Why is threat hunting so important?
What happens when an attacker gets into your environment and none of your security tools notice?
Adam Wong, Senior Security Analyst for Threat Intelligence and Threat Hunting at ISA Cybersecurity, encourages organizations to run threat hunting exercises so they find potential incidents sooner. In this article, Adam shares the insights that go into searching for threat actors who are already inside a network and haven’t set off an alarm yet.
The 2026 Cost of a Data Breach Report found that breaches caught by internal teams were closed about five weeks faster than average, and those the attackers disclosed themselves cost the most. Every extra day an intruder goes undiscovered gives them more time to harvest data, drop malware, and plant backdoors that could survive a cleanup. Each of those adds to the work, and the cost, of recovering once the breach is found.
Why do attackers go unnoticed for so long?
A joint guide co-authored by the Canadian Centre for Cyber Security warns that sophisticated attackers increasingly rely on the tools and processes already built into a network – a technique known as living off the land. By erasing their tracks as they go, they keep access without being detected. “At a glance, they look like your own administrators at work. Threat hunting is how you go looking for them,” Adam says. NIST’s security control catalogue lists threat hunting as a control in its own right, aimed at threats that get past existing defences.
What’s involved in threat hunting?
“There’s more than one way to hunt,” Adam explains. “These ten principles are the ones I use most, and they’re what I teach our SOC team.”
1. Assume they’re already in, and think like them.
Picture the attacker inside your network, using your own admin tools and moving slowly to avoid detection. Then ask what they’d do next. If the hacker has stolen a domain admin account, would they create new accounts, or use the access to reach other machines? “Account creation leaves a trail on the domain controller, and most security operations centres already alert on it. A careful attacker knows that too,” Adam points out.
2. Respect the adversary.
Most attackers Adam sees today are basic, and the Canadian Centre for Cyber Security warned in June that AI is making it easier for less skilled attackers to pull off more sophisticated attacks. But don’t forget that the capable ones still turn up, especially in higher-end attacks such as ransomware. They’re quiet, adaptive, and patient, and a hunt built only for the basic cases will miss them.
3. Let intelligence pick the target.
Good hunts start from something concrete: a government advisory, a partner’s threat report, a technique attackers are known to use, or an incident you’ve handled before.
4. Write the hypothesis before you open a tool.
One of the biggest issues Adam sees is analysts opening powerful security tools with no idea what they’re looking for. Adam references a passage from Alice’s Adventures in Wonderland to illustrate:
“Would you tell me, please, which way I ought to go from here?”
“That depends a good deal on where you want to get to,” said the Cat.
“I don’t much care where…” said Alice.
“Then it doesn’t matter which way you go,” said the Cat.
Lewis Carroll, Alice’s Adventures in Wonderland
“A hunt needs a destination. If an attacker used AI to move through your environment faster, what would that look like, and do you have the logs to see it?” Adam asks.
5. Know what normal looks like.
Hunting means reading logs, processes, and network traffic for anything out of place, and you can’t spot what’s out of place without a baseline. Adam is often brought into investigations where the first question is whether a log entry is “normal”: only the people who run the environment can answer that accurately.
6. Move methodically.
Work through hosts, logs, and identity in order, and note each step as you go. Start where the evidence points, such as the firewall, then move to the internal machines the attacker connected to. Adam’s rule for domain controllers is to leave their logs alone until there’s evidence the attacker reached them, or some other reason to look. Following the evidence keeps a hunt from sprawling.
7. Master the tools you already have.
Two teams with the same security information and event management (SIEM) and endpoint detection and response (EDR) platforms can get very different results, depending on how well they know the query language and the data. “People always ask me which security product is best. My answer is always the one you already own,” Adam says.
8. Escalate what you find. Hunters identify and analyze. When a hunt uncovers something real, incident response takes over containment.
9. Count a clean hunt as a result. A good share of hunts come back empty – and that’s okay. No result is still a result, and should be documented.
10. Keep revising your hypotheses. New cloud services, new identity setups, new intelligence, and AI-powered attacker techniques all mean hypotheses need rewriting. Keep your approach flexible enough to pivot quickly when something new appears.
How can a security team start threat hunting?
Adam’s starting advice is practical: “Begin documenting what normal looks like now. Each week, pull your firewall logs, check which sites and IP addresses your machines are reaching, and confirm each one should be there. Add the approved ones to an inventory, so the next review only has to look at what’s new. That record also gives any outside responder the context they’ll need if you ever have to call one in. Then check whether the tools you already own can see the activity your hypotheses depend on, and fill gaps only where they can’t.”
How can ISA Cybersecurity help with threat hunting?
Threat hunting is part of ISA Cybersecurity’s Detect 360 services, where our analysts actively search client environments for signs of malicious activity. To talk through how threat hunting fits in your security program, contact our team today.
