What Is Threat Hunting?

Instead of simply reacting to cyberattacks from a defensive posture, modern enterprises go on the offensive with threat hunting. As data breaches become more frequent and expensive, systematically searching for unknown and undetected threats is a critical piece of an enterprise security strategy, offering three core benefits:

• Proactive defense against hidden risks: Uncovers and mitigates threats that escape detection by other methods, preventing adversaries from persisting in the network for long periods.
• Accelerated incident response and reduced dwell time: Combines automated tools and human expertise for faster, more accurate threat detection.
• Reduced financial and reputational harm: Minimizes data loss and business disruption in the face of increasingly costly consequences.

Key Data Points: According to IBM’s Cost of a Data Breach Report 2024, the data breach life cycle takes an average of 258 days, following a 15% rise in the global average cost of a breach (reaching US$4.45 million in 2023). Threat hunting directly disrupts this life cycle before cybercriminals can establish a foothold.

Key Trends Driving the Need for Threat Hunting

Several macro trends are making proactive hunting essential to enterprise security:

• The rise of generative AI: Generative artificial intelligence (AI) makes it easier for less-skilled cyber adversaries to conduct complex, high-volume attacks.
• Attack speed and intensity: A steady increase in the velocity of cyberattacks allows adversaries to outpace traditional security tools, calling for proactive measures to get ahead of threat actors.
• Identities as the new perimeter: The rise of identity-based attacks has introduced stealthy attacker techniques, such as creating email forwarding rules in compromised accounts, using rules to hide inbound security alerts, and abusing cloud accounts.
• Multicloud complexity: Cloud migration continues to expand the attack surface; IBM found that roughly 40% of all breaches involve data distributed across multiple environments, such as public and private clouds.
• Zero-day exploitation: Threat hunting is uniquely effective in preventing zero-day attacks that exploit known software vulnerabilities before the vendor or user community learns about them.

Beyond uncovering active threats, the hunting process gives security analysts a comprehensive picture of the organization’s security posture and the tactics, techniques, and procedures (TTPs) used by attackers—feeding directly back into threat intelligence and mitigation efforts.

Traditional threat hunting was a purely manual process requiring analysts to evaluate network data based on institutional knowledge. Today, automation, machine learning, and user and entity behavior analytics (UEBA) augment human skills to keep pace with threat actors.

Effective threat hunting follows a continuous, cyclical methodology broken into three distinct phases:

Phase 1: Before the Hunt (Preparation & Data Collection)

1. Develop a Hypothesis: Make an educated guess about possible threats existing in the environment and how to track them down. Hypotheses can draw on intelligence about current and evolving threats, past attacks on industry peers, situational awareness, or artificial intelligence (AI) insights.
2. Threat Modeling: Understand what data and signals are necessary to detect the hypothesized threat and create a model that informs which telemetry you will collect and analyze.
3. Collect and Analyze Data: Gather and process vast amounts of internal and external telemetry from sources like SIEM software, threat intelligence feeds, network traffic, and endpoints. Behavioral analytics and machine learning help establish a baseline of normal behavior, making deviations easier to spot.

Phase 2: During the Hunt (Investigation & Validation)

1. Trigger the Hunt: Initiate the active hunt after identifying specific indicators of compromise (IOCs), indicators of attack (IOAs), or behavioral anomalies that support the initial hypothesis.
2. Investigate and Validate: Correlate and analyze the collected data using manual techniques, tool-based workflows, or analytics to uncover patterns like data exfiltration or lateral movement. The goal is to validate whether indicators point to genuine threats or false positives—or to rule out the hypothesis entirely, which is equally valuable.

Phase 3: After the Hunt (Resolution & Continuous Improvement)

1. Response and Resolution: If hunters detect a breach, the incident response team steps in to remediate the issue. If uncovered vulnerabilities are the root cause, the security team patches and fixes them.
2. Post-Mortem and Continuous Improvement: Once addressed, teams conduct an analysis of why existing security controls missed the threat. Because hunting is cyclical, hunters apply these lessons to refine techniques, update hypotheses, and incorporate new intelligence for future hunts.

The approach threat hunters take depends on the information they have upfront—for instance, whether a threat feed provided signature data for an emerging malware strain, or whether the team noticed an unexplained spike in outbound traffic. These approaches are often combined for comprehensive coverage:

• Structured Hunting (Lead-Driven): Begins with a well-defined hypothesis or specific IOCs/IOAs and follows a systematic procedure or playbook. It is methodical, repeatable, and yields measurable results. It typically takes two forms:
  • Intel-based hunting: Triggered by external threat intelligence sources regarding current trends, attacker TTPs, or newly identified malware signatures.
  • Hypothesis-driven hunting: Aligns with frameworks like MITRE ATT&CK and is triggered by newly identified threat behaviors, prompting hunters to test whether those behaviors exist in their environment.
• Unstructured Hunting (Leadless): Less constrained and does not depend on specific leads or prior indicators. Hunters use data analysis, anomaly detection, and instinct to explore free-form avenues—such as investigating an unexpected network traffic spike to find its root cause.
• Situational (Entity-Driven) & Custom Hunting: Tailored to the enterprise's specific high-value systems, assets, accounts, and data, or driven by unique customer requirements, geopolitical issues, or targeted attacks against industry peers. It blends intel-driven and hypothesis-based models.

