Threat hunting searches for hidden attacker activity that evades alerts, helping limit dwell time and damage through evidence-led detection.
Search across headline titles and summaries.
Background for this topic.
Threat hunting is the proactive search for signs of compromise that automated alerts, signatures, or routine monitoring may miss. Analysts form hypotheses from threat intelligence and observed attacker tactics, techniques, and procedures, then examine endpoint, identity, network, cloud, and application telemetry for unusual behavior. The work may uncover unauthorized persistence, credential use, or lateral movement before an attacker’s objective is reached.
In a threat model, hunting addresses adversaries who already have—or may have obtained—an initial foothold and are deliberately avoiding detection. Its value depends on usable, time-synchronized logs, adequate visibility, and disciplined investigation rather than isolated anomalies. Effective practice prioritizes high-risk assets and attack paths, tests hypotheses against historical data, turns validated findings into detections, and preserves evidence for containment and scoping. Access to detailed user and system data should also be limited and governed because hunting can expose sensitive information.
The UK’s National Cyber Security Centre has released new guidance to help firms improve observability and threat hunting
AI is transforming cybersecurity—from detecting phishing and insider threats to accelerating response. See how Waziuh, the open-source XDR and SIEM, integrates AI to turn raw security data into actionable insights and smarter threat hunting. [...]