Most break-ins today are a two-crew job. The first crew gets in quietly and sells the access, and the buyer is the one who does the damage. Alerts tend to fire at that second stage, so the break-in itself never shows up in the queue. Proactive threat detection means going after that first crew anyway, and threat hunting is how a SOC does it.
Here is what a hunting program takes to run, and where most of them stall.
Proactive threat detection is analyst-initiated investigation for adversary presence that has not yet triggered an alert. A person forms a hypothesis about how an attacker would operate in this specific environment, then goes looking for the evidence. The investigation begins before any rule has matched anything.
Proactive threat hunting is the hypothesis-driven searching that delivers proactive threat detection. In everyday SOC usage the two terms are interchangeable. Proactive threat detection names the outcome, and cyber threat hunting names the work. Threat hunting is proactive by definition. If an alert started it, it is triage, not a hunt.
Reactive detection waits for a rule to match. Proactive detection starts with a person's question. The contrast runs along three operational dimensions.
That last dimension is where most programs quietly fail. Tuning alerts improves what you catch inside the boundary of what you thought to look for. Hunting is how you find out what sits outside it.
The taxonomy most SOCs still work from splits detection into four categories, set out by Dragos analyst Selena Larson in 2018:
The useful conclusion is that proactive hunting lives in the modeling and threat-behavior rows. Indicator-based detection is the one type that cannot start a hunt, because you cannot search for an artifact nobody has seen yet. Mandiant reaches the same place from incident data, recommending defenders transition from static IOCs to behavioral anomaly detection as attackers rotate infrastructure and deploy in-memory malware.
Global median dwell time rose to 14 days from 11 in Mandiant's 2025 investigations, the first reversal after years of steady improvement. For cyber espionage and North Korean IT-worker cases, the median sat at 122 days. Mandiant groups those actors with insider threats as the set optimizing for extreme persistence, working through unmonitored edge devices to stay invisible. Dwell time is the budget an adversary gets to spend on reconnaissance, credential collection, and staging, and every extra day builds persistence you will have to unwind later.
At the other end of the range, Strike48's early enterprise deployments recorded MTTD below eight minutes, but only where complete telemetry coverage and parallel agentic investigation were both in place. Neither condition delivers that result alone.
Criminal specialization is what compressed the response window. Initial-access brokers now pre-stage the second group's malware and tunnels during the initial infection, so the operators who deploy ransomware are equipped the moment they touch the network. Mandiant measured that hand-off at more than eight hours in 2022 and at 22 seconds in 2025. The quiet interval between “someone got in” and “someone who intends harm got in” is gone. Alert-triggered response assumes a human reviews the alert while it still matters, and that assumption no longer holds.
Detection-by-source is the visible scoreboard, and it is genuinely improving. Organizations found the intrusion themselves 52% of the time in 2025, up from 43%. That still leaves nearly half of all intrusions surfacing because a customer, a law enforcement contact, or a third party noticed first.
None of this argues for abandoning alert-based detection. Hunting is additive. It covers the threat actors who route around your rules while the alert pipeline handles everything your rules already anticipate.
A hunting hypothesis can only be tested against the log sources a team is actually querying. Analyst skill cannot substitute for a source nobody ever connected, so data architecture sets the ceiling long before analyst competency or framework maturity does.
Unit 42's incident response research points the same way, attributing the large majority of breaches to preventable exposure gaps (limited visibility, inconsistent controls, excessive identity trust) more than to attacker sophistication. Hunting for advanced technique while basic segments stay unmonitored is effort misallocated.
The cause of those gaps is usually economic. Ingestion-priced log platforms force a decision at collection time about which sources justify the per-gigabyte cost. East-west network traffic, endpoint telemetry at volume, and identity logs are expensive and high-volume, which is exactly why they get trimmed. They are also where lateral movement and data exfiltration hide. Retention compounds the problem. Mandiant found espionage backdoors dwelling nearly 400 days, which a standard 90-day horizon cannot reach. The blind spot ends up engineered into the SOC before anyone runs a single hunt.
Strike48's 2026 survey of 100 security leaders found 84% report their tools cannot access all the log data they need, four out of five call the cost of keeping data live and searchable painful or a major budget concern, and 65% have had an investigation stall because data sat in a system their tools could not reach. Teams know where their gaps are, and the cost lands on live investigations.
Strike48's federated search queries logs where they already live, across S3, Splunk, Elastic, and existing data lakes, removing the migration barrier and the duplicate-storage cost that push teams into excluding sources. Coverage decisions then get made on risk rather than on what the ingestion line item tolerates. Where speed or normalization argues for centralizing a source, smart collection reaches most system types in under a day.
A well-formed hypothesis, say a test for a specific lateral-movement technique across a segment, returns a clean result when the relevant source was never connected. The hunt looks successful and the report says no evidence found. But the query ran against a partial view and produced a false negative that is indistinguishable, from the analyst's side, from a genuine all-clear.
