Threat hunting helps organisations find security threats that have slipped past their first line of endpoint defences. Most organisations rely on a defensive set of controls to deal with cyber threats, such as firewalls, antivirus, endpoint protection, email security and web security. Alongside these tools, many now go a step further and actively look for attackers who may already be hiding inside their networks. This proactive search is known as cyber threat hunting.
This article explains what threat hunting is, the main methodologies, the four steps of a hunt and the benefits for Australian organisations. For the tools and techniques hunters use, see our guide to proactive threat hunting tools and techniques.
How does it work?
With today's threat landscape, security teams can't simply wait for their systems to raise an alarm. They need to stay alert, patch vulnerabilities and anticipate the next attack before it lands. Threat hunting starts with a hypothesis about a likely threat, or about how criminals might attack in future, and then tests that idea against what is actually happening in the organisation's environment. Hunters build these hypotheses from the data their security systems collect, then dig through that data for clues that point to suspicious activity.
What makes threat hunting effective is the human element. Skilled security professionals work alongside automated tools to search, log, monitor and neutralise threats before they cause serious harm. Rather than waiting for an alert before checking networks and systems for a breach, hunters assume a breach has already happened, or soon will, and go looking for the evidence.
Threat Hunting Methodologies
A threat hunter starts an investigation on the assumption that a malicious actor is already present within an organisation's system or network. These investigations can follow three different methodologies:
- Hypothesis-driven investigation - This type of investigation is triggered when a potential cyber threat emerges based on crowdsourced attack data which has provided insight into an attacker's tactics, techniques and procedures (TTPs). Based on these new TTPs a hypothesis will then be created and tested by threat hunters in the environment of their own organisation.
- Investigations based on identified IOCs & IOAs - This type of investigation leverages threat intelligence to catalogue known indicators of compromise (IOCs) or indicators of attack (IOAs) associated with new emerging threats. This information is then used as a trigger for a threat hunter to identify malicious activity in an organisation.
- Investigations using machine learning - This type of investigation combines powerful data analysis and machine learning to comb through a large amount of information in order to detect anomalies that might indicate malicious activity within an organisation.
Why Threat Hunting Is Needed
No set of automated controls catches everything, and the threats that get through can do serious damage to systems and networks. An effective threat hunting program shortens the time between an intrusion and its discovery, which limits the harm an attacker can cause.
That window still matters. Mandiant's M-Trends 2026 report found the global median dwell time (the time attackers spend inside a network before they are detected) rose to 14 days in 2025, up from 11 days the year before. IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at USD 4.99 million, and the harmful effects of a breach can linger for years. The longer it takes to detect and respond, the more a breach can cost an organisation.
In Australia, ASD's Annual Cyber Threat Report 2025–26 shows how often organisations don't know an attacker is present: of the more than 1,500 incidents ASD's ACSC responded to in 2025–26, 362 were identified only after ASD notified the organisation of potential malicious activity on its network.
Put simply, without threat hunting an organisation may not know whether an attacker is already inside its systems. Once in, cybercriminals can stay for long periods, gathering data and searching for sensitive information and credentials that open up deeper systems. The longer they remain, the greater the financial and reputational damage. Threat hunting finds and removes intruders who have got past the first line of defence, before they can do more harm.
How Threat Hunting Is Performed
Threat hunting has quickly become an essential part of an organisation's cybersecurity posture, it consists of four key steps:
Creating a hypothesis
The first step of any successful threat hunting attempt is to create a hypothesis of potential threats in the environment, it involves creating a hypothetical scenario of an attacker's tactics, techniques and procedures when it comes to breaching an organisation's defences. An information security team can create a hypothesis using their own threat experiences and knowledge of the threat landscape.
Collect and process data and intelligence
Threat hunting involves creating a plan for the collection and processing of intelligence and data. Often organisations implement SIEM solutions, Security Information & Event Management software can help an organisation keep track of the activities being conducted in an IT environment.
Trigger & Investigation
Using the hypothesis threat hunters can identify an area of investigation i.e. in this step of the threat hunting process a hypothesis of a new threat acts as a trigger for an information security team to conduct an investigation in a specific area of the organisation. Once triggered the investigation can start, threat hunters can utilise technology like endpoint detection and response to search for malicious anomalies in a system or network.
