Hypothesis-Driven Threat Hunting: Method and Execution

Recent SANS reporting shows attackers still leaning on living-off-the-land activity and nation-state tradecraft. That kind of activity rarely trips an alert, so finding it requires someone to go looking on purpose. Hypothesis-driven threat hunting is the structured way to do that: a specific, falsifiable statement about what an adversary could be doing in your environment, tested against defined data sources until it reaches a verdict.

The method is well documented. MITRE has set it out in detail since 2019, and in surveying the state of practice it cited SANS data showing 45.1% of organizations hunting through ad-hoc processes with no documented methodology, and another 27.1% working from internally defined methods. Those numbers look like a knowledge gap and are usually reported as one, but they track capacity more closely than understanding. Hunting competes for the same senior hours as alert investigation, so it runs when room opens up, and intermittent practice is what ad-hoc looks like from the outside.

TL;DR:

• Hypothesis-driven hunting is well suited to finding unknown threats. IOC sweeps and alert-driven investigation cover known threats; a falsifiable hypothesis about adversary behavior surfaces activity no rule was written for.
• Execution capacity now limits programs more than methodology design. Sqrrl, MITRE, TaHiTI, and PEAK all codify the hypothesis-test-verdict-feedback loop, yet hypothesis lists sit unexecuted because hunting competes with alert triage for the same experienced analysts.
• A refuted hypothesis is a successful hunt. Mature programs treat "not happening here" and "we have a visibility gap" as actionable outputs, and they convert confirmed findings into detections rather than filing a report.
• The emerging delivery model keeps humans on hypothesis design and puts AI agents on execution. Expert-defined, agent-executed hunting can make sustained, recurring hypothesis testing more operationally realistic. Full autonomy is further out: current outlooks put unsupervised remediation years away, and hypothesis suggestion arrives well before it.

The Method: From Hypothesis to Verdict

The canonical loop comes from Sqrrl's 2016 whitepaper and MITRE's report: generate a hypothesis, investigate with tools and techniques, discover patterns and TTPs, and enrich automated analytics with the findings. Its starting point still holds: a hunt begins with an educated, testable guess about activity that might be happening in your IT environment.

Falsifiability separates a workable hypothesis from a fishing expedition. SANS puts the bar at scoping every hypothesis so the team can either confidently disprove it or establish that it is happening and open an incident. Hunting has no point unless the team finishes confident that a given attack vector is ruled out.

A hunt-ready hypothesis sounds like this: "An account authenticating to multiple workstations within a short time window suggests use of valid accounts for lateral movement." It works because it names a behavior and implies the evidence that would confirm or refute it. Testing it for lateral movement means knowing which authentication telemetry to pull and what a normal pattern looks like for that account.

The loop closes when the verdict changes something. Sqrrl's fourth stage feeds findings back into automated detection, and SANS describes hunt output as feeding incident response when malicious activity is found or security monitoring when new detection methods are needed. A hunt that ends in a report nobody operationalizes broke the loop before it finished.

The Frameworks That Codified the Method

Four published models dominate structured hunting. They differ in vintage and in how they carve up the work, but each puts a hypothesis at the center and a feedback loop at the end.

Sqrrl Threat Hunting Loop (2016)

The original four-stage cycle from Sqrrl Data. Its companion Hunting Maturity Model grades organizations by hunting capability, from alert-centric operations toward more automated, data-driven hunting.

TaHiTI (2018)

Published by the Dutch financial sector's FI-ISAC NL, TaHiTI methodology runs six steps grouped into three named phases. The process moves from Initiate into Hunt before Finalize. The relationship with threat intelligence runs both ways: intelligence is a major source of hunting hypotheses and enriches hunts in progress, and hunting in turn generates new intelligence.

PEAK (2023)

The PEAK framework, published by Splunk's SURGe research team, stands for Prepare, Execute, and Act with Knowledge. Every PEAK hunt runs a three-stage process, with hunters selecting topics, researching, and planning during Prepare before any query is written. PEAK also goes further than the earlier models in naming three distinct hunt types: hypothesis-driven, baseline, and model-assisted.

