Skip to content
←Back to glossaryCyber

Threat hunting

Proactive practice in which analysts actively search for signs of compromise within a network before any automated alert surfaces them.

Definition

On May 24, 2023, Microsoft and the Five Eyes agencies described Volt Typhoon, a Chinese state actor embedded in US critical infrastructure, Guam included. It worked almost entirely with administration tools already present on the machines. The joint advisory gave defenders hunting queries rather than signatures to block. Threat hunting starts from the premise that an attacker may already be inside a network without having triggered any automated alert, notably with living-off-the-land techniques or those typical of APT groups. The hunter forms hypotheses about an adversary's probable tactics, techniques and procedures, then tests them by querying logs, endpoint telemetry and network data. The work is human and iterative, and it complements automated tooling. It relies on frameworks such as MITRE ATT&CK to structure hypotheses. For cyber insurers, an in-house or contracted threat-hunting capability signals security maturity and can justify a lower premium or deductible. Threat hunting also cuts the attacker's average dwell time, the main variable driving loss severity. In AI environments, it extends to searching for anomalous behavior in inference pipelines, or for model drift that legitimate data changes do not explain.

Its 7 cross-references, woven across the glossary's 18 categories
Threat hunting: Cyber glossary illustration, AlgoPolis
Example

Textbook case: following the publication of a threat intelligence report signaling a campaign targeting European insurers, a hunt team spends three days searching for the associated IoCs (indicators of compromise) across infrastructure logs. No incident is confirmed, but the exercise is documented and shared with the cyber insurer at renewal as proof of reasonable diligence.

Read next
CyberThreat intelligence (cyber threat intelligence)Cyber threat intelligence, encompassing the collection and analysis of indicators of compromise and attacker tactics to anticipate and detect intrusions.Read the entry →CyberSOC / CIRT (Security Operations Center / Cyber Incident Response Team)Security monitoring and cyber incident response team, whose existence and maturity are a cyber underwriting criterion.Read the entry →CyberSIEM and SOARLog correlation and incident-response automation platforms that reduce threat detection and handling times.Read the entry →
Put it to work
QuizThe controls cyber underwriting looks at, and what they proveAcademy questions on this concept, each one marked and explained.Test yourself →SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.