Response & Resolution
Once the investigation is complete the final step of threat hunting is response and resolution. Using the results from the investigation provided by threat hunters, information security teams can work on responding to and mitigating any threats identified. The data collected from investigations can also be used to improve the technology used to identify threats, reducing overall human interaction and further automating the process of threat detection.
By the end of a threat hunting activity hopefully, the organisation would have learned more about their threat landscape and how future threats can be prevented. Threat hunting is something that should be taken seriously by every organisation, adding proactive measures on top of reactive cyber security solutions can greatly reduce the chances of facing any negative consequences of cyber attacks.
Six Benefits of Threat Hunting
Uncovers Hidden Threats
Implementing a threat hunting program in your organisation's cybersecurity strategy allows your organisation to proactively identify malware or any other threats that have managed to sneak into your network and systems. Threat hunting also does a great job of identifying and eliminating any malicious actors that may have gained access and are hiding in your networks and systems.
Faster Threat Response
The proactive nature of threat hunting helps keep your organisation one step ahead of the attackers, giving them less time to exploit gaps in automated threat detection before an attack is complete. By actively looking for threats, your organisation is better equipped to respond quickly when any anomalous activities are discovered.
Reduces damage and overall risk
Every day an intruder stays hidden adds to the potential financial and reputational cost of a breach. By finding attackers who have slipped past the initial defences and removing them early, threat hunting stops further damage before it happens and lowers the organisation's overall risk.
Helps improve defences
One of the main results of carrying out a threat hunting program is that it provides insights on how to improve your organisation's security to better defend against possible threats. Because threat hunting is carried out on the assumption that a potential threat has already occurred or a malicious actor is already present within your networks or systems, it provides valuable insight into how to improve your organisation's existing defences.
A more efficient approach to identifying threats
Threat Hunting utilises tools like security information and event management (SIEM) software products or an intrusion detection system (IDS) to help identify anomalies within your organisation's networks and systems, leading to more efficient identification of threats and giving the ability to counteract them.
Reduces Investigation Time
The results and knowledge gained from threat hunting exercises can significantly reduce the investigation time for security teams when an actual security incident occurs. Threat hunting provides organisations with a better understanding of their security capabilities, systems and networks along with their vulnerabilities.
How can StickmanCyber help?
StickmanCyber helps Australian organisations systematically identify, record and respond to potential cyber threats. Our Security Operations service provides a 24x7 SOC with managed SIEM and EDR, and our threat intelligence service feeds current indicators of compromise into that monitoring. Talk to a consultant today to learn more.
Frequently asked questions
What is the difference between threat hunting and threat intelligence?
Threat intelligence is information about threats: who the attackers are, how they operate and the indicators that reveal their activity. Threat hunting is the activity of searching your own environment for signs of those threats. Intelligence often supplies the starting point for a hunt, such as a new technique or indicator of compromise, and the results of a hunt can feed back into an organisation's intelligence.
How is threat hunting different from incident response?
Threat hunting is proactive: hunters search for attackers before any alert or confirmed incident. Incident response is reactive: it starts once an incident has been detected and focuses on containing it, removing the attacker and recovering. The two work together, because when a hunt uncovers malicious activity, it is handed to the incident response process to contain and resolve.
What is dwell time in cyber security?
Dwell time is how long an attacker remains inside a network before they are detected. Mandiant's M-Trends 2026 report put the global median at 14 days in 2025, up from 11 days the year before, and much longer for some types of intrusion, such as cyber espionage. Threat hunting aims to shorten dwell time by looking for intruders rather than waiting for an alert.
What data do you need to start threat hunting?
Hunters need visibility, so the starting point is good logging: endpoint, identity, network, server and cloud logs collected in one place, usually a SIEM, often with endpoint detection and response (EDR) tools. In Australia, ASD's Essential Eight maturity model expects organisations at higher maturity levels to centrally log important events and analyse them in a timely manner, which also builds the foundation that threat hunting relies on.
What is MITRE ATT&CK and how is it used in threat hunting?
MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. Threat hunters use it to build hypotheses around specific techniques, check which ones their logs can detect and describe their findings in a common language. ASD also uses ATT&CK techniques to analyse the incidents it reports on in its Annual Cyber Threat Report.
Can smaller Australian businesses benefit from threat hunting?
Yes, although few smaller organisations have the specialist staff to run their own hunting program. A common approach is to get the basics in place first, such as the Essential Eight, multi-factor authentication and good logging, and then use a managed security operations centre (SOC) whose analysts monitor and investigate on the business's behalf.
