The Threat Hunting Flywheel: Why Threat Hunting Isn’t About Finding Bad Things

This article was originally published in the InfoSec Survival Guide: Teal Book — Threat Hunting. Read it free online HERE, or grab it on the Spearphish General Store (free digital download or a $1.25 physical copy, your call). | Here’s a counterintuitive truth: the ultimate goal of threat hunting isn’t to find more security incidents—it’s to drive continuous improvement across your entire security program. We’re not hunting merely to find present bad; we’re hunting to decrease the probability of future bad. Think of it like debugging. You don’t debug just to find bugs—you debug to build better software. Each bug you find teaches you something about your system, improves your testing, and makes future bugs less likely. Threat hunting works the same way. The Cyclical Nature of Threat Hunting Every threat hunting framework can be thought of as a cycle that improves with every revolution. Step 1: Determine Your Focus The biggest challenge in threat hunting? Answering this question: “Where do we even start?” You can’t just randomly poke around in logs hoping to find something interesting. You need a method to focus your efforts. The good news is that there are several effective approaches, and you don’t have to pick just one. In fact, most mature programs blend approaches over time. Hypothesis-driven hunting starts with an educated guess, perhaps informed by the latest threat intelligence. Maybe something like, “I bet adversaries are using scheduled tasks for persistence on our web servers.” Baseline hunting flips the question entirely: instead of rooting around for specific threats, you map what “normal” looks like in your environment, then investigate anything that doesn’t fit the pattern. Statistical analysis tools like RITA let you approach those patterns from yet another angle. They surface statistically weird behaviors and connections, giving you a prioritized list of anomalies to consider and maybe investigate. Machine learning models can highlight specific events that deviate from learned baselines, essentially saying “start here” with confidence scores attached. Step 2: Investigation The real detective work happens here. Investigation is iterative and rarely linear. You start broad, progressively narrow your focus by filtering out known-good activity, and follow interesting patterns wherever they lead. One scheduled task leads to a user account, which leads to authentication logs, which leads to source IPs, which leads to ... you get it. The “art” is knowing which threads to pull and which to drop. Something can be technically anomalous but contextually benign, like a DBA running weird queries at 2 AM because production is on fire. Step 3: Discovery and Analysis Eventually you reach a conclusion. Maybe you found a threat. Awesome! Now hand it to incident response. But maybe, or most likely in fact, you found nothing… Here’s the critical mindset shift: finding nothing isn’t failure. It’s validation—discovery of a different kind, even. A thorough hunt might confirm that your defenses are working and that an attack isn’t happening (win!). Or it might reveal that a detection you thought existed doesn’t, or that it’s misconfigured and wouldn’t fire even if the attack happened (also a win because now you know what to fix). Approached with this mindset, any outcome is a win, and every hunt ultimately makes you more secure. Step 4: Knowledge Refinement and Improvement This is where threat hunting transforms from investigation into force multiplication. Everything you’ve learned feeds back into your security program: - Create detection rules so you don’t have to manually hunt for the same thing again. - Document baselines about normal behavior in your environment. - Share knowledge with your team and the wider community (Document!). - Generate new hypotheses for the next hunt (Back to Step 1...). - Close visibility gaps you discovered. - Measure and communicate your program’s value. This phase is what makes hunting a continuous improvement engine. Each excursion expands detection coverage, deepens environmental knowledge, sharpens hunting skills, and strengthens overall security posture. The Self-Improving Loop The real power of this hunting “loop” is its cumulative nature. Your first few hunts might feel slow and uncertain. But knowledge accumulates. Patterns become obvious. Investigation approaches become routine. Organizations committed to sustained hunting programs often hit critical mass around 12–18 months, where value accelerates dramatically. Remember: You’re not just looking for today’s threats. You’re building tomorrow’s defenses. Every rotation improves your skills, the program, and the rotations themselves. That’s the threat hunting flywheel. Explore the Infosec Survival Guide and more… for FREE! Get instant access to every issue of the Infosec Survival Guide, as well as our self-published infosec zine PROMPT#, and exclusive Darknet Diaries comics — all available at no cost.