This is why a coverage audit belongs on the dashboard as a prerequisite metric. A SOC that cannot state what fraction of its endpoint, identity, network, and cloud sources are queryable today does not yet know what its hunting results mean.
Four stages, each with a distinct failure mode.
Two realities make behavioral reasoning mandatory throughout. Identity weaknesses were material in nearly 90% of Unit 42's investigated breaches. And living-off-the-land tradecraft, where the adversary works entirely through legitimate administrative tooling, evades signature-based detection by design. CISA's Volt Typhoon advisory documents a state actor holding persistence across critical infrastructure this way for extended periods.
A threat hunting platform needs three things, and most teams already own pieces of all three. Queryable breadth across endpoint, identity, network, and cloud. You cannot test a hypothesis against a source you do not have. Cross-source correlation and behavioral baselining that persist between hunts. Teams who rebuild both with ad hoc scripts hit a throughput wall at a handful of hunts per week, because the analyst's time goes into data plumbing instead of reasoning about the adversary. And continuous monitoring with enough retention to cover the dwell times you are actually hunting for. CISA's event logging guidance covers the baseline posture all three depend on.
A dedicated hunting product is not on that list. Most proactive threat detection tools are recombinations of security analytics you already license. The gap is almost never a missing tool. It is a missing log source.
AI is where the reliability question gets sharp. A broad model asked to reason across an entire environment and surface anomalies produces outputs reflecting statistical patterns from training, which is a different thing from the environment being hunted. That is a knowledge-scope problem more than a model-quality problem, and it is worse in hunting than in triage, because a single alert constrains the question and an open hypothesis space does not. An overconfident anomaly list is a false lead your senior analysts will spend a day disproving.
Strike48's micro-agent architecture applies narrow task scoping and GraphRAG persona graphs to hunting hypotheses, the same anti-hallucination mechanism the platform uses for Tier 1 triage. Each agent gets one bounded job, a knowledge graph defining what it can know about your environment, and MCP tool constraints limiting what it can invoke, so its conclusions trace back to specific log data. Scoped agents reasoning over complete telemetry produce conclusions that are grounded and auditable step by step, which is the condition under which a SOC manager can defend a hunt result to a CISO or an auditor. Prospector Studio lets a team encode a recurring hypothesis as a standing agent through a no-code builder.
Proactive detection is a program decision before it is a headcount decision. Hiring skilled hunters without first solving telemetry coverage puts experienced people to work running hypotheses against partial data, and the output is false confidence documented in a report, which is worse than no hunting program at all.
The practical next step is a coverage audit. Work out what percentage of your endpoint, identity, network, and cloud sources are queryable today, as distinct from retained in cold storage. Once you know that number, the question becomes what investigation looks like when the gaps are closed. Strike48 combines federated search across your existing log stores with scoped agent investigation in one platform, covering proactive hunting and reactive triage from the same data foundation, with human approval gates on consequential actions like endpoint isolation and a verifiable audit trail on every agent action.
Audit coverage first, then run one hypothesis end to end. Pick a MITRE ATT&CK technique that matches your actual threat profile, constrain it to a log source you have confirmed coverage for, and document the result whether or not you find anything. Confirmed visibility beats technique sophistication on a first hunt. A clean result against a source you trust tells you something, and a clean result against an unverified source tells you nothing.
No. Strike48's search-in-place connectors query your existing SIEM alongside S3, Splunk, and Elastic without migration, so you close coverage gaps by connecting sources while the SIEM keeps doing what it already does.
Reactive work starts from a queued alert and follows a fixed triage path ending in a confirmation, an escalation, or a close. Proactive work starts from a hypothesis the analyst chose and runs open-ended with no guaranteed finding. It needs protected time on the calendar, and it loses every time it competes with whatever remains after the queue clears.
Ransomware is now the clearest case for hunting, because the operators arrive pre-equipped. Mandiant found prior compromise was the top initial infection vector in ransomware operations at 30%, double its 2024 share, and that operators increasingly target backup infrastructure, identity services, and virtualization management planes. The hunt-worthy hypotheses are the pre-ransomware ones, like unexpected access to backup objects, certificate-services misconfiguration, and hypervisor-layer activity.
An MDR provider brings hunters, not visibility. If your coverage gaps are the binding constraint, and for most teams they are, an outsourced hunting service inherits exactly the same blind spots your own analysts would, and you will pay for hypotheses run against partial data. Fix coverage first. The build-or-buy question is easier to answer once a hunt result means something.
Audit what percentage of sources across endpoint, identity, network, and cloud are queryable today, counting only what an analyst could search during an active investigation. Data retained in an archive nobody can query mid-hunt does not count toward coverage.