Cyber Hunting

Expanded Definition

Cyber hunting, also called threat hunting in many security operations teams, is a disciplined, hypothesis-led search for signs of compromise that have not yet produced a high-confidence alert. It differs from reactive incident response because the analyst begins with a question, then tests that question against endpoint, network, identity, cloud, and application telemetry. Good hunting is iterative: a weak signal can become a confirmed compromise, or it can expose a visibility gap that needs to be closed.

In practice, cyber hunting sits between detection engineering and investigation. Detection engineering tries to codify known attacker behavior into alerts, while hunting is used to search for behavior that current rules, models, or use cases may miss. Definitions vary slightly across vendors and teams, but the core idea is consistent: a human or machine-assisted analyst is actively looking for evidence of malicious activity before the alerting stack has recognised it. Guidance from CISA cyber threat advisories is often used to seed those hypotheses.

The most common misapplication is treating cyber hunting as a periodic log review, which occurs when teams search for anomalies without a clear hypothesis, scope, or telemetry baseline.

Examples and Use Cases

Implementing cyber hunting rigorously often introduces operational overhead, requiring organisations to balance deeper visibility and earlier compromise detection against analyst time, tooling coverage, and query maintenance.

• An analyst looks for impossible travel, unusual token use, or atypical privilege escalation paths after a phishing campaign, then correlates identity logs with endpoint activity to see whether the account was abused.
• A cloud security team hunts for dormant service principals, unexpected API calls, or suspicious role changes in order to detect Non-Human Identity abuse before a rules-based alert fires.
• A SOC team tests whether known adversary tradecraft could be present in email, proxy, DNS, and EDR telemetry, using CISA cyber threat advisories to inform the hypothesis.
• A security team investigates whether an AI-assisted intrusion may have used automation to accelerate reconnaissance or phishing, comparing observed activity against emerging patterns such as those described in the Anthropic report on the first AI-orchestrated cyber espionage campaign.
• A threat hunter validates whether adversarial AI activity is relevant to the environment by checking techniques and behaviours referenced in the MITRE ATLAS adversarial AI threat matrix.

For organisations with immature telemetry, hunting also becomes a discovery exercise: it reveals which data sources are missing, delayed, or too noisy to support reliable detection.

Why It Matters for Security Teams

Cyber hunting matters because many compromises do not announce themselves with a clean alert. Attackers who live off the land, abuse valid credentials, or move through cloud and identity layers often blend into normal activity until a hunt exposes the pattern. For that reason, hunting strengthens both detection coverage and operational assurance: it tells security teams not only what they can see, but also what they are still blind to.

This is especially important where identity, NHI, and agentic AI overlap. If an autonomous agent, compromised service account, or misused API key is part of the attack path, the hunt must include identity logs, secrets usage, token issuance, permission drift, and tool invocation history. The value of hunting is not limited to finding an active intrusion; it also helps teams verify whether their controls are actually producing trustworthy telemetry. In AI-adjacent cases, practitioners increasingly compare behavior against emerging adversarial AI references such as MITRE ATLAS adversarial AI threat matrix to decide what abnormal activity should look like.

Organisations typically encounter the full cost of weak hunting only after a breach review shows that suspicious activity was present for days or weeks, at which point cyber hunting becomes operationally unavoidable to restore confidence in detection.

Related resources from NHI Mgmt Group

• How can organizations counter AI-driven cyber attacks?
• How should security teams use GRC to reduce identity-related cyber risk?
• Why do cyber crisis responses slow down even when teams know the playbook?
• Who is accountable when cyber crisis decisions stall across teams?