prove searchable become new automated detections, so hunting continuously expands what the tooling catches unattended.
Dwell Time
Dwell time is the length of time an attacker remains undetected inside a compromised environment, measured from initial intrusion to detection.
SIEM
A SIEM (Security Information and Event Management) system centralises log and event data from across an organisation's infrastructure, correlating it to detect suspicious activity and support investigation.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
MITRE ATT&CK
MITRE ATT&CK is a public knowledge base that catalogues real-world adversary tactics, techniques, and procedures, organised into a matrix that maps how attackers progress through an intrusion.
Indicator of Compromise
An indicator of compromise (IOC) is an observable artifact — such as a file hash, IP address, domain, or registry key — that suggests a system may have been breached.