MITRE ATT&CK-Based Hunting

ATT&CK is a technique knowledge base. MITRE's TTP hunting methodology uses it to frame detection hypotheses around adversary actions that translate into "specific, implementable analytics." In MITRE's account, behavior-focused models like ATT&CK surface new adversary behaviors and help prioritize detection for techniques that multiple adversary groups rely on. Combined with data modeling, they also expose where visibility is missing.

Adoption of formal methodology is improving: SANS found organizations with formally established threat hunting methodologies rose from 35% to 51% in the 2024 survey. Adopting a methodology and sustaining it are different problems, though. The 2025 survey found staffing, not threat modeling, setting the practical ceiling on what a program runs.

Where Good Hypotheses Come From

SANS identifies threat intelligence as a core driver for hypothesis generation, alongside domain knowledge and situational awareness about changes in the organization's threat model. Domain knowledge does double duty here: it supplies the adversary tradecraft a hypothesis describes, and it identifies the critical assets that determine which behaviors are worth testing first.

Intelligence-driven generation is the most common path. The SANS 2019 survey found 56% of respondents use threat intelligence such as adversary TTPs to hypothesize where attackers might be found: intelligence describes a behavior, and hunters test whether it exists in their own environment.

In practice, a TTP-driven hunt tests whether a valid account is authenticating across multiple hosts in a tight window or whether PowerShell is spawning suspicious commands on critical servers. An intelligence plus crown jewels hunt starts from a threat report describing activity against the organization's sector, then tests whether matching artifacts exist around sensitive systems. A situational hunt can follow Sqrrl's example of looking for compromise on the laptops of users who recently traveled abroad, tested as individual sub-hypotheses.

MITRE recommends starting from the telemetry you already collect. It also recommends beginning with early lifecycle stages such as initial access and discovery, or with technique bottlenecks most adversaries pass through, like credential dumping and remote system discovery.

How Hypothesis-Driven Compares to Other Hunt Types

The SANS 2019 survey found that only 35% of respondents would include hypothesis-driven hunting in their definition of threat hunting at all, which its authors called unexpected given how central the approach is to proactive hunting. The approach tends to demand more maturity than the alternatives, since teams need both the time and the expertise to build structured hunts before they can run them.

IOC-based sweeps sit at the other end. They are repeatable, they scale without senior time, and every mature program should run them. Their limit is definitional: they find what has already been publicly identified, and indicators go stale quickly. That makes IOC sweeping necessary without being sufficient. Unstructured hunting trades repeatability for hunter intuition, and it remains common: 43% of SANS 2019 respondents ran hunts on an ad hoc basis rather than as a formal program. Model-assisted hunting, PEAK's M-ATH, scales pattern discovery through machine learning but carries higher false-positive risk when models don't match operational reality.

The comparison below synthesizes how the four approaches behave in practice, drawn from the framework documentation and survey findings above. No single published benchmark covers all four.

‍

Few mature programs pick just one. A practical coverage model runs IOC sweeps against known campaigns while hypothesis-driven hunts carry the search for what nobody has catalogued yet.

Why Hypothesis-Driven Programs Stall

Sound hypotheses stall for reasons unrelated to the hypothesis itself. Four failure points account for most of it:

• Telemetry gaps. The hypothesis may be well formed, but the log source it depends on is missing, misconfigured, or retained for too short a window. A credential-dumping hypothesis cannot be tested if the underlying endpoint events were never collected. Record the visibility gap as an output and route it to telemetry engineering.
• Interrupted hunts. Momentum breaks when the same experienced hunters get pulled back into urgent alert queues, and rebuilding lost investigative context makes the resumed hunt slower and less reliable. The SANS 2025 survey found 61% of organizations cite skilled staffing shortages as their primary barrier.
• Undocumented verdicts. A hunt record should state whether the hypothesis was validated or disproved and list the data gaps, configuration gaps, and escalations it produced. In the same survey, only 51% of organizations reported formally measuring hunting effectiveness, down from 64% in 2024.
• Findings that go nowhere. A confirmed hunt finding should produce a detection, a telemetry change, or an escalation; a finding that produces none of the three has cost hunter time without reducing risk.