Threat hunting teams rely on established frameworks to structure their investigations and align detection efforts:

• MITRE ATT&CK Framework: A globally accessible knowledge base of known adversary TTPs that provides a standardized way to categorize and analyze threat behaviors across the attack lifecycle.
• Prepare, Execute & Act with Knowledge (PEAK): The PEAK framework structures hunts into three phases—preparation, execution, and acting with knowledge—incorporating hypothesis-driven, baseline, and model-assisted hunting.
• Targeted Hunting Integrating Threat Intelligence (TaHiTI): The TaHiTI methodology standardizes threat hunting by explicitly integrating threat intelligence into the trigger, investigation, and resolution phases.
• Sqrrl Threat Hunting Reference Model: The Sqrrl framework defines the core hunting loop alongside a Hunting Maturity Model (HMM) to evaluate an organization's data collection, analytics, and automation capabilities.
• Lockheed Martin Cyber Kill Chain: Breaks down seven stages of a cyberattack—from reconnaissance to exfiltration—to help hunters identify vulnerabilities and apply mitigation strategies at each stage.
• Cyberthreat Intelligence Life Cycle: A continuous process of collecting, analyzing, and disseminating threat intelligence to keep hunters ahead of emerging threats. (Read more in our dedicated article, What Is Threat Intelligence?)
• Observe, Orient, Decide, Act (OODA) Loop: A four-step military decision-making framework that helps hunters contextualize evolving threat information and act rapidly.
• Diamond Model of Intrusion Analysis: A cyberthreat attribution framework defining four core features of intrusion activity—adversary, infrastructure, victim, and capability—to map the who, what, where, and how of an attack.

Malicious actors increasingly use AI and automation to fuel their attacks, making defensive automation essential to "fight fire with fire." Automation collects, correlates, and identifies anomalies across massive datasets in real time, freeing human analysts to focus on incidents requiring nuanced, contextual decision-making.

Common technologies in the threat hunter's toolkit include:

1. SIEM: Security information and event management solutions collect and analyze log data from across the network, providing real-time threat analysis, tracking, and centralized alerting.
2. EDR and XDR: Endpoint detection and response (EDR) tools monitor endpoints in real time for triage and remediation. Comparing EDR vs. MDR vs. XDR, Extended Detection and Response (XDR) expands visibility by correlating data across networks, cloud workloads, identity systems, and email.
3. MDR: Managed detection and response systems provide continuous monitoring and external hunting expertise to complement and enhance internal human hunting activities.
4. Generative AI: Generative AI models rapidly ingest structured data (such as firewall or IAM logs) and synthesize key findings into a human-readable format for faster triage.
5. Network Traffic Analysis (NTA) & Security Monitoring: NTA tools, firewalls, intrusion detection systems (IDS), and endpoint security solutions monitor real-time traffic patterns and event flags.
6. Threat Intelligence Platforms (TIPs) & SOAR: TIPs aggregate and enrich external threat feeds, while Security Orchestration, Automation, and Response (SOAR) platforms automate incident response workflows.
7. Vulnerability Scanning & Attack Surface Management (ASM): Identify, monitor, and help patch exploitable weaknesses and external attack vectors across environments and apps.
8. Malware Sandboxes, Deception, & Red-Teaming Tools: Malware sandboxes safely detonate suspicious files; deception technology deploys network decoys to lure attackers and generate high-fidelity alerts; and threat emulation tools simulate real-world attacks.

While threat hunting and threat intelligence work hand-in-hand to bolster cybersecurity programs, they serve distinct functions:

In practice, threat hunters rely on threat intelligence to formulate hypotheses and guide their hunts, while the net-new internal data uncovered during a hunt enriches the organization's threat intelligence program.

Building an effective threat hunting program requires alignment across people, processes, and technology:

1. Corporate Commitment and Key Roles

Because threat hunting is proactive rather than a response to a known alarm, it requires dedicated executive buy-in, budget, and staffing (whether in-house or outsourced). Key stakeholders include:

• Threat Hunters and SOC Analysts: Take the lead in tracking suspicious behaviors and investigating IOAs.
• Threat Intelligence Analysts: Distill raw feeds into actionable context and IOCs.
• Legal, Compliance, and Executive Leadership: Ensure regulatory adherence and make strategic decisions on risk tolerance and resourcing.

2. Preparation and Baselines

Before launching a hunt, establish the baseline of normal, expected behavior for your organization’s systems, communication flows, user rights, and business processes so anomalies stand out. Define clear objectives tailored to your risk profile—such as hunting for insider threats or advanced persistent threats (APTs).

3. Adopting the Adversary Mindset

To spot subtle weaknesses, hunters must think like cybercriminals—anticipating how threat actors view the organization's infrastructure, what high-value assets they hope to gain, and how they evade existing security measures.

4. Cross-Team Collaboration

Expand a hunt's value by sharing insights directly with your SOC, incident response, and vulnerability management teams. Applying lessons learned from each hunt—both successful detections and ruled-out hypotheses—continuously sharpens your data sources and detection engineering.

Zscaler ThreatLabz threat hunting experts continuously monitor for anomalies across more than 500 trillion daily data points traversing the Zscaler Zero Trust Exchange—the world’s largest security cloud—identifying and detecting malicious activity and emerging threats at global scale.

Combining world-class threat intelligence, Red Canary’s battle-tested detection and hunting expertise, and proprietary machine learning models, Zscaler proactively hunts for the telltale TTPs of threats ranging from sophisticated nation-state adversary groups to commodity malware. This telemetry continuously trains our AI models for faster, broader detections—contributing to identifying and blocking 9 billion potential threats daily before they can impact our customers.

Our experienced threat hunters are ready to uncover and defend against advanced attacks in your environment

• Discover how to proactively secure your enterprise network and endpoints with Zscaler Managed Threat Hunting.
• Follow ThreatLabz on X