Threat hunting is the practice of proactively searching a network for signs of an attacker instead of waiting for an alert. NIST describes it as an active defensive strategy that looks for threats that evade existing controls. People who do this work are called threat hunters.
- Also Called2other namescyber threat hunting · proactive threat hunting
- Related Terms3linked entriesThreat intelligence · Indicator of compromise (IoC)
What is threat hunting?
Threat hunting is the practice of searching a network on purpose for signs of an attacker, instead of waiting for an alert. The person who does this work is called a threat hunter.
NIST describes threat hunting in its security control RA-10 (SP 800-53 Rev. 5). It says an organization should establish and maintain a cyber threat hunting capability. NIST explains that threat hunting is an active means of cyber defense, in contrast to traditional protection measures such as firewalls and intrusion detection and prevention systems.
How does threat hunting work?
NIST says hunting means proactively searching systems, networks and infrastructure for advanced threats. The objective is to track and disrupt adversaries as early as possible in the attack sequence. The control asks hunters to do two things.
- Search for indicators of compromise in organizational systems. An indicator of compromise is a sign that a system may have been attacked.
- Detect, track and disrupt threats that evade existing controls.
NIST also says the hunting capability should be used at a frequency the organization defines. Hunting teams use threat intelligence, which is information about attackers and their methods. NIST adds that teams may create new threat intelligence and share it with peer organizations, relevant government departments and agencies, and information sharing groups known as ISAOs and ISACs.
What does a threat hunt look for?
NIST gives examples of signs of compromise: unusual network traffic, unusual file changes and the presence of malicious code.
CISA gives more detailed examples in advisory AA25-239A, which covers network devices. As a simple illustration of the kind of checks it lists, the advisory suggests the following.
- Pull the configurations of running network equipment and compare them with the latest authorized versions.
- Hunt for SSH running on high, non-default ports.
- Alert when a packet capture is started on a device.
- Check firmware with hash verification and compare the values against the vendor’s database to detect unauthorized changes.
Why do organizations hunt for threats?
NIST says some threats evade existing controls. Hunting is one way to look for those threats. In AA25-239A, the authoring agencies strongly urge network defenders to hunt for malicious activity and to apply the mitigations in the advisory. The advisory also cautions that partial response actions may alert the actors to an ongoing investigation.
| Question | Threat hunting | Threat intelligence |
|---|---|---|
| What it is | The act of searching systems for threats | Information about attackers and their methods |
| Starting point | Threats that no alert has flagged yet | Used by hunting teams as an input |
| Output | Teams may create new threat intelligence and share it | Shared with peers, agencies and ISAC or ISAO groups |
How does threat hunting relate to nearby terms?
Threat hunting often draws on threat intelligence and looks for indicators of compromise. Hunters also use the language of tactics, techniques and procedures to describe attacker behavior. See the related terms below for each of these.
Is threat hunting the same as waiting for alerts?
No. NIST contrasts hunting with traditional protection measures such as firewalls and intrusion detection and prevention systems. Hunting is a search that people start, not a tool that waits for a rule to match.
Is threat hunting the same as threat intelligence?
No. Threat intelligence is information about attackers. NIST says hunting teams use threat intelligence, so the two work together, but hunting is the act of searching systems for threats.
Does a hunt need a known threat to start?
NIST describes the aim as finding threats that evade existing controls. That means a hunt can look for threats that no alert has flagged yet.
Brandefense monitors outside sources for threat information that hunters may use.
Also Called.
- Namecyber threat hunting
- Nameproactive threat hunting
Questions.
-
What is threat hunting?
Threat hunting is the practice of searching a network on purpose for signs of an attacker instead of waiting for an alert. NIST calls it an active means of cyber defense.
-
How does threat hunting work?
NIST says hunters proactively search systems, networks and infrastructure for advanced threats. They look for indicators of compromise and try to detect, track and disrupt threats that evade existing controls.
-
What does a threat hunt look for?
NIST gives unusual network traffic, unusual file changes and the presence of malicious code as examples. CISA advisory AA25-239A suggests checks such as comparing device configurations with authorized versions.
-
Is threat hunting the same as waiting for alerts?
No. NIST contrasts hunting with traditional protection measures such as firewalls and intrusion detection systems. Hunting is a search that people start, not a tool that waits for an alert.
Sources
In Our Research
- 1 NIST CSF 2.0: the six functions explained October 2026
- 2 Phishing-as-a-Service 2.0: The Kits That Bypass MFA Without a Fake Login Page August 2026
- 3 Agentic AI in Cybersecurity: How Autonomous Agents Are Transforming the SOC April 2026
- 4 GC01 (Golden Chickens): Inside the Arsenal of a Premier E-Crime MaaS Provider April 2026
- 5 DarkHotel (APT-C-06 / ATK52 / DUBNIUM): The Global Espionage Network Behind Elite Cyber Intrusions March 2026
- 6 Turla APT: Russia’s Longstanding Cyber Espionage Powerhouse March 2026