Where a finding does convert into a detection, David Bianco's Pyramid of Pain governs how much that detection is worth: it ranks indicator and behavior types by how costly they are for an adversary to change. MITRE CTID's Summiting the Pyramid work, published in December 2024, adds a scoring methodology for evasion resistance. This closed loop between hunting and detection engineering is where a program either compounds or resets, and it is often the part left unfinished.

Choosing How to Run Hypothesis-Driven Hunting

The 2025 SANS data shows organizations moving toward in-house programs, with full outsourcing dropping to 30% from 37% the year before. Choose conditionally, against what your team and telemetry can support:

• If your hunts keep getting deprioritized by alert triage, buy hunting capacity directly instead of more triage capacity. Alert investigation starts from something the stack already flagged; hunting starts from a question nothing has flagged yet. Adding headcount to the first does not produce the second.
• If you expect hunting from an existing contract, verify rather than assume. Ask how often hunts run, what triggers them, whether a documented hypothesis-driven methodology exists, whether experienced hunters run the investigations or less experienced staff execute canned searches, and what a sample hunt report contains. Get those answers before signing.
• If your environment is majority cloud, weight provider cloud maturity heavily. The SANS 2025 survey singles out cloud as one of the hardest environments to hunt in. No single log stream exposes the attack chain, so a hunter has to correlate identity activity, control-plane changes, and data-plane access before the sequence becomes readable. That same burden is what slows cloud incident response, so a provider weak at one is usually weak at the other.
• If threat hunting is core to your security mission and you're at high SOC maturity, build in-house. Budget it honestly against the full cost of staffing: a functioning program needs dedicated hunter time, infrastructure, enough team depth to avoid single-person dependency, and a ramp period before the first useful hunt.
• If you can't yet provide normalized multi-source telemetry, fix that before anything else. No delivery model, in-house or managed, can hunt past the limits of what you collect.

These options overlap. A common mature pattern pairs in-house detection engineering with a managed service supplying hunting cadence the internal team can't sustain.

Execution Capacity Is the New Bottleneck

Sqrrl, MITRE, TaHiTI, and PEAK converge on hypothesis, test, verdict, and feedback. None of them addresses throughput, because none of them can: a methodology can specify what a good hunt looks like, but it cannot manufacture the senior hours a good hunt consumes.

AI-executed hunting rests on a specific division of labor: humans define hypotheses, agents execute investigations. A 2026 agentic AI survey places adaptive threat hunting among the workflows these systems can sustain, on the strength of memory, tool use, and iterative decision cycles.

The limits are worth stating plainly. SecurityWeek's 2026 outlook expects agentic hunting to stay at the level of discrete agents handling individual tasks for now. An orchestrating agent that decides on and carries out remediation without a human is, in its assessment, "a long way off." The practitioners it quotes expect automation to reach hypothesis suggestion well before unsupervised action. So the model shipping today leaves hypothesis design with the experts and hands agents the iterative query-and-refine work that used to consume analyst weeks.

What This Changes for Managed Hunting

Most MDR providers will run IOC sweeps when a known active threat emerges, and buyers should confirm that coverage exists before assuming it. Hypothesis-based hunting is a different commitment, and in most engagements it sits outside scope, sold separately or not offered at all. The reason is the arithmetic the customer already knows: a provider carrying alert investigation across many environments is drawing on the same scarce expertise a hunt would need.

The agentic division of labor changes that arithmetic. Once experts own hypothesis design and agents carry the investigation underneath, hunt cadence becomes a scheduling decision instead of a staffing one.

Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its threat hunting service is one of three services running on that architecture, alongside MDR and the Agentic Security Data Lake. The people writing its hypotheses come from incident response, threat hunting, and detection engineering backgrounds, with over 10 years of experience and no juniors on the bench.

The service launch sets out the execution model. An expert defines the hypothesis and breaks it into structured analyses, deterministic extraction pulls up to 90 days of telemetry, and specialized agents then iterate on that dataset in parallel, each step shaped by the data instead of a fixed sequence. A central orchestration layer records the queries, decisions, and outputs at each iteration and enforces limits on how far a hunt runs, which is what makes an agent-executed investigation reviewable afterward instead of something taken on trust. Hunts run on a defined frequency, not whenever capacity frees up, and each ends either with all activity explained or with unexplained behavior escalated for investigation and, where it holds up, converted into a detection.

Measure the Backlog, Not the Framework

A program with a documented methodology and a hypothesis backlog it never clears does not have a methodology problem. The numbers worth tracking are the share of proposed hypotheses that reach a verdict and the lag between proposing one and testing it. Those two figures separate a design problem from a capacity problem, and the second takes a staffing or delivery-model decision to fix. Whichever path you choose, the discipline that makes hunting worth funding is the same one Sqrrl described in 2016. Record the verdict, log the gap, convert the finding.

Frequently Asked Questions About Hypothesis-Driven Threat Hunting

Is a Hunt That Finds Nothing a Failed Hunt?

No. A hunt can succeed by ruling out the behavior it was designed to test. If a well-scoped hypothesis produces no supporting evidence, the behavior is either not present in the environment or the team has uncovered a visibility gap. Both outcomes matter: one reduces uncertainty about a risk, the other becomes a telemetry engineering task. The hunts that tend to fail are those abandoned mid-thread with no verdict recorded either way.

What's the Readiness Test for a Hypothesis Before the Hunt Starts?

Capture it in one clear sentence naming the ATT&CK technique ID, the relevant data sources, and what evidence would settle it either way. If that sentence is vague, keep refining before execution. Peer review of the proposal, a practice documented in the SANS 2018 survey workflow, catches unfalsifiable framing before it wastes hunter time.

Does IOC Sweeping Count as Hypothesis-Driven Hunting?

Under a behavior-first definition of threat hunting, IOC sweeping falls outside hypothesis-driven hunting: IoCs relate to known threats, and known threats fall under detection and alerting capabilities rather than threat hunting. SANS takes a softer line, treating IOC hunting as a legitimate starting point on the maturity curve with progression toward hypothesis-based methods. The debate matters less than the coverage model. Run both, and keep the distinction visible when reporting on the program, because IOC sweep volume says nothing about how much behavioral hunting took place.

How Should Hunt Outputs Feed Detection Engineering?

Prioritize conversions by the Pyramid of Pain: TTP-level detections force adversaries to change behavior instead of rotating infrastructure. Treat each detection as a product, not a single commit. It needs analyst enablement, because whoever acts on it has to understand what it means and how to investigate it, plus testing, disciplined deployment, and ongoing tuning.

What Context Do Hunts Need Beyond Raw Telemetry?

Three kinds, and they are worth keeping distinct. Telemetry context covers the machine-readable material: asset inventories, network maps, user roles, and behavioral baselines. SANS observes that hunt teams eventually build "a deeper understanding of normal user behavior," down to standard working hours and typical login patterns, and that baseline is what makes an anomaly legible. Common cloud API calls appear constantly in healthy environments, so hunting on them without a baseline produces noise instead of leads.

The other two are harder to acquire because no tool emits them. Organizational context is the policies, sanctioned exceptions, and unwritten rules specific to one company, which is why a hypothesis that looks alarming in the abstract can be routine in a given environment. Historic context is the record of what past investigations concluded and why. Between them they determine whether a hypothesis can be scoped at all, and both depend on people documenting what they know, not on collection getting better.